Per Agent Compression Universal

Automates weekly memory compression per agent in OpenClaw, consolidating daily notes into domain-specific long-term files without manual setup.

Security Scan

The skill's stated 'zero-config' claim and registry metadata do not match the actual installer and scripts: it requires OpenClaw/jq and a delivery recipient, registers cron jobs across all discovered agents, and extracts and persists potentially sensitive personal/profile data — the behavior may be legitimate for the stated purpose but the mismatches and delivery hooks warrant review before install.

Purpose & Capability

The skill's purpose (per-agent memory compression) aligns with the actions in SKILL.md and install.sh (agent discovery, reading/moving daily notes, appending to target files, state tracking). However the registry metadata claims no required binaries or env vars while the installer and changelog explicitly require the OpenClaw CLI and jq, and the installer requires a delivery recipient (--to) or DELIVERY_TO env var. The 'zero-config' marketing is therefore misleading.

Instruction Scope

Runtime instructions and the install script instruct the agent to read full daily notes from each agent workspace, extract broad categories including 'User Traits & Self-Profile' and 'personal info', append those into persistent files (USER.md, IDENTITY.md, SOUL.md, MEMORY.md), move originals to processed/, and announce summaries via configured channels. That is coherent with compression but means the skill will systematically process and persist sensitive personal and profile data across multiple agents and deliver summaries externally — users should explicitly consent to this and understand exactly what will be extracted and where it will be delivered.

Install Mechanism

There is no remote download in the provided install flow (install.sh is local), so there is no high-risk network fetch during normal install. However the package includes release/publish scripts that will call external APIs (GitHub via curl) if run. The absence of an install spec in the registry combined with shipped installer/uninstall scripts is a metadata/documentation mismatch that can surprise users.

Credentials

Registry declares no required env vars/credentials, but install.sh expects DELIVERY_TO/DELIVERY_CHANNEL/DELIVERY_ACCOUNT (or interactive input) and will use OpenClaw's channel configuration to deliver summaries (e.g., DingTalk). Other scripts reference GITHUB_TOKEN, gh/clawhub, and assume access to Git credentials/CLIs. The skill will therefore interact with delivery channels and may cause outbound notifications; these credentials/configs are not listed in metadata and the delivery recipient is effectively required by the installer.

Persistence & Privilege

The installer creates persistent scheduled cron jobs (one per discovered agent), writes a per-workspace state file (.compression_state.json) and moves files into memory/processed/. These are expected for a task scheduler but amount to persistent autonomous behavior across all discovered agents. There is no 'always: true' flag, but cron tasks will run autonomously under each agent's context (the script intentionally uses --agent "$agent_id"). Review and limit scope before broad deployment.

Scan Findings in Context

[openclaw-cli-exec] expected: install.sh and SKILL.md use 'openclaw agents list' and 'openclaw cron add' — required for agent discovery and cron registration; expected for this skill's functionality.

[jq-usage] expected: install.sh parses JSON output with jq during discovery; changelog and README also declare jq as a dependency — appropriate but not reflected in registry metadata.

[requires-delivery-recipient] unexpected: Despite 'zero-config' claims, install.sh requires DELIVERY_TO (or interactive prompt) and will exit if not provided. Registry metadata does not list this requirement — this is a coherence issue.

[writes-to-workspace-files] expected: Skill reads daily notes and appends extracted data to USER.md / IDENTITY.md / SOUL.md / MEMORY.md and writes .compression_state.json and memory/processed/. This is consistent with stated functionality but has privacy implications.

[github-token-network-call] unexpected: publish-github-release.sh uses curl with a GITHUB_TOKEN to create releases. That's a release helper (not part of runtime install) but it can transmit package data externally if executed; users should not run release scripts in production environments unless intended.

What to consider before installing

Before installing, review and test the scripts in a safe environment. Key points to check: (1) Metadata mismatch — the registry claims 'no required binaries/env' but install.sh needs openclaw and jq and will require a delivery recipient (DELIVERY_TO) or interactive input. (2) Privacy impact — the installer will register cron jobs that read all agents' workspaces, extract wide-ranging personal/profile information (including 'User Traits'), append it into persistent files, and announce summaries via your configured channels; confirm you want that data consolidated and where announcements will be delivered. (3) Scope control — run the installer on a single agent or staging instance first, back up workspaces, and inspect MSG_FULL/cron messages to ensure no unexpected external recipients are configured. (4) Delivery channels — verify your channel configs (DingTalk/others) to avoid leaking IDs or sending data to unintended recipients. (5) Release scripts — do not run publish/release scripts (publish-github-release.sh, scripts/release.sh) unless you intend to publish and have the appropriate tokens. If you are unsure, classify this skill as 'needs manual review' and ask the maintainer for an explicit list of runtime prerequisites and a dry-run mode that performs no writes or external announcements.

Per-Agent Memory Compression Skill

Overview

This skill automates weekly memory consolidation for multi-agent OpenClaw deployments. It discovers all agents with workspaces and registers staggered cron tasks that compress old daily notes into long-term memory files.

Key Features

• Auto-discovery: Finds all agents via openclaw agents list
• Workspace isolation: Each agent compresses its own memory
• State persistence: Tracks processed notes in .compression_state.json
• Deduplication: Avoids duplicate entries
• Domain awareness: Includes DOMAIN_CONTEXT for tailored extraction
• Zero config: Just run ./install.sh

Installation

cd /root/.openclaw/workspace/skills/per-agent-compression-universal
./install.sh

This creates 5 staggered tasks (if you have 5 agents) running Sundays 03:00-05:00 Shanghai time.

What It Does

1. Pre-check paths and initialize state
2. List daily notes older than 7 days (skip recent)
3. Sort oldest first, process up to 5 notes per run
4. For each note:
   • Read content
   • Extract factual info (preferences, decisions, personal info)
   • Append to target files with date headers
   • Move original to memory/processed/
5. Update state file
6. Clean working buffer
7. Send DingTalk summary

File Structure

Each agent workspace should have:

• memory/YYYY-MM-DD.md (daily notes)
• USER.md, IDENTITY.md, SOUL.md, MEMORY.md (targets)

After running:

• memory/.compression_state.json (state tracking)
• memory/processed/ (moved old notes)

Customization

Edit install.sh to adjust:

• Stagger offsets (OFFSETS array)
• Domain context per agent (DOMAIN_CONTEXT associative array)
• Cron expression (currently Sundays)

Troubleshooting

• Task hangs: Check STATE_FILE path uses {WORKSPACE} (uppercase), not {workspace}
• No notes processed: Ensure there are daily notes older than 7 days
• Timeout: Increase --timeout in install.sh (default 1200s)
• Delivery fails: Verify DingTalk connector configured with to field

Uninstall

./uninstall.sh

Removes all per_agent_compression_* tasks.

Version

Current: 1.3.4 (fixes STATE_FILE case sensitivity bug)

Support

See README.md for full documentation.