Self Evolution Pro

This skill appears to do what it says (collect learnings, extract skills, sync across sessions), but it carries data-exposure and automation risks you should consider before installing: - It writes into ~/.openclaw/workspace and will read those files and your session histories. Inspect those files for any sensitive content you wouldn't want stored or published. - The extractor can call `clawhub publish` (network publish). If run, that could push learned content — potentially containing secrets — to ClawHub. Verify how ClawHub publishing is authenticated and require explicit consent before publishing; do not assume this is safe for confidential data. - The SKILL.md instructs spawning subagents and scheduling cron jobs. If the agent invokes this autonomously, it could run background tasks. Limit the agent's ability to run the skill autonomously or review scheduled jobs/cron entries the skill creates. - The skill does not declare required credentials but expects platform APIs/CLI (sessions_* functions, clawhub). Confirm what credentials/platform permissions are used and avoid supplying broad tokens unless you trust the code. Recommendations before enabling: - Review the three bundled scripts line-by-line and run them in a sandbox or VM first. - Disable automatic publishing (do not run extract.sh --publish) until you confirm outputs are safe. - Audit existing .learnings and session history for secrets; consider redaction policies before use. - Require manual approval for any publish/auto-extract actions and restrict agent autonomy for this skill. Given these ambiguities and the potential for unintended data exfiltration or background actions, treat this skill as suspicious until you validate the publish/auth flows and restrict its autonomy.