涤尘

PassAudited by VirusTotal on May 4, 2026.

Overview

Type: OpenClaw Skill Name: dichen Version: 0.1.0 The '涤尘' (Dichen) skill bundle is a maintenance utility designed to audit and organize an agent's skills and memory files. It uses two Python scripts, `scan_skills.py` and `scan_memory.py`, to perform local file system analysis, identifying configuration errors in skill metadata and identifying stale or fragmented memory files for consolidation. The instructions in `SKILL.md` strictly adhere to a 'diagnosis-first' principle, requiring explicit user confirmation before performing any modifications or deletions. While `scan_skills.py` attempts a best-effort installation of the `pyyaml` library via pip, the behavior is consistent with its stated purpose of robust YAML parsing and does not exhibit signs of malicious intent or data exfiltration.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If approved carelessly, changes could alter future agent behavior or remove useful memory records.

Why it was flagged

The skill explicitly allows the agent to modify skill definitions, update scripts, append memory, create memory files, and delete old daily records after user confirmation.

Skill content
修复 SKILL.md 中的错误... 删除可清理的文件... 更新脚本中的过时路径... 用户确认后删除已过时效的每日记录文件
Recommendation

Review each proposed file change and deletion list before approving, and keep backups for important memory or skill files.

What this means

Running the scan could change the managed Python environment and depend on the current PyPI package supply chain.

Why it was flagged

The scanner may install the unpinned PyYAML package at runtime if it is missing.

Skill content
subprocess.run([sys.executable, "-m", "pip", "install", "pyyaml", "--quiet"], capture_output=True, timeout=30)
Recommendation

Prefer declaring and pinning PyYAML as a dependency, or ask the user before installing packages at runtime.

What this means

Private notes may be summarized in conversation or persisted into long-term memory where they can influence future agent behavior.

Why it was flagged

The skill reads memory files and can write persistent long-term memory or memory pointers after user approval.

Skill content
扫描记忆文件... 将用户确认的内容追加到 MEMORY.md... 创建 `{topic}_memory.md` 并更新 MEMORY.md 中的引用
Recommendation

Check the extracted snippets and proposed MEMORY.md additions carefully, especially for sensitive, outdated, or misleading information.