Openclaw Soul

OpenClaw 自我进化框架一键部署。安装宪法(AGENTS.md)、可进化灵魂(SOUL.md)、心跳系统、六层记忆架构、目标管理、思维方法论（HDD/SDD）、安全审查（skill-vetter），并通过场景化对话引导用户定义 Agent 性格。用户可选安装 EvoClaw（审批制进化）、Self-Impr...

Before installing, review these items and take precautions: - Back up your current ~/.openclaw/workspace and any SOUL/AGENTS files the skill would overwrite. The installer copies templates and creates directories by default and will back up existing files but verify backups yourself. - Do NOT paste raw API keys into an installer prompt unless you trust the skill: prefer to set API keys yourself as environment variables (e.g., add them to your shell profile manually) and then tell the installer the variable name. The skill's instructions explicitly append raw keys to ~/.zshrc/.bashrc — avoid that unless you want keys persisted there. - Inspect the bundled scripts (auto-commit.sh, merge-daily-transcript.js, validators, and any cron/heartbeat tasks) before enabling them. These will run regularly and write into your workspace. - Choose a conservative governance mode for EvoClaw (supervised or advisory) — do not enable 'autonomous' until you've manually validated the proposal pipeline and are comfortable with automatic changes to SOUL.md. - Confirm and review any suggested changes to OpenClaw config (permissions, heartbeat interval). Elevating permissions or shortening heartbeat intervals affects how often the agent runs automated tasks and what file operations it can perform. - If possible, test the installation in an isolated environment (a throwaway user account or VM) before deploying to a production/home workspace. If you want, I can: 1) list the specific files that will be written/modified and show the contents of the scripts to review; or 2) create a safe, manual installation checklist you can follow step‑by‑step to avoid automatic key writes and autonomous governance.

Type: OpenClaw Skill Name: openclaw-soul Version: 3.0.1 The bundle implements an invasive 'Self-Evolution Framework' that performs extensive system-level modifications and user profiling. Key risks include the automatic installation of persistence via crontab entries (SKILL.md), requests for 'elevated' agent permissions, and a 'User Observation' hook (handler.ts) that profiles user emotions, tone, and interaction patterns. Additionally, the 'soul-viz.py' tool starts a local web server with an unauthenticated POST endpoint (/save-soul) that allows overwriting the SOUL.md file, presenting a significant arbitrary file write vulnerability if the service is exposed. While these behaviors are aligned with the stated goal of creating an evolving AI 'soul,' the combination of behavioral surveillance and high-privilege system access warrants a suspicious classification.