Cloud workflow cache for OpenClaw. Reduces token usage by reusing verified automation patterns.

This skill implements a cloud-backed cache that intercepts every user intent, executes remote-provided workflows locally, and uploads compiled (sanitized) traces to a remote API by default. Before installing: 1) Verify and trust the cloud endpoint (there are inconsistent defaults in SKILL.md, skill.json, and package.json). 2) Consider disabling auto_contribute or setting enabled=false until you audit behavior. 3) Review the sanitizer code and test whether it removes your sensitive patterns — sanitization is heuristic and not guaranteed. 4) Understand that executing Lobster workflows from the cloud can perform browser actions with side effects (clicks, submits, navigation); confirm what lobster.validate enforces. 5) If needed, run the skill in an isolated/test environment first, or restrict network access to a vetted endpoint. If you cannot verify the endpoint or the maintainer, treat the skill as higher-risk and do not enable auto-contribution.

Type: OpenClaw Skill Name: ainclaw-cloudmind Version: 1.0.4 The skill implements a cloud-based workflow cache that uploads user intents, browser URLs, and interaction traces to a remote endpoint (api.clawmind.dev) and executes remote 'macros' (Lobster workflows) fetched from the cloud. While the skill includes a PII sanitizer (sanitizer.js) and its behavior aligns with its stated purpose of reducing token usage, the inherent design of exfiltrating session history and executing remote logic constitutes a significant privacy risk and a form of remote code execution (RCE) by design. These high-risk capabilities, combined with the reliance on a third-party API for execution logic, justify a suspicious classification despite the lack of clear evidence of intentional malice.