Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Learning Coordinator
v2.0.0Coordinates learning signals, pattern promotion, and stage management for self-improving memory. Monitors corrections and preferences to identify emerging pa...
⭐ 0· 61·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (learning coordination, pattern promotion, stage management) lines up with the provided code and examples. The skill reads a learning rules file, integrates with correction and preference adapters, and exposes the expected API. However, the code inserts a hard-coded integration path (/root/.openclaw/workspace/integration) to load adapters, which is environment-specific and could cause the skill to load other adapters or modules outside its apparent scope.
Instruction Scope
SKILL.md and the code focus on reading/creating the learning rules file, reading correction/preference adapters, computing statistics, and promoting/demoting patterns. The instructions do not request unrelated files or environment variables. The skill will create and write the learning rules file (learning.md) under the user's home by default and reads other files referenced in configuration (e.g., corrections.md, corrections_enhanced.db). This file I/O is consistent with the stated purpose but is write-capable on the user's filesystem.
Install Mechanism
There is no install spec (instruction-only install), and included code files are provided in the package. No external downloads, package installers, or archive extraction are used. Risk from the install mechanism itself is low.
Credentials
The skill declares no required environment variables or credentials, and the code does not attempt to read secret environment variables. It does operate on files under ~/self-improving by default; those paths are proportional to a learning rules/adapter integration skill. The ability to import adapters from an integration registry means the skill could indirectly access adapter-provided data, which is expected for its purpose but worth reviewing.
Persistence & Privilege
always:false (no forced-inclusion). The skill writes a rules file (creates ~/self-improving/learning.md if missing) and may create other files (corrections_enhanced.db) per config; this persistent presence on disk is consistent with its function but should be noted. Also, the skill attempts to load adapters from a fixed absolute path (/root/.openclaw/workspace/integration), which may let it access other adapters or shared resources on the host — this increases its effective reach beyond only its own files.
What to consider before installing
This skill appears to implement the learning-coordinator functionality it describes, but take these precautions before installing:
- Inspect adapters: The code attempts to load adapters via an AdapterFactory from a hard-coded integration path (/root/.openclaw/workspace/integration). Verify what adapters exist in that registry and whether they expose or access sensitive data. If you run in a shared environment, ensure adapters are trusted.
- Backup and review files: The skill will create and write ~/self-improving/learning.md (and may create corrections db files). Back up any existing files in that directory and review the content the skill will write.
- Run in a restricted environment first: Test the skill in a sandbox or developer environment to observe what files it reads/writes and which adapters it loads.
- Check file permissions: Ensure created files do not gain broader access than intended (set appropriate filesystem permissions).
- Review related plugins: The skill integrates with correction-logger and preference-tracker; review those plugins' code and configs so you understand what data flows into the coordinator.
If you want to proceed more confidently, provide the skill with an explicit configuration that points to an isolated rules directory (not a shared root path) and disable auto_create until you have inspected the code and integration adapters.Like a lobster shell, security has layers — review code before you run it.
latestvk9740man3qekmynfs9k3jnaxrx8394av
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎓 Clawdis
OSLinux · macOS · Windows
