Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Hermes Learning Loop

v1.0.0

Self-improving learning loop inspired by Hermes Agent. Automatically extracts successful workflows, creates skills, and persists knowledge across sessions.

0· 151·0 current·0 all-time
by陈子昂@mystour

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mystour/hermes-learning-loop.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Hermes Learning Loop" (mystour/hermes-learning-loop) from ClawHub.
Skill page: https://clawhub.ai/mystour/hermes-learning-loop
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install hermes-learning-loop

ClawHub CLI

Package manager switcher

npx clawhub@latest install hermes-learning-loop
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code and SKILL.md implement a learning loop that inspects recent tasks, extracts workflows, writes MEMORY.md/USER.md entries and generates SKILL.md files under a skills directory. Those capabilities align with the stated purpose (self-improving agent and skill creation).
!
Instruction Scope
Instructions and the script direct the agent to read session data, evaluate and persist curated memories, and create skill files. The SKILL.md explicitly references using a 'system prompt' for reflection (prompt injection pattern detected). The agent is given broad discretion to decide what to persist, which risks storing sensitive context. The script also references loading sessions and recent tasks (getRecentTasks/loadSession) — those functions are truncated in the provided listing; you should verify they don't read arbitrary files or external endpoints.
Install Mechanism
No install spec or external downloads are present; the skill is instruction-only plus an included JS script. Nothing in the manifest attempts to fetch remote archives or run third-party installers.
Credentials
The skill requests no credentials and only mentions non-sensitive environment variables (nudge interval, min tool calls, skills dir, auto-create). These settings are proportionate to its task. It uses the workspace and a .openclaw directory to store state; that is expected but worth noting because it writes to user files.
!
Persistence & Privilege
The skill intentionally writes new SKILL.md files into the user's skills directory (~/.openclaw/skills or configurable LEARNING_SKILLS_DIR) and persists state in .openclaw/.learning-state.json. Creating or updating other skill files is powerful: if AUTO_CREATE is enabled (configurable via env), the skill can persist new skills without interactive approval. Combined with the prompt-override pattern, this raises the possibility of persistent, self-propagating behavior that should be reviewed.
Scan Findings in Context
[system-prompt-override] unexpected: SKILL.md and architecture text include lines like 'System prompt: "Reflect on recent activity"' and the pre-scan flagged a system-prompt-override pattern. While internal reflection prompts are relevant to a learning loop, instructions that override or set system-level prompts are sensitive because they can change high-privilege agent behavior. Verify what the code actually does with prompts and ensure it does not replace or persist system prompts globally.
What to consider before installing
This skill mostly does what it says (extracts workflows and writes skill files), but there are two things to check before installing: (1) prompt-override risk — the SKILL.md contains text flagged as 'system-prompt-override'; review the JS to confirm it does not set or persist system-level prompts or otherwise inject prompts into privileged contexts; (2) persistence into skills dir — the script writes SKILL.md files into ~/.openclaw/skills (or a configured directory) and can auto-create skills if AUTO_CREATE is enabled. To reduce risk: run the skill in a sandboxed workspace first (set OPENCLAW_WORKSPACE to an isolated folder), set LEARNING_AUTO_CREATE=false, set LEARNING_SKILLS_DIR to a non-global path you control, inspect loadSession/getRecentTasks implementations to ensure they don't read arbitrary files or call external endpoints, and review any generated SKILL.md files before placing them into your real skills directory. If you are not comfortable auditing the code, avoid installing or only use it in an isolated environment.
!
SKILL.md:80
Prompt-injection style instruction pattern detected.
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

automationvk97ehger639fvdgb59j8w4tsxh844brghermesvk97ehger639fvdgb59j8w4tsxh844brglatestvk97ehger639fvdgb59j8w4tsxh844brglearningvk97ehger639fvdgb59j8w4tsxh844brgself-improvementvk97ehger639fvdgb59j8w4tsxh844brg
151downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Hermes Learning Loop for OpenClaw

Inspired by: NousResearch/hermes-agent (Self-improving AI agent)

Implements Hermes Agent's core learning loop in OpenClaw — automatically extracts successful workflows, creates reusable skills, and persists curated knowledge across sessions.

