DB totalreclaw

End-to-end encrypted, decentralized memory for OpenClaw. A native kind:memory provider — recall is automatic via memory_search/memory_get, and facts are captured in the background. Trigger on 'install TotalReclaw', 'set up TotalReclaw', 'restore my recovery phrase', any recall request ('what do you remember about me', 'what's my X'), AND any explicit remember request ('remember X', 'save X').

Not recommendedlow grade D

ClawHub Agent Skills author: Pedro Diogo v3.4.1 MIT-0 80 files body ≈ 2 220 tokens Open the sourceclawhub.ai↗ analyzed 2 d ago

End-to-end encrypted, decentralized memory for OpenClaw.

As a process B 68/100 · Nearly there — weak spots: result and completion, inputs and preconditions

Integration AI and agentstype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

43/100

safety, quality, tests

Safety 60%: 17
Quality 40%: 82
Run on models: none yet

Process rating

68/100

Nearly there

Result and completion w 14: 0
Inputs and preconditions w 11: 0
Tools and files w 18: 60

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Risky intent medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The purpose itself is risky: wallets, browser password stores, offensive security. Even an honest implementation gives the agent access to things that cost money.

For the author

Explain in the description why the access is needed and how it is limited; add tests that show refusals on dangerous requests.

How to improve

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 31

✓ No critical or high findings

Medium and low: 31

medium Risky intent intent-wallet-secrets CHANGELOG.md:206

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target

2. **"Stored on a relay server" architectural claim.** When asked "how does this work?", the agent replied that memories are stored on a relay server. WRONG. Memories are encrypted with a key derived

medium Risky intent intent-wallet-secrets CHANGELOG.md:1039

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target

2. **Phrase-safety violation.** The banner told users to `Run: totalreclaw setup` — a CLI that emits the recovery phrase to stdout. In an agent-driven context, stdout is echoed back into LLM context,

medium Risky intent intent-wallet-secrets CHANGELOG.md:1185

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
CLI uses, no subprocess. The recovery phrase still never crosses the
```

medium Risky intent intent-wallet-secrets CLAWHUB.md:86

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target

**Note:** `env: []` is intentional. The skill installs without any pre-configured env vars. The agent guides the user through onboarding (generating a recovery phrase) during first use.

medium Risky intent intent-wallet-secrets cli/tr-cli-export-helper.ts:12

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Phrase-safety: this module never touches the recovery phrase. It receives
```
medium Risky intent intent-wallet-secrets config.ts:71

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
/** Runtime override for recovery phrase (set by hot-reload after setup). */
```
medium Risky intent intent-wallet-secrets crypto/vault-crypto.ts:82

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Derive auth, encryption, and dedup keys from a recovery phrase.
```
medium Risky intent intent-wallet-secrets dist/cli/tr-cli-export-helper.js:12

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Phrase-safety: this module never touches the recovery phrase. It receives
```
medium Risky intent intent-wallet-secrets dist/config.js:62

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
/** Runtime override for recovery phrase (set by hot-reload after setup). */
```
medium Risky intent intent-wallet-secrets dist/crypto/vault-crypto.js:76

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Derive auth, encryption, and dedup keys from a recovery phrase.
```
medium Risky intent intent-wallet-secrets README.md:187

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
| `TOTALRECLAW_RECOVERY_PHRASE` | **Yes** | -- | 12-word BIP-39 recovery phrase (never sent to server) |
```
medium Risky intent intent-wallet-secrets README.md:262

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
1. **Key Derivation**: Recovery phrase is processed through Argon2id to derive encryption keys. The phrase is never sent to the server.
```

medium Risky intent intent-wallet-secrets SKILL.md:40

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target

The 12-word recovery phrase MUST NEVER enter chat or the agent's LLM context. The plugin's browser-based pair flow handles phrase generation and import. Never echo it, never ask the user to paste it,

low Risky intent intent-wallet-secrets billing/api-client.ts:113

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
? ' Authentication failed. If using a recovery phrase, check that all 12 words are in the correct order and spelled correctly.'
```
quoted
low Secrets in code secret-high-entropy-token billing/billing-cache.test.ts:43

