self-improving-agent

Security scan

Security ScanVirusTotalVirusTotalBenignView report →OpenClawOpenClawBenignhigh confidenceThe skill behaves like a self-improvement reminder/logging helper and the files and instructions are consistent with that purpose; no unexplained credentials, downloads, or hidden endpoints were found, but enabling hooks will persist reminders across sessions and you should avoid logging secrets.Details ▾✓Purpose & CapabilityName/description match the included files and instructions: scripts output reminders, an extractor scaffolds new skills, and OpenClaw hook handlers inject a bootstrap reminder. Nothing required or requested (env vars, binaries, creds) is unrelated to the stated purpose.ℹInstruction ScopeSKILL.md and scripts instruct the agent to write/maintain local markdown logs (.learnings/), to copy/enable a hook in the OpenClaw hooks directory, and to optionally run the extractor script. The error-detector reads the CLAUDE_TOOL_OUTPUT environment variable (an expected agent-provided value). This is in-scope, but be aware that learnings you log become persistent workspace context (and can be promoted to workspace-wide files) — do not store secrets or private data in these logs.✓Install MechanismNo automatic install spec; recommended install is via ClawdHub or a GitHub git clone (the README points to a GitHub repo). Files are local scripts and hook handlers; there are no downloads from arbitrary or shortener URLs or extract/install of remote archives in the package itself.✓CredentialsThe skill declares no required environment variables or credentials. The scripts read CLAUDE_TOOL_OUTPUT (a contextual tool-output variable provided by the agent runtime) which is consistent with the PostToolUse error-detection behavior described.ℹPersistence & Privilegealways:false and model invocation are normal. Enabling the provided OpenClaw hook will cause the reminder to be injected at agent bootstrap (i.e., it affects every session where the hook is enabled). This is a legitimate feature for a reminder/plugin, but it is a persistent presence in sessions when enabled — prefer project-scoped or opt-in enablement rather than enabling user/global hooks if you want limited scope.Assessm…