Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Self-Evolving Agent (Lorin)

v1.0.0

自我进化智能体 — 自动捕获错误+主动提炼经验+自动生成SKILL,三位一体持续进化。灵感来源:Hermes Agent skill_manage + pskoett self-improving-agent

0· 74·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lorinwei/lorin-self-evolving-agent.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Self-Evolving Agent (Lorin)" (lorinwei/lorin-self-evolving-agent) from ClawHub.
Skill page: https://clawhub.ai/lorinwei/lorin-self-evolving-agent
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install lorin-self-evolving-agent

ClawHub CLI

Package manager switcher

npx clawhub@latest install lorin-self-evolving-agent
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (self-improvement / skill extraction) match the shipped artifacts: hooks to inject reminders, an error detector script, and a skill-extraction script. The requested filesystem operations (creating .learnings and writing SKILL.md under skills/) and hook usage are expected for this feature.
Instruction Scope
SKILL.md and hook docs instruct the agent to capture errors, log learnings, and optionally promote them into skill files; hooks/scripts operate on local workspace files and suggest using platform session APIs (sessions_history/sessions_send). This is within scope, but the hooks/scripts will see command output and (if configured) may reference other session transcripts — enable only when you accept that local command output and session data may be inspected.
Install Mechanism
No remote downloads or package installs; the skill is instruction-plus-local-scripts. Scripts and handlers are provided in the bundle and create files under a relative skills/ or .learnings/ path. extract-skill.sh includes path validation to avoid writing outside the workspace.
Credentials
The skill declares no required credentials (good). Scripts expect a platform-provided environment variable CLAUDE_TOOL_OUTPUT for PostToolUse hooks; this env var is not listed in metadata but is a platform convention. The skill does not request unrelated secrets or cloud credentials.
Persistence & Privilege
The skill is not always-on and is user-invocable; hooks are opt-in and must be copied/enabled by the user. The hook code only injects a virtual reminder file and the scripts create files only when run. No modification of other skills or global agent internals is observed.
Assessment
This skill appears to do what it says: capture errors, prompt you to log learnings, and scaffold extracted skills. Before enabling it: (1) review the provided scripts (activator.sh, error-detector.sh, extract-skill.sh) to ensure you’re comfortable with local file writes; (2) be aware the error detector reads the platform variable CLAUDE_TOOL_OUTPUT (it examines command output) and hooks will see tool outputs and—if you use session APIs—may access other session transcripts; (3) enable the hooks only if you want those reminders and local file updates, and run extract-skill.sh from a directory you control (it prevents absolute/.. writes but will create files under the current workspace). If you need additional assurance, ask the maintainer for a signed provenance or run the scripts in a sandbox first.

Like a lobster shell, security has layers — review code before you run it.

latestvk978ctqfv07n5g60trf875x7kn84mv00
74downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

自我进化智能体 (Self-Improving Agent)

三位一体:自动捕获错误(Hook) + 主动提炼经验(Skill化) + 遗忘曲线复习(Promote)

每一次踩坑都不会白费,每一个经验都会变成可复用的 Skill。


核心循环

工具调用失败/用户纠正/发现新工作流
         ↓
  ┌──────┴──────┐
  ↓             ↓
自动捕获     主动判断
(.learnings)   (Skill化)
  ↓             ↓
  ↓         是否值得固化成Skill?
  ↓             ├─ 否 → 保持原样
  ↓             └─ 是 → 创建/更新 SKILL.md
  ↓                      ↓
  ↓              是否普遍适用?
  ↓             ├─ 否 → 保持为Skill
  ↓             └─ 是 → Promote到 SOUL.md / AGENTS.md / TOOLS.md
  ↓
定期回顾
  ↓
Recurrence-Count ≥ 3 → 系统级规则

第一层:自动捕获(Hook层)

触发时机(自动,无需人工判断)

