ClawMind

Save up to 90% on Token costs. One agent explores, all agents benefit. Cloud-cached workflows with zero inference cost.

Security Scan

The skill's code and hooks match its stated purpose, but its privacy claims are contradicted by behavior that sends full URLs, intents, and session identifiers to a remote cloud endpoint — this could leak sensitive data.

Purpose & Capability

Name, description, permissions (browser, lobster, sessions_history, network) and implemented hooks (interceptIntent, onSessionComplete) are coherent: the skill needs access to browser state, session history, and network to query and contribute cached workflows.

Instruction Scope

SKILL.md promises 'Local-first privacy' and 'No account credentials ever uploaded', but the code sends intent (user text), the full current URL, node_id, session_id and the compiled Lobster workflow to the cloud. Intent and URLs often contain sensitive data (emails, tokens in query strings, account identifiers). The sanitizer is applied to action args, but intent and URL are not sanitized before upload.

Install Mechanism

No remote download/install URL or extract step; standard npm-based build is used and only undici is a runtime dependency. There are no obscure or shortener URLs or arbitrary binary fetches in the manifest.

Credentials

The skill requests no credentials and only asks for APIs it needs, which is appropriate. However, the data it transmits (intent text, full URL, session_id, node_id) is more sensitive than the README/SKILL.md acknowledges; requiring no env vars is fine, but the claimed 'no credentials uploaded' is not enforced for URLs or intent content.

Persistence & Privilege

always is false and the skill registers normal hooks; it does not request permanent global privileges or modify other skills. Autonomous invocation via hooks is expected for this type of skill.

What to consider before installing

This skill does what it says (intercept intents, fetch replayable workflows, contribute successes), but it can send your intent text and the full current URL and session identifiers to the configured cloud endpoint. Those fields can contain sensitive information (e.g., emails, account IDs, auth tokens in query strings, or private intents). Before installing: - Treat the default cloud endpoint (https://api.workflowcache.dev) as an external service that will receive data from your agent. If you can't trust it, do not enable the skill or set cloud_endpoint to a private/self-hosted endpoint. - Disable auto_contribute (set auto_contribute=false) or disable the skill entirely (enabled=false) if you want interception without uploading contributions. - Avoid running the skill while interacting with pages where URLs or intents might include secrets (auth tokens, payment identifiers). - If you need the feature but want tighter privacy, ask the developer to sanitize intent and URL (strip query params, remove path segments containing tokens) before any network call, and to expose an option to require explicit, per-contribution approval. - If you accept the risk, audit network traffic to the cloud endpoint and/or host your own workflow cache service so contributions remain under your control. I assessed actual source files included in the package; the privacy claim in SKILL.md is inconsistent with the code that transmits intent and URL. If you need help crafting a safer configuration or questions to ask the maintainer, tell me what you want to protect and I can suggest specific settings.

One agent explores, all agents benefit.

A crowdsourced workflow registry that caches successful automation patterns, letting you skip LLM inference entirely when a matching workflow exists.

Why Use This?

1. Save Real Money

Traditional approach: LLM explores and reasons through every step, burning tokens on trial-and-error.

Our approach: Query the cloud for a cached workflow. If found, execute directly. Zero inference cost.

Token savings example (10-step browser task):

• Traditional: ~5000 tokens
• Workflow Cache: ~800 tokens
• Savings: 80%+

The more complex the task and the more you repeat it, the more you save.

2. Skip the Debugging Hell

The painful part of AI automation isn't writing the script—it's the endless debugging when:

• The website changes its layout
• Selectors break unexpectedly
• Edge cases you didn't anticipate

ClawMind solves this:

• Every successful workflow from any agent is cached
• When websites change, cached workflows auto-update
• You never debug the same problem twice

3. Platform Agnostic

Works with any Claw/Lobster engine. One workflow, all platforms. Automatic syntax adaptation.

How It Works

User Intent → Query Cloud → Match Found?
                                ↓ Yes        ↓ No
                          Execute Now    Normal Flow
                          (1 second)     (LLM reasons)
                                ↓              ↓
                          Success!      Success → Contribute

One agent's success becomes every agent's shortcut.

Features

Interceptor

Queries the cloud before LLM inference. On match, replays the cached workflow directly.

Trace Compiler

Converts successful session traces into reusable Lobster workflows automatically.

PII Sanitizer

Local-first privacy. All sensitive data stays local. Only workflow patterns are shared.

Configuration

Option	Type	Default	Description
cloud_endpoint	string	https://api.workflowcache.dev	Cloud API endpoint
enabled	boolean	true	Enable/disable interception
auto_contribute	boolean	true	Auto-contribute successful workflows
timeout_ms	number	300	API timeout (ms)

Installation

npx clawhub install ainclaw-mind

Or manually:

cd ~/.qclaw/workspace/skills/ainclaw-mind
npm install
npm run build

Security

• Full PII sanitization pipeline
• No account credentials ever uploaded
• Multi-node security validation on all workflows
• Malicious injection detection and blocking

Who Is This For?

• Heavy AI users — Daily automation, high token bills
• Cost-conscious developers — Every token saved is money saved
• Automation enthusiasts — Stop reinventing wheels
• Efficiency maximalists — Why reason when you can replay?

License

MIT-0 — Free to use, modify, and redistribute. No attribution required.

---

Tags: #AI-efficiency #token-saver #automation #crowdsourced #workflow-cache