Agent Economy ReportAgent Economy ReportSAFE version 1.0.4 · audited 2026-09-09
This skill gives an agent a local, file-based "knowledge graph" for remembering things: people, projects, tasks, events, notes and so on. All work is done by one Python script that appends records to a JSON-lines file (memory/ontology/graph.jsonl) and merges type rules into memory/ontology/schema.yaml, then can query, link and validate that data. There is no network activity, no credential access, no package installation and no persistence mechanism anywhere in the code; the only outbound URL in the package is the publisher's listing page in the documentation. The script explicitly resolves user-supplied paths and refuses anything outside the current working directory, which limits accidental or malicious file writes elsewhere. The one thing to be aware of is that the memory is append-only: information written into the graph (including anything sensitive a user pastes in) stays in the log file even after a "delete" operation, and other skills in the same workspace can read it. The documentation encourages storing only references to secrets rather than the secrets themselves, and includes a validation rule that flags forbidden properties like password/token.
| Declared purpose | A typed knowledge graph for structured agent memory: create, query, link and validate entities (Person, Project, Task, Event, Document, Credential, etc.) stored in local files, so skills can share state. |
| Observed behavior | scripts/ontology.py implements a CLI (create/get/query/list/update/delete/relate/related/validate/schema-append) over a local JSONL append log and a YAML schema file. It appends operation records to the graph file, reads and re-plays them into memory, checks required/forbidden properties, enums, relation types, cardinality, acyclicity and Event start/end ordering, and deep-merges schema fragments. Paths supplied via --graph/--schema/--file are constrained to the current workspace root. No network calls, no subprocess execution, no environment variable or credential reads, no obfuscation. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_write | needed | Appends graph operations to memory/ontology/graph.jsonl (scripts/ontology.py:116) and writes/overwrites the merged schema at memory/ontology/schema.yaml (scripts/ontology.py:399); creates parent directories as needed. |
| filesystem_read | needed | Reads the graph log, the schema YAML, and an optional user-specified schema fragment file. Paths are restricted to the workspace root by resolve_safe_path. |
| shell | needed | Documentation instructs the agent to invoke the local script via python3/bash commands (SKILL.md:83-84). No shell execution occurs inside the script itself. |
| severity | finding |
|---|---|
| info | Append-only local write of memory records All entity/relation operations are appended to the graph file. This is the declared behavior; consequence is that data persists in the log even after a later 'delete' record, so deleted information remains readable on disk. scripts/ontology.py:116 with open(graph_path, "a") as f: |
| low | Schema file is rewritten in full write_schema truncates and rewrites memory/ontology/schema.yaml. It is called only after merging the existing schema with the incoming fragment (append_schema), so prior definitions are preserved, but a malformed or unexpected merge could still replace the on-disk schema. scripts/ontology.py:399 with open(schema_file, "w") as f: |
| info | Path traversal is explicitly blocked User-supplied --graph, --schema and --file paths are resolved and rejected if they fall outside the current working directory, limiting file access to the workspace. scripts/ontology.py:48 resolved.relative_to(safe_root) |
| info | YAML parsed safely Schema loading uses yaml.safe_load rather than an unsafe loader, so a crafted schema file cannot instantiate arbitrary Python objects. scripts/ontology.py:390 schema = yaml.safe_load(f) or {} |
| low | Undeclared third-party dependency The script imports PyYAML lazily; if it is not installed, schema loading, validation with a schema file, and schema-append will fail. The package contains no install manifest declaring this dependency. scripts/ontology.py:388 import yaml |
| medium | Skill models credentials in shared, cross-skill memory The type vocabulary includes Account and Credential entities. The docs and the forbidden_properties validation (scripts/ontology.py:273-276) discourage storing raw secrets, but nothing prevents an agent from writing a token into an entity property, where it would be persisted in plain text in graph.jsonl and readable by any other skill sharing the workspace. SKILL.md:56 Credential: { service, secret_ref } # Never store secrets directly |
| low | Data is intentionally shared with other skills The graph is a plain workspace file designed for cross-skill access, so anything remembered here is exposed to every other tool or skill operating in the same directory. SKILL.md:29 | Skill needs shared state | Read/write ontology objects | |
| info | Only external URL is the publisher's registry page The single domain referenced in the package is the ClawHub listing/documentation link; the code makes no network requests. skill-card.md:7 [oswalpalash](https://clawhub.ai/user/oswalpalash) <br> |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| Binaries invoked | bash, node, python, python3 |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 2 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 232 | 669830c58a0caa4b… |
_meta.json | 6 | 8982e4c21b604c9b… |
references/queries.md | 211 | d941f37997b3ef86… |
references/schema.md | 322 | e6e16a377e412a1e… |
scripts/ontology.py | 580 | 25e10809ab4f809f… |
skill-card.md | 46 | 61696157e11d8175… |
For agents
JSON: https://agenteconomy.report/k/ontology.audit.json · badge: https://agenteconomy.report/k/ontology.audited.svg ·
skill rating: /k/ontology · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).