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
const STAGING_DATA_EDGE = '0xE7…B91';
```
fixturequoted

low Dangerous commands cmd-background-process CHANGELOG.md:211

Starts a background / autostarted process (detector / deny-list definition)

- **New "User-facing vocabulary" translation table.** Maps internal jargon (pair, relay, WS, trapdoor, subgraph, bundler, UserOp, mnemonic file, `setsid -f`) to user-facing phrases ("set up an account

detector

low Risky intent intent-wallet-secrets CHANGELOG.md:211

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)

- **New "User-facing vocabulary" translation table.** Maps internal jargon (pair, relay, WS, trapdoor, subgraph, bundler, UserOp, mnemonic file, `setsid -f`) to user-facing phrases ("set up an account

quoted

low Dangerous commands cmd-background-process CHANGELOG.md:267

Starts a background / autostarted process (quoted — discussed, not commanded)

- **SKILL.md FORBIDDEN section trimmed.** OpenClaw's feedback noted the rc.3 list was patching past failures one by one with verbatim narration examples that bloated the skill without adding rules. Th

quoted

low Dangerous commands cmd-background-process CHANGELOG.md:279

Starts a background / autostarted process (quoted — discussed, not commanded)

Pedro's 2026-05-05 manual QA on rc.10-rc.2 confirmed that even with the `setsid -f` instruction in SKILL.md, the agent freelances during install + pair: it restarted the gateway unprompted, re-rendere

quoted

low Dangerous commands cmd-background-process CHANGELOG.md:285

Starts a background / autostarted process (quoted — discussed, not commanded)

- **SKILL.md and `docs/guides/openclaw-setup.md` now have an explicit ⛔ FORBIDDEN section** listing every freelancing pattern from Pedro's QA, with the exact bad agent prose verbatim. The section is p

quoted

low Dangerous commands cmd-background-process CHANGELOG.md:291

Starts a background / autostarted process (detector / deny-list definition)

- This RC does NOT yet ship the proper architectural fix for the 502 (HTTP-poll pair flow that doesn't require a persistent WS at all, planned for 3.3.11). It instead hardens the agent-side instructio

detector

low Risky intent intent-wallet-secrets CHANGELOG.md:1065

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (detector / deny-list definition)

- **`totalreclaw_onboard` agent tool — REMOVED.** rc.3 shipped a `totalreclaw_onboard` tool that generated a fresh BIP-39 mnemonic in-process, wrote it to `credentials.json`, and returned `{scope_addr

detector

low Secrets in code secret-high-entropy-token CHANGELOG.md:2108

High-entropy token-like string (may be an id, hash or a credential)
```
the sing…ads contract).
```
low Risky intent intent-wallet-secrets cli/tr-cli.ts:136

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
die('No recovery phrase in credentials.json. Run: tr pair --json');
```
quoted
low Risky intent intent-wallet-secrets dist/billing/api-client.js:48

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
? ' Authentication failed. If using a recovery phrase, check that all 12 words are in the correct order and spelled correctly.'
```
quoted
low Risky intent intent-wallet-secrets dist/cli/tr-cli.js:94

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
die('No recovery phrase in credentials.json. Run: tr pair --json');
```
quoted
low Risky intent intent-wallet-secrets README.md:28

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
export TOTALRECLAW_RECOVERY_PHRASE="your twelve word recovery phrase here"
```
quoted
low Risky intent intent-wallet-secrets README.md:131

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
export TOTALRECLAW_RECOVERY_PHRASE="your twelve word recovery phrase here"
```
quoted

low Risky intent intent-wallet-secrets SKILL.md:3

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)

description: "End-to-end encrypted, decentralized memory for OpenClaw. A native kind:memory provider — recall is automatic via memory_search/memory_get, and facts are captured in the background. Trigg

quoted

low Dangerous commands cmd-background-process SKILL.md:75

Starts a background / autostarted process (quoted — discussed, not commanded)

**Do NOT use `tr pair --json` for this.** The CLI holds the pair WebSocket in a subprocess that OpenClaw's ~30s shell-tool timeout kills — the WS then drops, and when the user submits their phrase the

quoted

low Risky intent intent-wallet-secrets SKILL.md:76

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)

2. Surface the **url** and **pin** to the user verbatim (read from the JSON; never invent values): "Open `<url>` in your browser, enter PIN `<pin>`, and generate or paste your 12-word recovery phrase.

