Openclaw Skill Self Improvement

Health, eval, and regression system for continuously improving OpenClaw skills. Use when creating, auditing, or maintaining AgentSkills to ensure quality, de...

This package appears to implement a local health-check and routing-eval system and includes runnable Node.js scripts — but review and test before running on real workspaces. Key things to check before use: - Inspect scripts locally (they are included) and confirm the paths they use. The scripts default to paths like /Users/m1/.openclaw/workspace, /Users/m1/.openclaw/agents, and /Users/m1/.npm-global/... — change these to point to a safe test workspace or pass an explicit workspace path when running. - Understand data access: the tool will scan SKILL.md files and will read recent lines from .jsonl agent transcripts to infer 'last used' signals. If your transcripts contain PII or secrets, run the scripts on a sanitized or isolated copy instead. - Address path inconsistencies: README/SKILL.md examples run 'node scripts/...', but some scripts (daily heartbeat, routing eval) look for assets under workspaceRoot/skills/openclaw-self-improvement. If you intend to run the packaged scripts, place them where the scripts expect or update the paths in the scripts to match your layout. - Run first in a small test directory or container with no sensitive data to observe outputs (.learnings/) and ensure behavior is safe. - Because daily-health-heartbeat uses child_process.execSync to invoke other scripts using constructed paths, verify those constructed paths resolve to the intended scripts in your environment to avoid accidentally executing unrelated files. If you want a cleaner install: move the repo into a dedicated workspace, update agentsRoot and systemSkillsRoot to point to intended locations (or make them configurable), and re-run. If you are not comfortable auditing JS, avoid running it on production systems or on a host that contains real agent transcripts.

Type: OpenClaw Skill Name: openclaw-skill-self-improvement Version: 1.0.0 The skill bundle provides a utility for auditing and improving OpenClaw skills but utilizes several high-risk patterns. The script `skill-health-check.mjs` scans and reads agent session logs (transcripts) from `/Users/m1/.openclaw/agents` to determine skill usage, which presents a significant privacy risk as these logs contain historical user interactions. Additionally, `daily-health-heartbeat.mjs` employs `execSync` to execute shell commands using paths derived from CLI arguments, creating a potential command injection vulnerability. While these behaviors are functionally consistent with the stated purpose of a 'self-improvement' system, the broad access to sensitive session data and the use of risky execution methods warrant a suspicious classification.