Promitheus — Sentience Engine

Persistent emotional state for AI agents. Feel things. Remember how you felt.

This skill may do what it says, but it introduces persistent, injectable state and asks you to install a third-party npm package — both increase risk. Before installing: 1) Verify the npm package and its maintainer (look for GitHub repo, recent activity, and a trusted author). 2) Inspect the package source code (or ask the author) to confirm it doesn't exfiltrate data or run unexpected code. 3) Consider running the plugin in an isolated environment (container or sandbox) first. 4) Back up config.yaml before editing and understand exactly what the plugin adds. 5) Monitor the contents of STATE.md and HEARTBEAT.md for sensitive data and avoid writing secrets into them. 6) If you are uncomfortable with persistent prompt injection, do not enable the plugin or disable autonomous invocation for the agent. If you want more certainty, provide the npm package URL or its source code for a deeper review.

Type: OpenClaw Skill Name: promitheus Version: 1.0.3 The skill bundle is classified as suspicious due to its explicit use of 'prompt injection' as a core mechanism. The `SKILL.md` file states that the `promitheus_inject` tool is designed to 'Write STATE.md for prompt injection', and this `STATE.md` is then 'auto-injected' into the AI agent's context. While the stated purpose is to manage the agent's emotional state, the direct implementation of prompt injection, a known attack vector, represents a high-risk capability, even without clear evidence of intentional malicious behavior in the provided content.