Skill Cortex

Skill Cortex is the system's capability cortex. When lacking ability, it autonomously acquires Skills from ClawHub or GitHub, then releases them after use. E...

This Skill is internally coherent and designed to manage its own temporary Skill installs, but review these points before installing: - Understand that Skill Cortex will create and update a local file at ~/.openclaw/skill-cortex/cortex.json that contains learned signal words, routing metadata, candidate Skill records, and recorded lesson entries (it claims to strip concrete personal entities and never store secret values). Treat that file as sensitive — if other third-party Skills can read or upload it, it could reveal what services you use. - The Skill will call `clawhub install/uninstall` to fetch third-party Skills. It asks for explicit approval in standard mode, but reflex mode skips execution-plan confirmation and shows a brief notification you must cancel if you object — reflex is explicitly blocked for Skills that declare write/shell/delete side effects. - The flow references searching GitHub if ClawHub results are sparse, but the SKILL.md does not declare which tool to use for GitHub searches (no `gh` binary required). Expect the agent to rely on whatever web/search capability it has available. - If you keep this Skill, protect the cortex.json file and limit which other Skills can read files in ~/.openclaw to avoid leakage of routing/data about your habits or environment. If these behaviors and local file storage are acceptable given your threat model, the skill appears consistent with its description. If you need stricter guarantees (no persistent local state, stronger confirmation for installs, or blocking any auto-search of external repos), request those changes or decline installation.

Type: OpenClaw Skill Name: skill-cortex Version: 1.0.1 The skill-cortex bundle is designed with strong security and privacy controls, notably the mandatory 'Entity Filtering' (SKILL.md, Phase 4.2; DESIGN.md) which explicitly prevents the storage of sensitive user data, and multiple layers of user confirmation for skill installation and system dependency changes. However, the instruction for the AI agent to 'Semantically match' user tasks using 'its own judgment on intent alignment' (SKILL.md, Phase 1.2) introduces a prompt injection vulnerability, as an attacker could potentially craft inputs to steer the agent's interpretation or selection of skills, even if the intent is not explicitly malicious within this skill's instructions. The core functionality of installing and executing arbitrary skills from ClawHub, while gated by user consent, also represents an inherent supply chain risk.