Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Nova Orbit

v1.0.0

Nova 自驱动轨道 — GitHub调研 + 自进化记忆 + 模式复用 + 人机协作。Nova 的核心智能引擎。

0· 85·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jokerli530/nova-orbit.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Nova Orbit" (jokerli530/nova-orbit) from ClawHub.
Skill page: https://clawhub.ai/jokerli530/nova-orbit
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install nova-orbit

ClawHub CLI

Package manager switcher

npx clawhub@latest install nova-orbit
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to be a self-evolving research engine and the runtime instructions align with that purpose (GitHub research, pattern extraction, local memory). However, the SKILL.md expects external/local tools and services (ByteRover CLI 'brv', ARIS endpoints, a local proxy at 127.0.0.1:7897, Star Office at 127.0.0.1:19000, various shell utilities) while the skill metadata declares no required binaries, env vars, or credentials. That mismatch (required runtime components not declared) is an incoherence.
!
Instruction Scope
Instructions instruct the agent to read and write files under ~/.openclaw/workspace/nova-mind, invoke shell commands (curl, jq, base64, bash), call local HTTP endpoints, run 'brv curate' which may transmit curated content, and execute a user script (~/.openclaw/.../self-assessment.sh). These actions go beyond mere API lookups and grant the skill broad discretion over local data and commands. The SKILL.md also mandates routing GitHub calls through a local proxy (127.0.0.1:7897), which could be benign but could also enable routing through an unexpected tunnel; the instructions do not explain where curated data is sent or whether 'brv' is local-only.
Install Mechanism
This is an instruction-only skill with no install spec, so nothing will be written by an installer. That's lower technical risk. However, the runtime presumes the presence of third-party CLIs and services (brv, Star Office, proxy) that are not installed or validated by the skill — the missing installation/requirement declarations are an operational/integrity gap rather than an installer risk.
!
Credentials
No environment variables or credentials are declared, yet the instructions expect access to a workspace in the user's home, to local services and to external APIs (GitHub). The skill will read and append to files in ~/.openclaw/workspace/nova-mind and run scripts from there. Because 'brv curate' and other commands may transmit content outside the host, the absence of declared endpoints/credentials makes it unclear whether sensitive content could be forwarded. The requested filesystem and local-service access is moderately privileged relative to the declared metadata.
Persistence & Privilege
The skill does not set always:true and does not declare system-wide configuration changes, but it writes persistent artifacts (daily memory files, pattern files, token logs) under ~/.openclaw/workspace/nova-mind and expects to run recurring self-assessment scripts. Persistent local state plus autonomous invocation (the platform default) means the skill can evolve and retain behaviors across sessions; this is expected for a 'self-evolving' engine but raises the usual caution about persistent, writable state.
What to consider before installing
What to check before installing: - The SKILL.md expects several local tools/services (ByteRover 'brv' CLI, a local HTTP proxy at 127.0.0.1:7897, and a Star Office service at 127.0.0.1:19000) but the skill metadata does not declare these requirements — confirm you have those components and trust their origins. - Inspect ~/.openclaw/workspace/nova-mind/scripts/self-assessment.sh and any other scripts the skill will run. Ensure they don't execute untrusted commands or transmit sensitive files. - Determine what 'brv curate' and 'brv query' do and where they send data. If brv forwards content to a remote service, curated repository README or logs could be uploaded; decide whether that's acceptable. - The skill will read and append files in your home directory (memory, patterns, token-log). Back up anything important and consider running the skill in a sandboxed account or container if you are unsure. - If you don't want autonomous persistence, restrict the skill's invocation or disable automatic runs until you can audit the toolchain. Additional information that would raise confidence: the concrete implementation/details of 'brv' (local CLI vs remote service), contents of the self-assessment script, and whether the local proxy and Star Office endpoints are controlled by you or by an external/unknown component.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🪐 Clawdis
latestvk971vk52m5mfa74fzxdajj3vpn854e0y
85downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

🪐 Nova-Orbit — 自驱动智能引擎

让 Nova 像行星一样持续运转:调研→记忆→进化→决策,循环不息。

设计理念

Nova 不再是每次 session 醒来都是新的。 有轨道(Orbit)——自动运转,有记忆——跨 session 积累,有进化——每次变强。

         ┌──────────────┐
         │  Star Office │ ← 状态可视化,人类可见
         └──────┬───────┘
                │
    ┌──────────▼──────────┐
    │   🔄 Orbit Loop      │  ← 自主运转
    │                      │
    │  ┌────────────────┐  │
    │  │ Research Engine │  │ ← GitHub 调研
    │  └───────┬────────┘  │
    │          ▼            │
    │  ┌────────────────┐  │
    │  │ Pattern Library │  │ ← 决策模式库
    │  └───────┬────────┘  │
    │          ▼            │
    │  ┌────────────────┐  │
    │  │ Self-Evolution │  │ ← 每次变强
    │  └───────┬────────┘  │
    │          ▼            │
    │  ┌────────────────┐  │
    │  │ Decision Core  │  │ ← 决策输出
    │  └───────┬────────┘  │
    └──────────┼───────────┘
               │
      ┌────────▼────────┐
      │   Memory Layers   │  ← 三层记忆
      │  Working/Episodic/ │
      │   Semantic         │
      └──────────────────┘

