Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Skill From Memory

v0.1.2

Convert memory, conversation history, or completed tasks into publishable OpenClaw skills. Use when (1) A task or workflow should be reusable, (2) Extracting...

2· 2.7k·9 current·10 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill claims to extract from conversation history/memory and create/publish skills; the included scripts do exactly that (extract, create skill files, optionally push to GitHub and ClawHub). Access to session and memory files, and to git/clawhub tooling, is coherent with the stated purpose.
!
Instruction Scope
Scripts directly read arbitrary session.jsonl and memory.md files (examples reference ~/.openclaw/agents/main/sessions/latest.jsonl). They extract conversation text and code blocks and copy them into generated skill packages. If the extracted content contains secrets or private data, the publish step will push that content to remote services. The instructions allow full automatic create-and-publish in one command, which increases the risk of unintentionally exposing sensitive data.
Install Mechanism
No install spec or remote downloads are present; the skill is instruction+scripts only. It requires common CLI tools (git, jq, clawhub) which are reasonable for the stated functionality.
Credentials
The skill declares no environment variables, which is consistent, but publishing requires GitHub credentials/SSH keys and ClawHub auth in practice. Those are not requested explicitly by the skill metadata — users must supply them externally. This is expected for publishing, but the scripts will capture and stage any extracted content (including any credentials present in conversations) and push them if a repo/slug is provided.
Persistence & Privilege
always:false and no system-wide persistence requested. The scripts may initialize a git repo and add a remote inside the created skill directory, but they do not modify other skills or agent system configuration.
What to consider before installing
This skill will read your local conversation history and memory files, extract text and code blocks, generate a skill package, and — if you pass GitHub/ClawHub targets — attempt to push that package to remote repositories. Before using: (1) Inspect the extracted output directory (extracted-*) and review code_blocks.txt / extraction-summary.md for any secrets or private data. (2) Run create steps without publish (omit --github/--clawhub or use --skip-github / --skip-clawhub) to verify contents. (3) If you must publish, push to a private repo first and double-check files; don't publish directly to public repos. (4) Ensure you understand that any API keys, tokens, or PII present in conversations could be included in the package and uploaded. (5) Consider grepping session/memory files for common secret patterns before extraction, and prefer manual review of generated SKILL.md and scripts prior to running publish.sh.

Like a lobster shell, security has layers — review code before you run it.

latestvk975vgykyf6z17dtb2frw92yyn81agz5
2.7kdownloads
2stars
3versions
Updated 16h ago
v0.1.2
MIT-0

Skill from Memory

Transform your work into reusable skills. Extract workflows, solutions, and patterns from conversation history or memory files, package them as skills, and publish to GitHub and ClawHub.

Overview

This skill automates the complete workflow:

  1. Extract - Parse conversation history or memory for reusable patterns
  2. Design - Structure as a proper skill with SKILL.md and resources
  3. Create - Generate skill files and scripts
  4. Publish - Push to GitHub and publish to ClawHub

Quick Start

Create Skill from Recent Conversation

# Analyze last conversation and create skill draft
./scripts/extract-from-history.sh /path/to/session.jsonl ./my-new-skill

# Or specify a time range
./scripts/extract-from-history.sh /path/to/session.jsonl ./my-new-skill --since "2026-02-03" --pattern "backup"

Create Skill from Memory File

# Extract from memory markdown
./scripts/extract-from-memory.sh /path/to/memory/2026-02-04.md ./my-new-skill

Full Auto-Create and Publish

# One command: extract, create, and publish
./scripts/create-and-publish.sh \
  --source /path/to/session.jsonl \
  --skill-name "my-automation" \
  --github-repo "user/my-skills" \
  --clawhub-slug "my-automation"

Workflow Steps

Step 1: Extract Requirements

Identify from conversation/memory:

  • Task Pattern: What workflow was solved?
  • Inputs/Outputs: What goes in, what comes out?
  • Scripts/Tools: What code was written?
  • Key Decisions: What choices were made?

