Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Reward & Punishment System - Skill 奖惩技能
v1.0.0Tracks user praise (+10), criticism (-5), and insults (-10) to adjust a persistent score between 0 and 200 reflecting feedback and guide behavior improvement.
⭐ 0· 65·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (track praise/criticism, maintain a score) align with included code (scripts/reward.py) which stores score/history under ~/.openclaw/workspace/memory/reward_punishment.json. No unrelated binaries, env vars, or external network access are requested.
Instruction Scope
SKILL.md and README state the skill will write events to a permanent MEMORY.md and sometimes say events are only recorded when the user explicitly asks to 'record', while the code writes to reward_punishment.json and provides automatic CLI actions. These contradictions mean the runtime behavior (automatic keyword-based recording vs user-initiated only, and target file MEMORY.md vs JSON) is ambiguous and could lead to unexpected persistent logging of user messages.
Install Mechanism
No installer or remote downloads; this is an instruction-only skill with a small included Python script. Nothing in the install chain writes code from external URLs or executes fetched artifacts.
Credentials
No credentials or environment variables are requested, which is proportional. The script writes to the user's ~/.openclaw/workspace/memory path — consistent with a memory/persistence feature but worth noting because it persists user content across sessions (privacy risk).
Persistence & Privilege
always:false and no elevated privileges requested. The skill is allowed to be invoked autonomously (platform default). Combined with persistent storage of user messages, autonomous invocation could cause repeated writes to permanent memory; this amplifies the privacy impact but is not itself a privilege escalation.
What to consider before installing
Before installing, confirm two inconsistencies: (1) Should the skill auto-record on keyword detection, or only record when the user explicitly asks to 'record'? (SKILL.md/README say both.) (2) Where should events be saved — the README/SKILL.md claim MEMORY.md (permanent memory) but the bundled script saves reward_punishment.json under ~/.openclaw/workspace/memory. If you accept persistent recording, consider: review the script to ensure it only writes the intended fields (avoid storing full user messages if you want more privacy), test the skill in a sandbox account, and require an explicit opt-in or explicit confirmation step before writing to permanent memory. If you need guaranteed behavior (no automatic logging), request the author update code to require an explicit command and to document the exact storage path and file formats.Like a lobster shell, security has layers — review code before you run it.
latestvk974fgw7ccd7ksvq34fg99qyan83h2ne
License
MIT-0
Free to use, modify, and redistribute. No attribution required.