Back to skill
Skillv1.0.0
ClawScan security
16 Self Improving Agent Proactive Self Reflection · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 16, 2026, 7:10 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requested actions (local files under ~/self-improving, self-reflection workflows, and minor workspace edits) match its stated purpose, but it will create and maintain persistent files in your home directory and asks to edit workspace docs — review what it will store and where before enabling.
- Guidance
- This skill is coherent with its purpose but will create persistent files in ~/self-improving and suggests edits to workspace docs (AGENTS.md, SOUL.md). Before installing: (1) Inspect the exact files it will create and their location and ensure you are comfortable with persistent local storage; (2) Confirm the agent runs in Passive mode if you want stricter human confirmation before promotions/automatic learning; (3) Review and periodically audit memory files (they may contain user corrections that could include sensitive info if the user shares it); (4) Restrict filesystem permissions on ~/self-improving if necessary; (5) If you do not want any automated maintenance/cron tasks or external heartbeat integration, decline those setup steps. If you need higher assurance, request a version that logs-only (read-only) until you verify content and behavior.
Review Dimensions
- Purpose & Capability
- okName/description (self-reflection, learning, memory) align with the instructions: the skill only reads and writes a local memory directory (~/self-improving) and provides operational rules for promoting/demoting patterns. It does not request external credentials or unrelated binaries.
- Instruction Scope
- noteThe SKILL.md instructs the agent to create, read, and update files under ~/self-improving (memory.md, corrections.md, index.md, projects/, domains/, archive/, etc.) and to modify workspace doc files (AGENTS.md, SOUL.md). This is coherent with 'self-improving' behavior but does grant the skill scope to access and persist user-provided content. The skill's boundaries.md explicitly forbids storing credentials and sensitive categories, which is good practice, but enforcement depends on the agent following the instructions.
- Install Mechanism
- okInstruction-only skill with no install steps, no binaries requested, and no network download — low surface for supply-chain risk.
- Credentials
- okNo environment variables, no credentials, no external endpoints are required. The local filesystem access requested (home directory) is proportional to the stated purpose.
- Persistence & Privilege
- noteThe skill is persistent in that it creates and maintains files under ~/self-improving and expects to run periodic maintenance (documented as 'Weekly Maintenance (Cron)' and optional Heartbeat integration). always:false (normal). It also asks to update AGENTS.md and SOUL.md in your workspace—this is a modification of user files and should be confirmed before applying.