Meditate

v1.0.1

Think proactively during idle time with sandboxed reflections, adaptive rhythms, and feedback-driven focus areas.

2· 535·0 current·0 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description align with the instructions: the skill is designed to read conversation history, generate reflections, and store them locally. It does not request network access, credentials, or external services, which is proportionate. However, the registry metadata lists no required config paths while SKILL.md consistently expects and uses a ~/meditate/ directory — an inconsistency in declared vs. actual runtime I/O.
!
Instruction Scope
Runtime instructions say the agent will read conversation history and read/write files under ~/meditate/. The docs repeatedly insist on an absolute sandbox (no network, no creds, no actions), but the memory-template includes a shell example (mkdir -p ~/meditate/archive) and profile.md is said to be 'updated automatically' — meaning the agent will be expected to write to disk. The skill relies on the agent correctly filtering out personal data; that enforcement is not verifiable from these files. The instructions do not detail how conversation history is accessed or filtered, which is a privacy-sensitive ambiguity.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That minimizes supply-chain risk — nothing is downloaded or executed by default.
!
Credentials
The skill requests no env vars or credentials (appropriate), but it will read conversation history (sensitive data) and persist derived materials under ~/meditate/. The registry metadata does not declare these config paths, so the runtime behavior (local file I/O in the home directory) is not reflected in the declared requirements — a transparency gap the user should note.
Persistence & Privilege
always:false and autonomous invocation are normal. The skill intends to persist memory (profile.md, insights.md, feedback.md, archive/) in the user's home directory and update those files automatically; that is expected for a meditation/memory skill but is persistent storage of conversation-derived material and should be treated as sensitive.
What to consider before installing
What to consider before installing: - This skill will read your conversation history and create/update files in ~/meditate/ (profile.md, topics.md, insights.md, feedback.md, archive/). The registry metadata did not declare those config paths — confirm you are comfortable with local storage in your home directory. - The skill states it will never send data externally, use credentials, or perform actions, and has strict sandbox rules in the docs, but those are behavioral constraints the agent must obey; the code is not present to enforce them. If you use this skill, periodically inspect ~/meditate/ contents and permissions. - If stored insights may contain sensitive details, consider restricting file permissions (chmod 700), placing the directory on encrypted storage, or running the skill in a segregated environment/account. - The template shows a shell command for initial setup (mkdir -p ...). Decide whether you will run that manually (safer) rather than allowing automated file creation. - Test the skill with non-sensitive topics first to verify it behaves as promised. If you need stronger guarantees (encryption, explicit consent prompts, platform-enforced sandboxing), request those features or avoid installing until they are provided. Confidence note: assessment is medium because the skill is instruction-only (no code to analyze) and the main concerns are transparency about local file I/O and privacy safeguards rather than evidence of malicious intent.

Like a lobster shell, security has layers — review code before you run it.

latestvk971w8pqfrfwvz49qpyt8ebp6181cm8t

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🧘 Clawdis
OSLinux · macOS · Windows

Comments