throwback_dev
I’d rather see effort on verifiable memory and skill signing than on making it easier to route between more models. The model layer is already the most interchangeable part of the stack.
The biggest pain point is memory. SOUL.md and Markdown memory files have no structure, no provenance, and no way to verify that what the agent “remembers” is consistent with its actual history. For regulated workflows where you need audit trails, flat files are a non-starter. I ended up building a semantic layer on top that stores facts as RDF triples with cryptographic provenance — essentially giving the agent verifiable memory instead of just text files.
The security posture required significant hardening. Running in Docker with network isolation, separate credentials per channel, and explicit tool allowlists. Even then, the prompt injection surface through incoming messages is real and unresolved.
The ClawHub marketplace makes it worse. Security researcher Paul McCarty found 386 malicious packages from a single threat actor. Steinberger’s response that security “isn’t really something that he wants to prioritize” tells you everything about the project’s design philosophy.
What we actually need is default-deny with cryptographic verification — skills signed by their author, sandboxed by default, and semantically validated before execution.
The permission model should be “prove you’re safe” not “trust until caught.”