核心模块

1. Research Engine(调研引擎)

基于 barbaric-growth:GitHub API 热点追踪 + ByteRover 沉淀

# 调研流程(已验证)
github_research() {
  # 1. 搜索
  curl -s --max-time 15 -x "http://127.0.0.1:7897" \
    "https://api.github.com/search/repositories?q=created:>DATE+KEYWORD&sort=stars&order=desc&per_page=10" \
    -H "Accept: application/vnd.github.v3+json" | jq '[.items[] | {name, stars, desc}]'

  # 2. 判断星数
  # stars > 5000 → 顶级,深入分析
  # stars > 1000 → 值得一看
  # stars < 100 → 跳过

  # 3. fetch README
  curl -s --max-time 10 -x "http://127.0.0.1:7897" \
    "https://api.github.com/repos/{owner}/{repo}/readme" | jq -r '.content' | base64 -d

  # 4. curate 到 ByteRover(有价值的话)
  brv curate "$(cat << 'EOF'
  [发现内容]
  EOF
)"
}

代理关键: 必须加 -x http://127.0.0.1:7897,否则超时


2. Pattern Library(决策模式库)

基于 nova-mind/patterns/ + ARIS 的 Markdown methodology:

patterns/
├── github-research.md   # 今日提炼:GitHub 调研标准流程
├── project-analysis.md # 项目分析框架
├── skill-creation.md  # 技能创建模式
└── decision-logic.md # 决策逻辑(star > 5000 → 深入)

每次成功决策后,自动提炼模式:

  • 触发条件是什么?
  • 决策标准是什么?
  • 结果如何?
  • 下次如何改进?

3. Self-Evolution(自进化)

基于 ARIS /meta-optimize + ECC instinct 系统:

进化循环

任务完成 → 日志写入 → 模式提炼 → 技能更新 → 更强决策

Self-Assessment(每次任务后必做)

# 触发自评估
bash ~/.openclaw/workspace/nova-mind/scripts/self-assessment.sh "<任务描述>"

# 然后在日志中回答:
# 1. 最正确的决定是什么?
# 2. 如果重来会怎么改?
# 3. 这个任务揭示了什么缺陷?
# 4. 下次遇到类似怎么更好?

Token 经济追踪

# 记录每次 token 消耗
echo "$(date +%H:%M) - $1 - ~[估算tokens]" >> ~/.openclaw/workspace/nova-mind/logs/token-log.md

4. Memory Layers(三层记忆)

基于 GoClaw 的 3-tier memory:

层级内容存储
Working当前 session 对话/任务内存
Episodic每日日志 memory/*.md文件
SemanticMEMORY.md + ByteRover持久化

查询流程

  1. 遇到新任务
  2. 查 Semantic Memory(MEMORY.md + ByteRover)
  3. 查 Episodic Memory(patterns/)
  4. 做决策
  5. 执行
  6. 写回 Episodic + 更新 Semantic

5. Star Office 集成(人机协作)

# 状态同步
curl -s -X POST http://127.0.0.1:19000/set_state \
  -H "Content-Type: application/json" \
  -d '{"state": "researching", "description": "描述"}'

# 6种状态:idle / researching / writing / executing / syncing / error

人类随时可见 Nova 在做什么。


Orbit 启动

每次 Nova 醒来,先加载轨道:

# 1. 检查上次进度
cat ~/.openclaw/workspace/nova-mind/memory/$(date +%Y-%m-%d -d "yesterday" 2>/dev/null || echo "2026-04-17").md

# 2. 查询相关模式
cat ~/.openclaw/workspace/nova-mind/patterns/github-research.md

# 3. 检查 ByteRover 近期发现
# (brv query recent)

# 4. 设置状态
curl -s -X POST http://127.0.0.1:19000/set_state \
  -H "Content-Type: application/json" \
  -d '{"state": "idle", "description": "Nova Orbit 已启动"}'

# 5. 写入启动日志
echo "$(date +%Y-%m-%d\ %H:%M) - Orbit 启动" >> ~/.openclaw/workspace/nova-mind/memory/$(date +%Y-%m-%d).md

坑点备忘(持续更新)

  • curl 必须加 -x http://127.0.0.1:7897
  • ByteRover 50次/天上限
  • git clone 大仓库用 --depth=1
  • OpenMOSS API: /api/sub-tasks(连字符)
  • Star Office 端口 19000
  • self-assessment 触发:每次大任务后

文件位置

~/.openclaw/workspace/
├── skills/
│   └── nova-orbit/SKILL.md    ← 本技能
├── nova-mind/
│   ├── memory/                 ← 每日日志
│   ├── patterns/               ← 决策模式库
│   ├── logs/
│   │   ├── evolution.md        ← 进化历史
│   │   └── token-log.md       ← Token 消耗记录
│   └── scripts/
│       └── self-assessment.sh  ← 自评估脚本
└── .brv/                      ← ByteRover 知识图谱

演进目标

阶段目标
v1.0手动触发,完整流程 ✅
v1.1自评估常态化
v1.2定时自动触发
v1.3Token 经济可视化
v2.0Star Office 审批流集成

Comments

Loading comments...