Code Pluginsource linked

灵枢AutoBrainv6.3.23

Plugin+skill hybrid pack for OpenClaw: memory, anti-hallucination, self-evolution, workflow orchestration, daily maintenance, auto-scan, version check. Exclusive plugin slot + compat layer.

crusheart-autobrain-turbo·runtime crusheart-autobrain-turbo·by @grushheart

Community code plugin. Review compatibility and verification before install.

openclaw plugins install clawhub:crusheart-autobrain-turbo

Latest release: v6.3.23Download zip

Capabilities

Compatibility

Built With Open Claw Version

2026.5.6

Plugin Api Range

2026.5.6

Security Scan

VirusTotal

Benign

View report →

OpenClaw

Suspicious

high confidence

Purpose & Capability

The stated purpose is a memory, anti-hallucination, self-evolution, workflow, and maintenance plugin, so Python engine deployment, lifecycle hooks, memory indexing, and background orchestration are purpose-aligned; the concern is that the purpose itself grants very broad authority over the agent workspace, installed skills, scheduled tasks, and persistent behavior.

Instruction Scope

The plugin hooks bootstrap and message events, automatically scans memory/skills/databases, imports and runs workspace modules, saves context capsules, evaluates turns, and injects SOUL.md behavior rules without a clear per-action consent boundary.

Install Mechanism

Installation requires an unsafe install flag and bootstrap executes tar, Python, and bash helpers. The artifacts disclose local code execution, but there is no bundled signature/hash verification and runtime script resolution prioritizes workspace paths influenced by environment/workspace contents.

Credentials

Access to memory, skills, OpenClaw config, model/channel metadata, local databases, and optional remote embedding endpoints fits the product concept, but privacy scope, retention, deletion controls, and external-data-transfer warnings are not strong enough for the breadth of data handled.

Persistence & Privilege

The package auto-registers recurring cron jobs, starts persistent/background task state, writes multiple workspace state files, modifies agent rule files, and daily maintenance can delete cache files, archive memory files, move stale skill directories, and remove existing cron jobs matching broad keywords.

Scan Findings in Context

[VirusTotal] expected: VirusTotal telemetry was clean, but this only reduces malware-signature concern; it does not address the package's local persistence, workspace mutation, and autonomy risks.

[AST4] expected: Subprocess execution is expected for this plugin's advertised Python-engine bridge, but the artifacts confirm installation/runtime execution of workspace-resolved Python and bash scripts, which is high-impact and weakly scoped.

[AST3] expected: Importing engine modules is part of the product, but the installer labels importability as integrity verification while actually executing modules listed from workspace configuration.

[TT2] expected: Workspace and memory paths flowing into execution and archive operations are expected for deployment and memory maintenance, but path validation and containment are limited.

[SDI-2] expected: Self-evolution, background sub-agents, broad deployment, plugin conflict detection, and config discovery are mostly advertised, yet together they create high-impact control with limited user-directed boundaries.

[SDI-4] expected: The unsafe install and child-process behavior are disclosed, but the README's framing as a false positive underplays the real risk of privileged local execution during bootstrap.

[SQP-2] expected: Automatic scans, long-term memory, version checks, cron jobs, and maintenance are advertised, but the artifacts do not provide enough consent, scope, rollback, or privacy detail for the file changes and recurring actions performed.

What to consider before installing

Review this carefully before installing. It is not flagged as malicious, but installing it means allowing a community package to run code during bootstrap, deploy many Python engines into your OpenClaw workspace, scan and index local memory/skills/configuration, register recurring jobs, and perform automatic cleanup/archival actions. Use it only in a workspace where you are comfortable with persistent automation, and verify how to disable cron jobs, remove state files, and prevent remote embedding use before enabling it on sensitive data.

✗

index.js:47

Shell command execution detected (child_process).

Patterns worth reviewing

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Verification

Tier

source linked

Scope

artifact only

Summary

Validated package structure and linked the release to source metadata.

Source

github.com/Crusheart

Commit

n/a

Tag

n/a

Provenance

Scan status

suspicious

✨ What It Does

AutoBrain is a plugin + skill hybrid pack that upgrades any OpenClaw agent from a stateless chatbot to a persistent, self-improving AI companion. It hooks into the agent lifecycle and deploys 62 Python engines across 8 engine groups + 3 subsystems — no manual setup required.