场景自动日志目标文件
命令失败(exit code ≠ 0)error-detector.sh hook.learnings/ERRORS.md
工具调用异常Agent自觉判断.learnings/ERRORS.md
PostToolUse 扫描到错误模式hook自动注入.learnings/ERRORS.md

错误检测模式(自动匹配)

error:, Error:, ERROR:, failed, FAILED,
command not found, No such file, Permission denied,
fatal:, Exception, Traceback, npm ERR!,
ModuleNotFoundError, SyntaxError, TypeError,
exit code, non-zero

如果检测到:自动在输出中注入提醒,建议写入 .learnings/ERRORS.md


第二层:主动提炼(Skill层)

触发时机(Agent主动判断)

场景日志类型目标
复杂任务成功(≥5工具调用)经验→ 考虑创建Skill
踩坑后找到正确路径错误+解决→ 创建Skill记录坑+解法
用户纠正("不是这样")纠正→ 记录纠正内容
发现 nontrivial 工作流最佳实践→ 主动创建Skill
配置/环境特殊性知识→ 记录环境差异

是否值得创建Skill?决策树

这个任务以后还会遇到吗?
  ├─ 否 → 不用创建
  └─ 是 → 涉及 ≥2 个步骤?
            ├─ 否 → 不用创建(太简单)
            └─ 是 → 这个流程容易忘吗?
                      ├─ 否 → 不用创建
                      └─ 是 → ✓ 创建Skill

Skill 创建标准(满足任一即可)

标准描述
Recurring有 2+ 个相似问题(See Also 链接)
Verified已验证可行(有解决方案)
Non-obvious需要实际调试才发现
Broadly applicable跨项目适用
User-flagged用户说"把这个存成Skill"

第三层:升华提炼(Promote层)

Promote 触发条件

当学习内容满足以下全部条件时,提升到系统级文件:

  • Recurrence-Count ≥ 3
  • 跨至少 2 个不同任务发生
  • 在 30 天内重复出现

Promote 目标

学习类型提升目标
行为模式SOUL.md
工作流改进AGENTS.md
工具坑/GotchaTOOLS.md
项目规范MEMORY.md
普遍适用技能新Skill(提取)

日志格式

Learning 条目 → .learnings/LEARNINGS.md

## [LRN-YYYYMMDD-XXX] category

**Logged**: ISO-8601 timestamp
**Priority**: low | medium | high | critical
**Status**: pending
**Area**: frontend | backend | infra | tests | docs | config

### Summary
一句话描述学到了什么

### Details
完整上下文:发生了什么、哪里错了、正确的是什么

### Suggested Action
具体修复或改进

### Metadata
- Source: conversation | error | user_feedback
- Related Files: path/to/file.ext
- Tags: tag1, tag2
- See Also: LRN-YYYYMMDD-XXX
- Recurrence-Count: 1
- First-Seen: YYYY-MM-DD
- Last-Seen: YYYY-MM-DD

---

Error 条目 → .learnings/ERRORS.md

## [ERR-YYYYMMDD-XXX] skill_or_command

**Logged**: ISO-8601 timestamp
**Priority**: high
**Status**: pending
**Area**: frontend | backend | infra | tests | docs | config

### Summary
简要描述什么失败了

### Error

实际错误信息


### Context
- 尝试的命令/操作
- 使用的输入或参数
- 环境详情(如相关)

### Suggested Fix
如果可识别,给出解决方案

### Metadata
- Reproducible: yes | no | unknown
- Related Files: path/to/file.ext
- See Also: ERR-YYYYMMDD-XXX

---

Feature Request 条目 → .learnings/FEATURE_REQUESTS.md

## [FEAT-YYYYMMDD-XXX] capability_name

**Logged**: ISO-8601 timestamp
**Priority**: medium
**Status**: pending
**Area**: frontend | backend | infra | tests | docs | config

