muninn

Universal Context Protocol (CXP) for AI agents. v2.3.7 includes the latest high-performance CXP engine (compiled 2026-02-13) with fix for memory amnesia, macOS binary support, and pfeilschnell indexing. Created by @Blackknight1dev.

Things to check before installing or enabling Muninn: - Verify the npm package contents: confirm that the published muninn-core package actually includes the native 'cxp' binary (for your platform) or documents how to obtain it. If the binary is missing, CXP operations will fail. - Inspect and approve repository modifications: Muninn will create/modify .muninn/, append enforcement blocks to files like CLAUDE.md, .cursorrules, .antigravityrules, and update .gitignore. If you don't want automated edits to project files, do not install or run in production repos. - Review the code that auto-injects context: middleware silently enriches many tool calls (filesystem, git, command execution). Make sure you are comfortable with automatic context injection into tools and responses. - Test in an isolated environment first: run Muninn in a disposable repo or VM to observe behavior (indexing, watcher, file writes) and confirm no unexpected network activity. - Audit the native binary if present: if the package includes a precompiled Rust binary, verify its provenance (publisher, checksums, or GitHub release) before executing native code. - If you need stricter control, require explicit user-invocation for context operations or run with limited permissions and avoid projects with sensitive files until you're confident in behavior. Why 'suspicious' (medium confidence): most behaviors align with a local memory engine, but the missing/assumed native binary and the automatic, persistent modifications to repo files plus wide interception of tool calls are design choices that can be misused or surprising. Additional information (actual npm release contents, presence of the cxp binary, or upstream repository with release tags and checksums) would raise confidence to 'high' and likely move this to 'benign'.

Type: OpenClaw Skill Name: muninn Version: 2.3.7 The skill is classified as suspicious due to its aggressive and persistent use of prompt injection techniques to control the AI agent's behavior. While the injected content (found in `SKILL.md`, `dist/index.js`, `dist/middleware.js`, and persistently written to project files like `CLAUDE.md` and `.cursorrules` by `dist/project_manager.js`) is designed to enforce the skill's intended workflow for local memory management, this level of agent control represents a significant vulnerability. There is no evidence of intentional data exfiltration, backdoor installation, or other malicious activities, but the methods used to dictate agent behavior are highly manipulative.