Nightly Workspace Audit

Nightly workspace audit — auto-discover file dependencies by scanning all workspace files for cross-references, manage HOT/WARM/COLD memory tiers, detect orp...

Security Scan

The skill's capabilities align with a workspace-audit purpose, but the runtime instructions permit broad, autonomous, and vaguely-specified destructive edits (merge/delete/move/rename) and reference internal transcripts/tools without explicit safeguards — this is coherent but risky and needs user controls.

Purpose & Capability

The name/description match the actions in SKILL.md: scanning workspace files, building dependency graphs, and moving/archiving/cleaning files is consistent with a 'workspace audit'. Requesting no external credentials or installs is proportionate. Note: the skill expects access to workspace filesystem and agent-internal tooling (cron list, memory_search), which is reasonable for this purpose but high-impact.

Instruction Scope

The SKILL.md instructs the agent to read every .md/.json under workspace/, inspect cron job prompts and recent session transcripts (via memory_search), and to perform merges, deduplications, prunes, renames, and moves — including deleting entries and moving files to archive. Criteria for destructive actions are heuristic and sometimes vague ("confirmed no longer useful"), and there is no explicit step requiring user confirmation or a dry-run. The file referenced for local overrides is inconsistently named (mentions both local-overrides.md and references/local-overrides.md). These open-ended edit instructions create a real risk of unintended data loss.

Install Mechanism

No install spec and no code files (instruction-only). This minimizes supply-chain risk; nothing will be written to disk by an installer.

Credentials

The skill declares no required env vars, no credentials, and no config paths. Its need to read workspace files, cron entries, and session transcripts is proportional to the stated auditing purpose. However, the instructions implicitly rely on agent-internal tools (e.g., memory_search, cron list) that are not listed as explicit dependencies — reasonable but worth confirming with the platform.

Persistence & Privilege

always:false (good). The skill will modify workspace state (create/rename/move/delete files) when invoked; autonomous model invocation is allowed by platform default. Combined with the ambiguous deletion rules, this grants significant destructive capability during normal runs — recommend requiring explicit user confirmation or a safe dry-run mode before making changes.

What to consider before installing

This skill appears to do what it says (scan and clean an OpenClaw workspace) and does not request network credentials or external installs, which is good — but it will autonomously modify and delete workspace files based on heuristic rules. Before installing or running it: 1) insist on a dry-run mode that reports proposed changes without applying them; 2) require explicit user confirmation for any deletions/renames/moves; 3) back up your workspace first; 4) verify how it accesses session transcripts and cron jobs (ensure it only reads data you expect it to); and 5) clarify the local-overrides file path and keep a protected list of files the skill must never auto-modify.

Workspace Audit

Auto-discover, clean, tier, sync, and report on an OpenClaw workspace.

Memory Tiers

• HOT — auto-loaded every session: root .md files (MEMORY.md, TODO.md, USER.md, etc.)
• WARM — on disk, loaded on demand: memory/*.md, projects/*/ files
• COLD — archived, rarely touched: memory/archive/

Procedure

1. Dependency Discovery

Scan every .md and .json file in workspace/ (skip skills/, .git/, archive/).

For each file, extract:

• File paths (relative or absolute) mentioned in content
• Section headings that appear in multiple files (shared topics)
• Lists that substantially overlap across files (potential duplicates)

Then cross-reference against:

• Cron job prompts: cron list → extract all file paths from every job's message field → verify each file exists
• Index files: any file named README.md or containing a Markdown table with path-like entries → verify linked targets exist
• Tree diagrams: code blocks containing directory trees → verify paths match actual filesystem

Build a dependency graph: {file → [files it references]}.

Flag:

• Broken links: referenced file doesn't exist
• Orphaned files: files referenced by nothing (not in any cron, not linked from any index, not a root auto-loaded file)
• Content drift: two files that reference the same data but have diverged (e.g., a list appears in both MEMORY.md and another file but they differ)

2. Memory Hygiene

Read all files in memory/ (skip archive/).

• Merge: Combine related entries across files (same topic split across daily files)
• Deduplicate: Remove identical content that exists in multiple places
• Prune: Delete entries confirmed no longer useful (completed one-off tasks, expired temporary notes)
• Archive: Move daily files older than 7 days to memory/archive/
• Rename: Fix inconsistent naming if found

After changes, update the workspace structure tree in MEMORY.md if one exists.

3. Auto-promote / Demote

Apply tier rules. See tier-rules.md for thresholds and exceptions.

• Promote WARM → HOT: Add a summary line to MEMORY.md
• Demote HOT → WARM: Remove from MEMORY.md, ensure info exists in a WARM file
• Demote WARM → COLD: Move file to memory/archive/

Every promotion or demotion must be listed in the report.

4. Local Overrides (optional)

If local-overrides.md exists, run those additional checks. These are user-specific dependency pairs that can't be auto-discovered (e.g., content-level sync between specific sections).

Skip this step if the file doesn't exist.

5. Report

Send a concise message to the user:

🔍 Workspace Audit — {date}

**Dependencies**
- {broken links found and fixed/flagged}
- {orphaned files found}
- {content drift detected}
- {or "All dependencies healthy"}

**Cleaned**
- {what was merged/deleted/archived, or "Nothing — all clean"}

**Tier changes**
- ⬆️ Promoted: {item} (WARM → HOT) — reason
- ⬇️ Demoted: {item} (HOT → WARM) — reason
- {or "No tier changes"}

**Sync issues**
- {local override mismatches, or "All in sync"}

**Health**
- {file count} workspace files, {cron count} cron jobs, {error count} cron errors
- {any expiring items}