### Requested Capability
用户想要什么能力

### User Context
为什么需要,解决什么问题

### Complexity Estimate
simple | medium | complex

### Suggested Implementation
如何实现

### Metadata
- Frequency: first_time | recurring
- Related Features: existing_feature_name

---

Skill 生命周期管理

1. 创建新 Skill

满足 Skill 创建标准时,用 write 工具创建:

~/.openclaw/workspace/skills/<category>/<skill-name>/SKILL.md

SKILL.md 标准格式:

---
name: <skill_name>
description: 一句话描述技能及适用场景
version: 1.0.0
triggers:
  - "触发条件1"
  - "触发条件2"
---

# 技能标题

## When to Use
什么情况下用这个技能

## Procedure
1. 步骤一
2. 步骤二

## Pitfalls
- 已知失败模式

## Verification
如何验证成功

2. 更新 Skill

edit 工具增量修改(避免全量替换):

# patch 场景
## Pitfalls
- 原来只有1条,新发现1条 → edit 追加

# edit 场景
## Procedure
整个流程变了 → 全量替换

3. 删除过时 Skill

当 Skill 不再适用时:

rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/

4. Skill 提取自动化

当 Learning 满足 Skill 创建标准时,运行提取脚本:

./scripts/extract-skill.sh <skill-name> --dry-run  # 预览
./scripts/extract-skill.sh <skill-name>              # 执行

5. Skill 命名规范

类型格式示例
单工具<tool>_<brief>mysql_connect_prod
多工具流程<domain>_<task>deploy_k8s_rolling_update
环境坑<env>_<issue>aws_ssh_port_2222
最佳实践<domain>_<best_practice>git_commit_conventional

6. Category 参考

  • debug/ — 排错、调试
  • devops/ — 部署、运维
  • workflow/ — 工作流程
  • platform/ — 平台集成
  • learned/ — 从错误中学习

Hook 配置(可选,推荐开启)

自动错误检测 Hook

cp -r hooks/openclaw ~/.openclaw/hooks/self-improvement
openclaw hooks enable self-improvement

Hook 触发条件

Hook触发时机功能
activator.shUserPromptSubmit提醒评估学习
error-detector.shPostToolUse (Bash)自动检测错误

定期回顾

触发时机

  • 新任务开始前
  • 任务完成后
  • 每周/每两周

快速检查

# 统计待处理项
grep -h "Status**: pending" .learnings/*.md | wc -l

# 查看高优先级项
grep -B5 "Priority**: high" .learnings/*.md | grep "^## \["

# 查找特定领域的学习
grep -l "Area**: backend" .learnings/*.md

回顾行动

  1. 解决已修复的项
  2. 将普遍适用的学习 Promote
  3. 链接相关条目
  4. 升级反复出现的问题

容量管理

Skill 不是越多越好,而是精炼、可操作

  • :简洁、步骤清晰、一看就懂
  • :大段叙述、过于通用、缺乏具体性

超过 200 行的 Skill 考虑拆分。


ID 生成规则

格式:TYPE-YYYYMMDD-XXX

  • TYPE:LRN(学习)、ERR(错误)、FEAT(功能请求)
  • YYYYMMDD:当前日期
  • XXX:序号(如 001

示例:LRN-20260411-001, ERR-20260411-A3F, FEAT-20260411-002


与 skill_evolve 的区别

维度skill_evolveself-improving-agent(本技能)
架构纯 SKILL.md 指令SKILL.md + Hook 脚本 + 三层日志
触发Agent 主观判断Hook 自动 + 主动判断结合
错误捕获依赖 Agent 自觉error-detector.sh 自动扫描
日志格式无标准格式结构化 LRN/ERR/FEAT 条目
Promote三层 Promote 系统
Skill 提取手动extract-skill.sh 自动化
适用场景经验固化错误追踪 + 经验固化 + Skill 进化

本技能是 skill_evolve 的超集——skill_evolve 有的本技能全有,本技能有的 skill_evolve 不一定有。

Comments

Loading comments...