Step 2: Design Skill Structure

Decide resource types:

  • scripts/ - For reusable code
  • references/ - For documentation
  • assets/ - For templates/files

Step 3: Create Skill Files

Generate:

  • SKILL.md with frontmatter and instructions
  • Scripts in scripts/
  • Any reference files

Step 4: Publish

Push to GitHub and publish to ClawHub:

./scripts/publish.sh ./my-skill \
  --github "user/repo" \
  --clawhub-slug "my-skill" \
  --version "1.0.0"

Scripts Reference

extract-from-history.sh

Parse conversation JSONL for skill content.

./scripts/extract-from-history.sh <session.jsonl> <output-dir> [options]

Options:
  --since DATE     Only extract from DATE onwards
  --pattern REGEX  Filter messages matching pattern
  --tools-only     Only extract tool usage patterns

extract-from-memory.sh

Parse memory markdown files.

./scripts/extract-from-memory.sh <memory.md> <output-dir>

create-skill.sh

Generate skill structure from extracted content.

./scripts/create-skill.sh <extracted-content-dir> <skill-name>

Options:
  --description "..."  Skill description
  --type workflow    Skill type (workflow|tool|reference)

publish.sh

Complete publish workflow.

./scripts/publish.sh <skill-path> [options]

Options:
  --github REPO      GitHub repo (owner/repo)
  --clawhub-slug     ClawHub slug
  --version VER      Version tag
  --skip-github      Skip GitHub push
  --skip-clawhub     Skip ClawHub publish

Example: Converting a Task to Skill

Original Task (from conversation)

User: "帮我设置每天自动备份OpenClaw配置" → Agent creates backup scripts + cron setup

Skill Creation Process

  1. Extract:

    ./scripts/extract-from-history.sh \
      ~/.openclaw/agents/main/sessions/latest.jsonl \
      ./extracted-backup
    
  2. Design:

    • Type: Workflow skill
    • Scripts: backup.sh, setup-cron.sh, cleanup.sh
    • No assets needed
  3. Create:

    ./scripts/create-skill.sh ./extracted-backup cron-backup \
      --description "Automated backup scheduling with cron" \
      --type workflow
    
  4. Publish:

    ./scripts/publish.sh ./cron-backup \
      --github "zfanmy/openclaw-skills" \
      --clawhub-slug "cron-backup" \
      --version "1.0.0"
    

Best Practices

What Makes a Good Skill

Do:

  • Single, well-defined purpose
  • Reusable across contexts
  • Includes working scripts
  • Clear usage examples
  • Progressive disclosure design

Don't:

  • Too broad or vague
  • Hardcoded personal paths
  • Missing error handling
  • Undocumented assumptions

Extracting from Memory

Look for these patterns:

  • "帮我写一个脚本..."
  • "设置定时任务..."
  • "以后每次都要..."
  • "这个流程可以复用..."

GitHub Integration

Required setup:

# Configure git
git config --global user.name "Your Name"
git config --global user.email "your@email.com"

# Setup SSH key for GitHub
ssh-keygen -t ed25519 -C "your@email.com"
# Add ~/.ssh/id_ed25519.pub to GitHub Settings → SSH Keys

# Login to ClawHub
clawhub login

Versioning

Follow semantic versioning:

  • 1.0.0 - Initial release
  • 1.0.1 - Bug fix
  • 1.1.0 - New feature
  • 2.0.0 - Breaking change

Troubleshooting

Extraction finds nothing

  • Check session file path
  • Verify date range with --since
  • Try broader pattern matching

GitHub push fails

  • Verify SSH key is added to GitHub
  • Check repo exists and you have access
  • Ensure git config user.name/email set

ClawHub publish fails

  • Run clawhub login first
  • Check skill validation passes
  • Verify slug is unique

Skill doesn't work when used

  • Test scripts manually first
  • Check for hardcoded paths
  • Verify all dependencies listed
  • Run with --examples flag when creating

Related Skills

  • skill-creator - Low-level skill creation utilities
  • cron-backup - Example output skill (backup automation)
  • clawhub - ClawHub CLI operations

Comments

Loading comments...