When to Use

  • After completing complex multi-step tasks
  • When you discover a workflow worth repeating
  • Automatically via heartbeat (periodic nudge)
  • When user says "remember this" or "save this workflow"

Features

  • Periodic Nudge — Auto-reflect every N tasks (default: 5)
  • Skill Extraction — Convert successful workflows to reusable skills
  • 4-Layer Memory — Prompt memory + Session search + Skills + User modeling
  • Curated Memory — Agent decides what's worth keeping (not logging everything)
  • Progressive Disclosure — Only load skill summaries by default, full content on-demand
  • FTS5 Session Search — SQLite-powered historical context retrieval

Quick Start

Install

clawhub install hermes-learning-loop

Manual Trigger

# After completing a task
node learning-loop.js extract --session=<session_id>

# Create skill from workflow
node learning-loop.js create-skill --name="my-skill" --description="What it does"

# Periodic nudge (heartbeat)
node learning-loop.js nudge

Auto-Trigger (Integration)

Add to HEARTBEAT.md:

## Learning Loop - Periodic Nudge

**Frequency:** Every 5 tasks or 30 minutes

**Task:**
1. Run `node learning-loop.js nudge`
2. Review extracted memories
3. Approve/reject skill creations

Architecture

Learning Loop Cycle

┌─────────────────────────────────────────────────────────┐
│  1. Task Execution                                      │
│     - Agent completes task                              │
│     - Track tool calls, decisions, outcomes             │
└──────────────┬──────────────────────────────────────────┘
               │
               ▼
┌─────────────────────────────────────────────────────────┐
│  2. Periodic Nudge (every 5 tasks)                      │
│     - System prompt: "Reflect on recent activity"       │
│     - Agent evaluates: Is this worth persisting?        │
└──────────────┬──────────────────────────────────────────┘
               │
               ▼
┌─────────────────────────────────────────────────────────┐
│  3. Memory Extraction                                   │
│     - If valuable → Write to MEMORY.md / USER.md        │
│     - If workflow → Create skill file                   │
│     - If context → Index in session archive             │
└──────────────┬──────────────────────────────────────────┘
               │
               ▼
┌─────────────────────────────────────────────────────────┐
│  4. Skill Creation                                      │
│     - Extract steps, tool calls, file references        │
│     - Write to ~/.openclaw/skills/<category>/<name>/   │
│     - Follow agentskills.io specification               │
└─────────────────────────────────────────────────────────┘

4-Layer Memory System

LayerPurposeLocationLoad Timing
Prompt MemoryAlways-on contextMEMORY.md, USER.mdEvery session start
SkillsProcedural memory (how-to)~/.openclaw/skills/On-demand (summary → full)
Session ArchiveEpisodic memory (what happened)SQLite + FTS5Deliberate retrieval
User ModelBehavioral patternsOptional (Honcho-like)Continuous passive

Skill Triggers

Automatically create skill when:

  • ✅ 5+ tool calls in sequence
  • ✅ Recovered from error successfully
  • ✅ User corrected → fixed approach
  • ✅ Non-obvious workflow that worked
  • ✅ Repeated pattern detected (3+ times)

Usage Examples

Example 1: Post-Task Skill Extraction

# After completing complex deployment
export SESSION_ID="2026-04-03-deploy"
export TASK_OUTCOME="success"
export TOOL_CALLS="15"

node learning-loop.js extract

Output:

📊 Learning Loop Analysis

✅ Task completed successfully
📈 Tool calls: 15
⚠️  Error recovery: 2 instances
💡  User corrections: 1

🎯 Skill-worthy detected: YES

Proposed skill:
  Name: deploy-to-k8s
  Description: Deploy application to Kubernetes with health checks
  Steps: 7
  Tool calls: 15

📄 Created: ~/.openclaw/skills/devops/deploy-to-k8s/SKILL.md

Example 2: Periodic Nudge

# Heartbeat triggers this
node learning-loop.js nudge

Output:

🔔 Periodic Nudge - Task #5

Looking back at tasks 1-5...

