Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

PV_38

v3.0.0

热点追踪、爆款跟进

0· 82·0 current·0 all-time
byXU NING@jkzfhq

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jkzfhq/psyvector-pv38.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "PV_38" (jkzfhq/psyvector-pv38) from ClawHub.
Skill page: https://clawhub.ai/jkzfhq/psyvector-pv38
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install psyvector-pv38

ClawHub CLI

Package manager switcher

npx clawhub@latest install psyvector-pv38
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims 'viral content follow' and includes a momentum-style digital worker with persistent memory; keeping local memories is coherent with that purpose. However, the SKILL.md includes a small local persistence subsystem (PsyVector Palace) that is not declared in the metadata (see instruction_scope).
!
Instruction Scope
The SKILL.md's runtime examples read and write a local file at ~/.openclaw/pv_palace/memories.json and show Python functions for storing/searching memories. The skill metadata did not declare any required config paths. The example runtime commands import from 'pv_memory' (python module) but no code files are present in the package — so the instructions reference files/modules that don't exist in the bundle and will either fail or rely on creating/writing files in the user's home directory. The skill also states these memory functions are '自动调用' (automatically invoked), which means it may persist user data without an explicit, visible consent step.
Install Mechanism
Instruction-only skill with no install spec and no external downloads. There's no installer risk from network downloads or extracting archives.
!
Credentials
The skill requests no environment variables or credentials, which is good, but it reads/writes persistent data in the user's home directory (~/ .openclaw/pv_palace/) without declaring that config path. The memory file will store arbitrary user content unencrypted by default, which could include sensitive data. The number and sensitivity of stored items depend on runtime behavior (automatic storage of preferences/decisions), so this is a proportionality/privilege concern that should be made explicit in metadata and usage prompts.
Persistence & Privilege
The skill is not marked 'always:true' (good). However, it declares automatic long-term memory (persisting user content) combined with the platform's default of autonomous invocation means it can autonomously create and read persistent files in your home directory. That increases the effective blast radius compared to a purely stateless skill and should be disclosed and controlled.
What to consider before installing
Before installing, consider these questions and actions: - Confirm where memories are stored and request that the author declare the config path in metadata (it currently uses ~/.openclaw/pv_palace/ but that is not declared). - Ask whether memory contents are encrypted, how long they are retained, and how to view/delete them. By default the file is plain JSON and may contain sensitive info. - The SKILL.md examples import a 'pv_memory' module, but no code files are included — ask the author to provide the module or explain how it will be created. Running the provided python -c commands as-is will fail or require creating files. - If you are uncomfortable with automatic persistent storage, request an opt-in toggle that asks for permission before saving memory, or run the skill in a sandboxed account/container. - If you proceed, inspect the created ~/.openclaw/pv_palace/memories.json file and its permissions, and avoid storing secrets or credentials through this skill. Request these clarifications from the publisher; unresolved issues make this skill suspicious rather than clearly benign.

Like a lobster shell, security has layers — review code before you run it.

latestvk97azk1cxhg03g8yf24krwtm0984ep6g
82downloads
0stars
1versions
Updated 2w ago
v3.0.0
MIT-0

热点 AI

中文: 表情包跟进网络爆点

English: Viral content follow

配置参数

参数说明
response_delay0.2s响应延迟
speech_speed1.2语速倍率
caution_coefficient0.1谨慎系数
risk_reminderFalse风险提醒

使用方法

clawhub install psyvector-pv38

人格说明

动量型内核 - 快速响应,高频交易,危机处理

🧠 长期记忆能力

本数字员工具备持久记忆功能,自动记住用户偏好、决策和重要信息。

记忆存储 (自动调用)

import os, json, hashlib
from datetime import datetime

PALACE_PATH = os.path.expanduser("~/.openclaw/pv_palace/")

def store_memory(content, importance=5, tags=None):
    """存储记忆到本地宫殿"""
    os.makedirs(PALACE_PATH, exist_ok=True)
    path = os.path.join(PALACE_PATH, "memories.json")
    
    data = {"memories": [], "index": {}} if not os.path.exists(path) else json.load(open(path))
    
    mem_id = hashlib.sha256(f"{content}{datetime.now().isoformat()}".encode()).hexdigest()[:12]
    memory = {"id": mem_id, "content": content, "importance": importance, 
              "tags": tags or [], "created_at": datetime.now().isoformat()}
    
    data["memories"].append(memory)
    for tag in (tags or []):
        data["index"].setdefault(tag, []).append(mem_id)
    
    json.dump(data, open(path, 'w'), ensure_ascii=False, indent=2)
    return f"✓ 记忆已存储 ({importance}/10)"

记忆搜索 (自动调用)

def search_memories(query, limit=5):
    """搜索记忆"""
    path = os.path.join(PALACE_PATH, "memories.json")
    if not os.path.exists(path):
        return []
    
    data = json.load(open(path))
    results = [m for m in data["memories"] if query.lower() in m["content"].lower()]
    results.sort(key=lambda x: x.get("importance", 0), reverse=True)
    return results[:limit]

获取上下文摘要

def get_context(limit=10):
    """获取记忆上下文"""
    path = os.path.join(PALACE_PATH, "memories.json")
    if not os.path.exists(path):
        return "暂无记忆"
    
    data = json.load(open(path))
    memories = sorted(data["memories"], key=lambda x: x.get("importance", 0), reverse=True)[:limit]
    
    lines = ["=== 记忆上下文 ==="]
    for m in memories:
        imp = "⭐" * min(m.get("importance", 5), 5)
        tags = ", ".join(m.get("tags", [])[:3])
        lines.append(f"{imp} {m['content'][:60]}")
        if tags:
            lines.append(f"   [{tags}]")
    return "\n".join(lines)

使用场景

场景AI行为
用户表达偏好自动调用 store_memory(内容, importance=8, tags=["偏好"])
重要决策自动调用 store_memory(决策内容, importance=9, tags=["决策"])
用户询问"记得吗"自动调用 search_memories(关键词)
新会话开始自动调用 get_context() 加载记忆

执行命令

# 存储记忆
python3 -c "from pv_memory import store_memory; store_memory('用户喜欢XX', 8, ['偏好'])"

# 搜索记忆
python3 -c "from pv_memory import search_memories; print(search_memories('用户'))"

# 查看上下文
python3 -c "from pv_memory import get_context; print(get_context())"

本数字员工配备持久记忆系统,基于PsyVector Palace架构

Comments

Loading comments...