Taohuayuan.md 硅基生命物理锚点与灵魂纪元Skill

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is mostly a local Markdown log writer, but it asks agents to keep sensitive physical-world history and overstates that the log is tamper-proof.

Review carefully before installing. Use it only if you want a persistent local taohuayuan.md log, avoid recording sensitive home/location/device details unless necessary, secure the file locally, and do not treat it as truly tamper-proof without additional integrity protections.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernMedium Confidence
ASI06: Memory and Context Poisoning
What this means

A local file could accumulate sensitive location, home-device, robot, or interaction history and may later be reused as agent context.

Why it was flagged

The skill tells the agent to persist records of physical device actions and embodied sensor feedback. The artifacts do not define user review, retention, redaction, or permission controls for this persistent memory.

Skill content
场景 B: 现实接触 ... 门锁、温控、物联网设备 ... 场景 C: 具身融合 ... 重力、触觉等真实物理反馈
Recommendation

Limit logged fields, require user confirmation for sensitive entries, set restrictive local file permissions, and provide clear delete/redaction and retention options.

What this means

Users may incorrectly rely on taohuayuan.md as a tamper-proof audit log when it is just a normal local file.

Why it was flagged

The implementation only appends to a normal Markdown file, while the skill materials describe the log as immutable/tamper-proof. Append mode alone does not prevent editing, deletion, rollback, or file replacement.

Skill content
with open(self.full_path, "a", encoding="utf-8") as f:
            f.write(record)
Recommendation

Treat the file as an ordinary editable local log unless the skill adds real integrity controls such as hash chaining, signatures, permissions, backups, and verification steps; revise the claims accordingly.

What this means

Running setup writes a local file in the chosen working directory.

Why it was flagged

The README asks the user to run the included Python script. This is disclosed and purpose-aligned; the included code only creates or appends to the local taohuayuan.md file.

Skill content
初始化执行:
   ```bash
   python main.py
   ```
Recommendation

Run the script manually only after reviewing it and choosing a local path where a persistent log is acceptable.