Scaffold

Your agent. Configured to you. Remembers everything. Includes setup wizard, 30-day roadmap, 25 ready-to-use prompts, and pre-built memory files.

Scaffold appears to do what it advertises (make a persistent local agent), but it grants broad, high-impact capabilities to your agent and tells it to run some things silently. Before installing or running the setup script: 1) Inspect setup-wizard.sh and HOOKS.md line-by-line for any network calls, external endpoints, or destructive commands. 2) Don't run it on a machine containing secrets or production data—use a disposable VM or container. 3) Remove or .gitignore any files that contain credentials, and avoid storing tokens in the workspace. 4) Run setup-wizard.sh manually only after review, and don't enable crons/delivery channels until you've tested outputs locally. 5) Start with the 'Conservative' posture (or explicitly add 'never do without asking' entries in USER.md) so the agent requires confirmation before external actions. 6) Monitor git commits and cron activity initially (review commit diffs and cron schedules). Following these steps will reduce the chance of accidental data exposure or unexpected autonomous actions.

Type: OpenClaw Skill Name: scaffold Version: 1.0.1 The Scaffold skill bundle is a comprehensive framework for managing AI agent behavior, memory, and operational protocols. It includes extensive documentation (AGENTS.md, SOUL.md, HOOKS.md) designed to provide the agent with a consistent persona and safety guardrails, such as explicit permission tiers and warnings against data exfiltration. The included 'setup-wizard.sh' is a standard configuration script that uses safe practices, such as input escaping for sed operations and null-terminated find loops, to prevent accidental command injection. No evidence of malicious intent, unauthorized persistence, or data exfiltration was found; rather, the bundle focuses heavily on security awareness and preventing common AI agent failure modes.