You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,12 @@ All notable changes to Network-AI will be documented in this file.
5
5
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
8
+
## [4.11.1] - 2026-03-22
9
+
10
+
### Fixed
11
+
-**ClawHub scanner: "suspicious" flag** — tightened `.clawhubignore` to exclude all TypeScript docs, OpenAPI spec, examples, and AI instruction files from the Python-only skill bundle; previously 15+ doc files referencing Node.js/TypeScript features leaked into the ClawHub package, causing a doc/bundle mismatch warning
12
+
-**SKILL.md clarity** — added explicit data-flow notice that `sessions_send` is NOT implemented by this skill (host-platform built-in only), added PII warning for justification fields and audit log, expanded `metadata.openclaw` with `sessions_send`, `pii_warning`, and `data_directory` fields
Copy file name to clipboardExpand all lines: SKILL.md
+17-4Lines changed: 17 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,9 +5,10 @@ metadata:
5
5
openclaw:
6
6
emoji: "\U0001F41D"
7
7
homepage: https://network-ai.org
8
-
bundle_scope: "Python scripts only (scripts/*.py). All execution is local."
9
-
network_calls: "none from bundled scripts; platform sessions_send delegations may invoke external models"
10
-
sessions_ops: "platform-provided"
8
+
bundle_scope: "Python scripts only (scripts/*.py). All execution is local. No TypeScript, Node.js, adapters, or CLI tools are included in this bundle."
9
+
network_calls: "none — bundled scripts make zero network calls. The host platform's sessions_send (not part of this skill) may invoke external models."
10
+
sessions_send: "NOT implemented or invoked by this skill. sessions_send is a host-platform built-in. This skill only provides budget guards that run before the platform delegates."
11
+
sessions_ops: "platform-provided — outside this skill's control"
11
12
requires:
12
13
bins:
13
14
- python3
@@ -18,11 +19,21 @@ metadata:
18
19
path: data/audit_log.jsonl
19
20
scope: local-only
20
21
description: "Local append-only JSONL file recording operation metadata. No data leaves the machine."
22
+
pii_warning: "Do not include PII, secrets, or credentials in justification fields. Log entries persist on disk."
description: "All persistent state is local-only. No files are transmitted over the network."
21
28
---
22
29
23
30
# Swarm Orchestrator Skill
24
31
25
-
> **Scope:** The bundled Python scripts (`scripts/*.py`) make no network calls, use only the Python standard library, and have zero third-party dependencies. Tokens are UUID-based (`grant_{uuid4().hex}`) stored in `data/active_grants.json`. Audit logging is plain JSONL (`data/audit_log.jsonl`). Workflow delegations that use the host platform's `sessions_send` may invoke external model APIs outside this skill's control.
32
+
> **Scope:** The bundled Python scripts (`scripts/*.py`) make **no network calls**, use only the Python standard library, and have **zero third-party dependencies**. Tokens are UUID-based (`grant_{uuid4().hex}`) stored in `data/active_grants.json`. Audit logging is plain JSONL (`data/audit_log.jsonl`).
33
+
34
+
> **Data-flow notice:** This skill does NOT implement, invoke, or control `sessions_send`. That is a host-platform built-in (OpenClaw runtime). The orchestration instructions below describe *when* to call the platform's `sessions_send` after budget checks pass — but the actual network call, model endpoint, and data transmission are entirely the host platform's responsibility. If you need to prevent external network calls, disable or reroute `sessions_send` in your platform settings before installing this skill.
35
+
36
+
> **PII / sensitive-data warning:** The `justification` field in permission requests and the audit log (`data/audit_log.jsonl`) store free-text strings provided by agents. **Do not include PII, secrets, or credentials in justification text.** Consider restricting file permissions on `data/` or running this skill in an isolated workspace.
26
37
27
38
## Setup
28
39
@@ -515,6 +526,8 @@ Sequential processing - output of one feeds into next.
515
526
516
527
**Every sensitive action MUST be logged to `data/audit_log.jsonl`** to maintain compliance and enable forensic analysis.
517
528
529
+
> **Privacy note:** Audit log entries contain agent-provided free-text fields (justifications, descriptions). These are stored locally in `data/audit_log.jsonl` and never transmitted over the network by this skill. However, **do not put PII, passwords, or API keys in justification strings** — they persist on disk. Consider periodic log rotation and restricting OS file permissions on the `data/` directory.
Copy file name to clipboardExpand all lines: skill.json
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
{
2
2
"name": "SwarmOrchestrator",
3
-
"version": "4.11.0",
3
+
"version": "4.11.1",
4
4
"description": "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. The bundled Python scripts make no network calls and have zero third-party dependencies. Workflow delegations via the host platform's sessions_send may invoke external model APIs.",
0 commit comments