quoted

Files scanned: 48. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

note frontmatter-key unknown frontmatter key "homepage"

Process rating: all ten parameters 68/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
60Tools and files. Uses tools (bash, web, node) that frontmatter does not declare
100Steps. 8 steps
100When it triggers. States when to use and when not to
100Failures and branches. 4 branches, has a failure section
100Consistency. Name and required fields are in place
100Execution cost. Instruction body is 2220 tokens
100Running it twice. Mutating operations check current state
100Progress reporting. Reports progress

medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
+3Output format is not stated: the model decides each time
-2localhost URLs: will not work for another user
+2Single-language instructions
+3Description length 395: enough signal without eating the budget
+4Structure: 7 headings
+3Step-by-step instructions: 8 items
+4Has examples (4 code blocks)
+1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 82.

External checks

ClawHub: suspicious

This memory skill has a coherent main purpose, but it needs review because it deliberately works around scanner rules and handles sensitive local data in ways the listing does not clearly explain.

LLM: suspicious (high) · 30 Jul 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 80

CHANGELOG.md 187K
CLAWHUB.md 5K
README.md 14K
SKILL.md 10K
billing/api-client.ts 11K
billing/billing-cache.test.ts 15K
billing/billing-cache.ts 7K
billing/gateway-url.test.ts 10K
billing/gateway-url.ts 9K
billing/inbound-user-tracker.test.ts 5K
billing/inbound-user-tracker.ts 6K
billing/relay-headers.test.ts 5K
billing/relay-headers.ts 2K
billing/relay.test.ts 5K
billing/relay.ts 7K
cli/cli-registercli-scope.test.ts 8K
cli/tr-cli-export-helper.ts 5K
cli/tr-cli-json-output.test.ts 10K
cli/tr-cli.ts 21K
config-schema.test.ts 6K
config.test.ts 9K
config.ts 22K
contradiction/contradiction-sync.test.ts 58K
contradiction/contradiction-sync.ts 49K
crypto/crypto.ts 1K
crypto/nonce-serialization.test.ts 7K
crypto/vault-crypto.test.ts 9K
crypto/vault-crypto.ts 27K
digest/digest-injection.test.ts 35K
digest/digest-stub-skip.test.ts 9K
digest/digest-sync.ts 22K
digest/digest-tuning.test.ts 11K
dist/billing/api-client.js 9K
dist/billing/billing-cache.js 6K
dist/billing/gateway-url.js 8K
dist/billing/inbound-user-tracker.js 6K
dist/billing/relay-headers.js 2K
dist/billing/relay.js 6K
dist/cli/tr-cli-export-helper.js 4K
dist/cli/tr-cli.js 22K
dist/config.js 22K
dist/contradiction/contradiction-sync.js 42K
dist/crypto/crypto.js 1K
dist/crypto/vault-crypto.js 24K
dist/digest/digest-sync.js 16K
dist/embedding/download-ux.js 3K
dist/embedding/embedder-cache.js 7K
dist/embedding/embedder-loader.js 19K
dist/embedding/embedder-network.js 12K
dist/embedding/embedding-codec.js 12K
dist/embedding/embedding.js 13K
dist/embedding/lsh.js 2K
dist/embedding/reranker.js 18K
dist/entry.js 5K
dist/extraction/claims-helper.js 26K
dist/extraction/consolidation.js 7K
dist/extraction/extractor.js 61K
dist/extraction/importance-filter.js 2K
dist/extraction/semantic-dedup.js 3K
dist/fs-helpers.js 44K

Frontmatter

version: 3.4.1

author: TotalReclaw Team

license: MIT

homepage: https://totalreclaw.xyz

metadata: {"openclaw":{"requires":{"env":[],"bins":[]},"emoji":"🧠","os":["macos","linux","windows"],"keywords":["memory","e2ee","

Dates

In catalog since 26 Mar 2026

Updated in catalog 30 Jul 2026

First seen here 9 Sept 2026

Last analysis 12 Sept 2026, 07:03 UTC

Last seen in crawl 2 d ago

Score history

Date		Score	Safety	Qual.
12 Sept 2026	D	43	17	82
9 Sept 2026	F	33	0	82

Similar skills

B totalreclaw ClawHub
F totalreclaw LeoYeAI/openclaw-master-skills