Task 1: ✅ Simple (no extraction needed)
Task 2: ✅ Complex workflow detected
  → Extracted: "github-pr-workflow"
Task 3: ✅ Error recovery pattern
  → Extracted: "debug-python-import"
Task 4: ✅ Simple
Task 5: ✅ User correction applied
  → Updated: "github-pr-workflow" (v1.0.1)

📊 Summary:
  - New skills: 2
  - Updated skills: 1
  - Memory entries: 3

Example 3: Memory Curation

# Review what's worth keeping
node learning-loop.js curate --session="2026-04-03"

Decision Framework:

┌──────────────────────────────────────────────────────┐
│ Should this be persisted?                            │
├──────────────────────────────────────────────────────┤
│ ❌ Chat pleasantries → Discard                       │
│ ❌ Failed attempts → Discard (keep only success)     │
│ ✅ Successful workflows → Extract as skill           │
│ ✅ User preferences → Add to USER.md                 │
│ ✅ Project context → Add to MEMORY.md (project/)     │
│ ✅ Corrections/feedback → Add to MEMORY.md (feedback/)│
└──────────────────────────────────────────────────────┘

Configuration

Environment Variables

VariableDescriptionDefault
LEARNING_NUDGE_INTERVALTasks between nudges5
LEARNING_MIN_TOOL_CALLSMin tool calls for skill5
LEARNING_AUTO_CREATEAuto-create skills (vs approve)false
LEARNING_SKILLS_DIRSkills directory~/.openclaw/skills/
LEARNING_MEMORY_DIRMemory directory~/.openclaw/memory/

Config File

# ~/.openclaw/learning-loop.yaml
learning:
  nudge:
    enabled: true
    interval: 5  # tasks
    
  skill_creation:
    auto_approve: false  # Review before creating
    min_tool_calls: 5
    categories:
      - devops
      - research
      - productivity
      
  memory:
    max_prompt_chars: 3575  # Hermes-style tight limit
    archive_enabled: true
    fts5_enabled: true

Skill File Format

Follows agentskills.io specification:

---
name: deploy-to-k8s
description: Deploy application to Kubernetes with health checks
version: 1.0.0
platforms: [linux, macos]
metadata:
  tags: [kubernetes, devops, deployment]
  category: devops
  created_from: session-2026-04-03
---

# deploy-to-k8s

## Overview

Deploy any application to Kubernetes cluster with automated health checks and rollback.

## Prerequisites

- kubectl configured
- Kubernetes cluster access
- Docker image ready

## Steps

1. **Validate cluster connection**
   ```bash
   kubectl cluster-info
  1. Apply deployment manifest

    kubectl apply -f deployment.yaml
    
  2. Wait for rollout

    kubectl rollout status deployment/app
    
  3. Health check

    kubectl get pods -l app=myapp
    
  4. Verify service

    kubectl get svc app-service
    

Tool Calls Used

  • exec: kubectl commands
  • read: deployment.yaml
  • web_search: Kubernetes docs (if errors)

Related Skills

  • docker-build-optimization
  • k8s-troubleshooting

## Integration with OpenClaw

### Heartbeat Integration

```markdown
## HEARTBEAT.md Update

### Learning Loop - Periodic Nudge

**Frequency:** Every 5 tasks

**Steps:**
1. Check task counter
2. If counter % 5 == 0 → Run nudge
3. Review proposed skills/memories
4. Approve/reject
5. Reset counter

PUA Integration

# Task PUA can trigger learning loop
if task.failed && task.recovered:
  node learning-loop.js extract --reason="error-recovery"
  
if task.pua_level >= "L2":
  # Complex task → likely skill-worthy
  node learning-loop.js nudge

Memory PUA Integration

# Memory health check includes learning loop status
node memory-pua.js audit

# Output includes:
# - Skills created this week
# - Memories curated
# - Nudge effectiveness

Comparison: Hermes vs This Implementation

FeatureHermes AgentThis Skill
Periodic Nudge✅ Built-in✅ Via heartbeat
Skill Auto-Creation✅ Full auto⚠️ Opt-in approval
4-Layer Memory✅ SQLite + FTS5⚠️ Markdown + optional SQLite
Progressive Disclosure✅ Summary → Full✅ Same pattern
User Modeling (Honcho)✅ Optional❌ Not implemented
Gateway Integration✅ Multi-platform⚠️ OpenClaw channels only
Context Compression✅ Lineage-aware⚠️ Basic summarization

Benefits

  • Curated not dumped — Agent decides what's worth keeping
  • Token-efficient — Progressive disclosure keeps context small
  • Portable skills — Follows agentskills.io standard
  • Self-improving — Gets better the more you use it
  • OpenClaw native — Works with existing memory system

Related Skills

  • claude-memory-optimizer: Memory structure and migration
  • task-pua: Task persistence and quality
  • memory-pua: Memory health maintenance

References

License

MIT-0


Version 1.0.0: Initial implementation inspired by Hermes Agent learning loop

Comments

Loading comments...