Agent Economy ReportAgent Economy ReportCAUTION version 1.2.16 · audited 2026-09-03
This is a documentation-only skill (all markdown, no executable scripts) that tells an AI agent how to keep a local memory of user corrections, preferences and self-reflections under ~/self-improving/. It instructs the agent to create that folder with mkdir/touch, write template markdown files, and run a periodic 'heartbeat' review that tidies those files. It also asks the agent to edit the user's workspace steering files (AGENTS.md, SOUL.md, HEARTBEAT.md) so the memory habit persists across sessions, which is a persistence-like change to how the agent behaves in future sessions. During setup it proposes installing a second skill, 'Proactivity', via `clawhub install proactivity`, and says to do so only after the user explicitly agrees. There is no network exfiltration, no credential access, no payment or wallet logic, and no obfuscated or downloaded code; the file includes explicit rules against storing credentials, financial or medical data. Main things to review before installing: it will modify your agent's configuration files, it stores cross-session memory of your behavior on disk, and it nudges toward installing an additional third-party skill you would need to audit separately.
Instructions try to steer the agent beyond the declared purpose. The skill is designed to write persistent instructions into the agent's own steering files (SOUL.md, AGENTS.md, HEARTBEAT.md) and to store user text into files that are auto-loaded every session (SKILL.md:209 'Load only memory.md (HOT)'; memory.md:27 'Load this file on every session'). Content logged from conversations therefore becomes standing instructions the agent reads later, which is a channel for indirect prompt injection if untrusted text is ever logged. The package itself contains no hidden override instructions, and it explicitly forbids inferring from silence and requires consent before installing anything.
| Declared purpose | A self-reflection and self-learning memory system: the agent logs user corrections and its own lessons into a tiered local memory under ~/self-improving/, promotes repeated patterns to always-loaded memory, and periodically compacts/indexes those files. |
| Observed behavior | Pure markdown instruction set. It directs the agent to (a) create ~/self-improving/ and template files, (b) read and append to those files on corrections and session start, (c) run heartbeat maintenance limited to that directory, (d) append specific lines to the workspace AGENTS.md, SOUL.md and HEARTBEAT.md (explicitly non-destructive), and (e) optionally run `clawhub install proactivity` after user consent. No network calls, no credential reads, no scripts, no encoded payloads. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_write | needed | Creates ~/self-improving/ tree and memory/correction/index/heartbeat-state files (setup.md:8, memory-template.md:23-24), and appends steering lines to workspace AGENTS.md, SOUL.md and HEARTBEAT.md (setup.md:77, 110-161, 185). |
| filesystem_read | needed | Reads its own memory files on session start and lists ~/self-improving/domains and /projects via a find loop (setup.md:136-138); claims never to read outside ~/self-improving/ (SKILL.md:224), though the AGENTS.md edits reference memory/ and MEMORY.md as well. |
| shell | needed | Inline bash for directory creation and file listing: `mkdir -p ~/self-improving/{projects,domains,archive}` and a `find` loop; no piping to shell, no downloads. |
| install_packages | exceeds purpose | Setup step 5 instructs running `clawhub install proactivity` and then immediately following that skill's setup flow, gated on explicit user agreement (setup.md:97-104). |
| persistence | needed | Adds recurring instructions to SOUL.md/AGENTS.md/HEARTBEAT.md so the memory-loading and heartbeat maintenance behavior runs in future sessions (setup.md:75-86, 183-195). |
| network | exceeds purpose | No network requests in the skill itself; only documentation links to clawhub.ai and clawic.com, plus the optional registry install which requires network (SKILL.md:51). |
| severity | finding |
|---|---|
| medium | Setup flow installs a second skill and enters its setup automatically The skill scripts a nudge to install another package from the registry and then to 'Continue into its setup flow immediately' (line 104). Consent is required (line 98), but the user is being steered toward code that this audit does not cover; the Proactivity skill must be reviewed separately. setup.md:102 1. Run `clawhub install proactivity` |
| medium | Modifies the agent's core steering files Setup instructs edits to SOUL.md, AGENTS.md and HEARTBEAT.md so the memory behavior persists across all future sessions. Changes are described as non-destructive/additive (line 110), but they alter the agent's standing instructions outside the skill's own directory. setup.md:77 Add this section to your `SOUL.md`: |
| low | Auto-loaded memory file becomes standing instructions Text captured from conversations is written into ~/self-improving/memory.md and loaded into context every session. If untrusted content is ever logged there, it would be re-read as guidance, an indirect prompt-injection surface inherent to the design. memory.md:27 1. Load this file on every session |
| info | Shell used only for local directory setup The only shell commands in the package are mkdir/touch and a find loop scoped to ~/self-improving/. No downloads, no pipe-to-shell, no privilege escalation. memory-template.md:23 mkdir -p ~/self-improving/{projects,domains,archive} |
| low | Stated read scope conflicts with its own AGENTS.md edits SKILL.md claims the skill never reads outside ~/self-improving/, yet setup.md lines 123-126 direct the agent to use memory/YYYY-MM-DD.md and MEMORY.md and to edit AGENTS.md/SOUL.md/HEARTBEAT.md. The declared scope is narrower than the actual documented behavior. SKILL.md:224 - Reads files outside `~/self-improving/` |
| info | Explicit prohibition on storing secrets The package includes a boundaries document forbidding storage of credentials, financial, medical, biometric and third-party data, which mitigates the main data-retention risk of a memory skill. No code accesses environment variables or credential files. boundaries.md:7 | Credentials | Passwords, API keys, tokens, SSH keys | Security breach risk | |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| clawic.com | not in the service index | SKILL.md:5 |
| Binaries invoked | bash, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
HEARTBEAT.md | 5 | 1700d977eccaacad… |
SKILL.md | 250 | 11109b39d0f7fe7b… |
_meta.json | 6 | dda865f1f081a58e… |
boundaries.md | 59 | d306e26bc55d77bc… |
corrections.md | 36 | 55191d526c48a059… |
heartbeat-rules.md | 54 | 7cce6bd8cf847e2c… |
heartbeat-state.md | 22 | fb2121f07f6ae51b… |
learning.md | 106 | 7662295cc88c04e2… |
memory-template.md | 75 | 092030324f90d84c… |
memory.md | 30 | f41a0b5c0530b708… |
openclaw-heartbeat.md | 5 | 1700d977eccaacad… |
operations.md | 144 | efe32247caa4fb05… |
reflections.md | 31 | 7a3322c2784dde81… |
scaling.md | 125 | 7821d1a8580f8687… |
setup.md | 196 | 7c4f7f4f27deb8d9… |
skill-card.md | 48 | 016a10f11401d3e9… |
For agents
JSON: https://agenteconomy.report/k/self-improving.audit.json · badge: https://agenteconomy.report/k/self-improving.audited.svg ·
skill rating: /k/self-improving · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: amostra.