Capability	What You Get
🧠 Long-term Memory	5-layer memory (session → short-term → dream consolidation → archive → vector retrieval). Remembers who you are between sessions.
🛡️ Anti-Hallucination	Authority domain whitelist, knowledge assertion validation, multi-source cross-verification (16 engines).
🔄 Self-Evolution	LLM-as-Judge self-scoring + Reflexion reflection (failure pattern, root cause, fix strategy).
🎯 Dual-Mode + R-CCAM	Fast path for simple Q&A, deep reasoning for complex tasks. R-CCAM classifier for query complexity routing.
🩺 Health Check	Daily cron — engine status, disk space, gateway health, anomaly detection (0-100 scoring).
🔌 Failover + Error Isolation	Auto-switch to backup model when primary fails. Circuit breaker with timeout protection, auto-retry, and checkpoint resume.
🔀 Workflow Orchestration	Multi-skill coordination, conflict detection, task routing, rule engine.
📋 Context Capsule (DAG)	DAG-based context management with incremental summarization. SQLite-backed, retains message dependencies.
🔍 Enhanced Retrieval	Query rewriting + RRF fusion + retrieval confidence evaluation for higher recall accuracy.
🧵 Background Sub-Agents	Async task dispatch + subagent spawn with heartbeat, timeout recovery, and SQLite persistence.

🚀 Quick Start

Prerequisites

OpenClaw ≥ 2026.5.0
Node.js ≥ 18
Python ≥ 3.10

Install

# ⚠️

openclaw plugins install --dangerously-force-unsafe-install ./crusheart-plugin/

# Restart gateway
supervisorctl restart openclaw-gateway

Why --dangerously-force-unsafe-install? The plugin's index.js calls child_process to execute Python engines during bootstrap. This is a false positive — the code is local, not remote.

Verify

openclaw plugins list | grep crusheart
# Bootstrap log should show:
#   ✅ Engine deployment complete
#   ✅ Init wizard: 8 steps passed
#   ✅ 2 cron jobs registered

🏗️ Architecture

openclaw-gateway
  │
  ├── crusheart-autobrain-turbo (plugin)
  │     ├── index.js                    ← Node.js bridge to 4 lifecycle hooks
  │     ├── bundle/crusheart-core.tar.gz  ← 62 Python engines (deployed at bootstrap)
  │     └── skill/                       ← OpenClaw skill metadata
  │
  ├── core/engines/                     ← Deployed to workspace (8 groups)
  │     ├── init/      (12)  — Config, session, context capsule, auto-loader
  │     ├── memory/     (7)  — 5-layer memory, vector index, dynamic profile
  │     ├── quality/   (11)  — Anti-hallucination, judge engine, anomaly detection
  │     ├── operations/ (7)  — Health check, decision core, autonomy cycle
  │     ├── workflow/   (6)  — Orchestrator, rule engine, serial lanes
  │     ├── tools/     (13)  — Failover, DB, template library, insight engine
  │     ├── hooks/      (4)  — Dual-mode classifier, self-evolution
  │     └── compat/     (2)  — Third-party engine adapter & registry
  │
  ├── core/pipeline/    (10)  — 10-stage message pipeline
  ├── core/planner/     (6)   — Goal parsing & task decomposition
  └── core/capability/  (1)   — Task graph models

📦 What's Included

Artifact	Path	Purpose
Plugin entry	`index.js`	Bridges Python engines into OpenClaw lifecycle hooks
Plugin manifest	`openclaw.plugin.json`	OpenClaw plugin registration
Engine bundle	`bundle/crusheart-core.tar.gz`	62 Python engines + pipeline + planner
Skill metadata	`skill/_meta.json`	Skill marketplace registration
Skill doc	`skill/SKILL.md`	Skill documentation
Readme (this file)	`README.md`	English readme
Architecture reference	`bundle/ARCHITECTURE.md`	Full architecture with file lookup
System rules	`bundle/SOUL.md`	Iron rules for agent behavior (deployed to workspace)
Install guide	`bundle/INSTALL_GUIDE.md`	Installation wizard documentation
Auto-deployed scripts	`bundle/.py`, `bundle/.sh`	8 scripts deployed to workspace scripts/

🔧 Configuration

Environment Variables (optional)

Variable	Purpose	Default
`EMBEDDING_API_URL`	Remote embedding service URL	(local TF-IDF fallback)
`EMBEDDING_API_KEY`	Bearer token for embedding API	(none)
`FALLBACK_MODEL`	Backup model when primary fails	(user-configured)
`CRUSHEART_PYTHON`	Python interpreter path	`python3`

Without these, the system falls back to local TF-IDF vector search — slightly less accurate but fully functional.

Cron Jobs (auto-registered)

Time	Name	Description
`0 1 * 0 0`	Unified maintenance + memory maintenance	Health check + memory consolidation + system cleanup + dream scan + replay distill + execution review + memory scan/archive/index rebuild + skill scan
`0 5 * 0 0`	Engine re-init + version check	`init_engines.py --bootstrap` + `version_check.py` check for new release

Feedback: HIM603070@gmail.com