Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is a documentation-only skill for setting up Clawdbot/Moltbot memory search. It tells the user or agent to edit the Clawdbot configuration file, create MEMORY.md and memory folder files, and optionally restart the gateway. It does not contain executable code, hidden network calls, wallet access, or credential exfiltration. The main caution is that the recommended defaults enable indexing of memory and past session transcripts and may use external embedding providers such as Voyage or OpenAI. That could send sensitive content to third parties, a risk the package itself discloses in its skill card.
| Declared purpose | Enable and configure Moltbot/Clawdbot memory search for persistent context. Use when setting up memory, fixing "goldfish brain," or helping users configure memorySearch in their config. Covers MEMORY.md, daily logs, and vector search setup. |
| Observed behavior | Documentation only; no runtime code, scripts, or binaries. It provides JSON config snippets, directory and file naming guidance, AGENTS.md instructions for memory recall, troubleshooting steps including a documented shell command to restart the gateway, and guidance to set API key environment variables for Voyage/OpenAI. The skill card discloses data exposure risk from indexing memory and session transcripts. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_write | needed | Instructions direct creation or editing of config files and memory files such as ~/.clawdbot/clawdbot.json, MEMORY.md, and memory/logs; the package itself has no write calls. |
| shell | needed | Contains a documented troubleshooting command, clawdbot gateway restart; no shell execution is performed by the package. |
| credentials | needed | Guidance says to set VOYAGE_API_KEY or OPENAI_API_KEY environment variables; no code reads secrets or transmits credentials. |
| network | needed | Recommended configuration enables external embedding providers that would make network calls; the package itself performs no network requests. |
| severity | finding |
|---|---|
| info | Declared purpose The skill describes itself as setup guidance for Moltbot/Clawdbot memory search and vector search. SKILL.md:3 description: Enable and configure Moltbot/Clawdbot memory search for persistent context. Use when setting up memory, fixing "goldfish brain," or helping users c |
| info | Config file modification guidance Tells the agent or user to modify Clawdbot configuration as part of memory setup. SKILL.md:14 Add to `~/.clawdbot/clawdbot.json` (or `moltbot.json`): |
| low | External embedding provider default The recommended default is the Voyage external embedding provider. SKILL.md:20 "provider": "voyage", |
| medium | Session transcript indexing enabled The recommended sources include sessions, meaning past conversation transcripts may be indexed. SKILL.md:21 "sources": ["memory", "sessions"], |
| info | Memory file creation guidance Instructs creation of MEMORY.md and memory/logs, projects, groups, and system directories. SKILL.md:31 In your workspace, create: |
| info | Agent instruction modification Tells the user or agent to add memory recall instructions to AGENTS.md; this matches the skill's purpose. SKILL.md:104 Add to your AGENTS.md for agent behavior: |
| low | Shell command guidance Documents a shell command to restart the gateway; the package does not execute it. SKILL.md:119 3. Restart gateway: `clawdbot gateway restart` |
| low | API key environment guidance Instructs setting a Voyage API key in the environment; no code reads or transmits credentials. SKILL.md:127 - Voyage: Set `VOYAGE_API_KEY` in environment |
| low | API key environment guidance Instructs setting an OpenAI API key in the environment; no code reads or transmits credentials. SKILL.md:128 - OpenAI: Set `OPENAI_API_KEY` in environment |
| medium | Disclosed data exposure risk The skill card explicitly warns that indexing transcripts with external providers may expose sensitive or regulated data. skill-card.md:24 Risk: The skill recommends indexing memory files and past session transcripts, including with external embedding providers, which can expose sensitive or regula |
| info | Provided mitigation The skill card recommends reviewing sources, preferring local indexing in sensitive environments, and avoiding secrets or regulated data. skill-card.md:26 Mitigation: Review memory sources before indexing, prefer local or memory-only indexing in sensitive environments, avoid storing secrets or regulated data, and |
| info | Docs-only nature The skill card states that no runtime code is executed by the skill itself. skill-card.md:40 **Other Properties Related to Output:** [Docs-only setup guidance; no runtime code is executed by the skill itself.] |
| info | External link The only observed domain is clawhub.ai, in a publisher link. No hidden network destination was found. skill-card.md:9 [jrbobbyhansen-pixel](https://clawhub.ai/user/jrbobbyhansen-pixel) |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 171 | 92023a48f5bfb5d4… |
_meta.json | 6 | ac5e279d25f1cdaa… |
skill-card.md | 48 | 973487126646149e… |
For agents
JSON: https://agenteconomy.report/k/memory-setup.audit.json · badge: https://agenteconomy.report/k/memory-setup.audited.svg ·
skill rating: /k/memory-setup · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).