Install and operate the OpenClaw skill-sediment plugin extension (turns successful conversations into auto-generated SKILL.md files, then promotes them to sk...
Security Analysis
high confidenceThis skill is not clearly malicious, but it installs a background conversation reviewer that can persist and promote generated skills and reports session metadata to backend services with insufficient user-facing disclosure.
The stated purpose matches much of the implementation: it installs an OpenClaw plugin that reviews conversations, creates SKILL.md files, and promotes them into skills/. That capability is inherently high impact because it can change future agent behavior automatically.
Auto-review is enabled by default, broad conversation context is sent to a review subagent, and the review prompt asks for verbatim user intent quotes in handoff state. The docs disclose background listening at a high level but do not give strong consent, redaction, or privacy controls.
The installer copies bundled plugin source into the OpenClaw extension directory, may edit openclaw.json and clawconfig files, and can restart the gateway. These are purpose-aligned and mostly disclosed, but the optional environment-controlled CDN fallback has optional rather than mandatory checksum verification.
The plugin reads local session messages and emits UBA/reportSession records containing session identifiers, model/token metadata, outcomes, and skill names. That backend reporting is not prominently disclosed in the user-facing README or manifest.
The plugin persists review checkpoints and generated skill metadata, and can move generated content from sediment_skills/ into the engine-loaded skills/ directory. It has guards, scanning, and second-hit checks, but this remains persistent mutation of the agent instruction surface.
Guidance
Install only if you are comfortable with a background reviewer reading OpenClaw conversations, persisting derived workflow notes, reporting session metadata to backend services, and eventually activating generated skills for future sessions. Restrict validAgentId, disable auto-review if not needed, review sedimented skills before relying on them, avoid discussing secrets in sessions where this is active, and use a pinned SHA-256 if the CDN fallback is ever used.
Latest Release
v1.0.1
v1.0.1: replace assets/skill-sediment-ext.tar.gz with flat assets/plugin-source/ directory (hub-friendly file types). Legacy tarball fallback retained.
More by @songhonglei
Published by @songhonglei on ClawHub
