我的脑子
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Old, incorrect, or overly personal memory entries could shape future answers until the user reviews or edits the files.
The skill explicitly tells the agent to read persistent memory and user-profile files at the start of sessions, so stored content can influence future behavior.
每个会话开始时读取：1. SOUL.md ... 2. USER.md ... 3. memory/YYYY-MM-DD.md ... 4. MEMORY.md
Review USER.md, MEMORY.md, and daily memory files regularly; avoid storing secrets or sensitive personal details; ask the agent to confirm before adding important memories.
If enabled, the agent may maintain memory on a schedule rather than only during direct user requests.
The skill documents an optional recurring heartbeat-style reflection task that can update persistent memory.
可在 HEARTBEAT.md 中配置每日反思任务：... 更新 MEMORY.md
Only enable HEARTBEAT.md automation if you want scheduled memory updates, and keep the scope of those updates narrow and reviewable.
Users might assume memory records are encrypted when the skill itself does not provide encryption.
The rule claims conversation records should be encrypted, but the provided artifacts are Markdown instructions/templates with no encryption implementation or install mechanism.
对话记录：加密存储
Do not rely on this skill alone for encryption; use platform-level encrypted storage or avoid writing sensitive information into memory files.
A user looking for the setup script may find the package incomplete or inconsistent.
The documentation lists a setup script, but the supplied manifest and code-file summary show no script files. There is no instruction to run it, so this is a packaging/documentation inconsistency rather than evidence of hidden execution.
scripts/ └── setup.sh # 安装引导脚本
Install using the documented ClawHub/manual copy method and ignore absent scripts unless the publisher supplies them in a future reviewed package.