ClawHub
Code PluginExecutes codesource-linked

Notes

Native OpenClaw notes plugin with local note storage and writing tools

Community code plugin. Review compatibility and verification before install.
notes-plugin · runtime id notes
Install
openclaw plugins install clawhub:notes-plugin
Latest Release
Version 0.1.0
Compatibility
{
  "builtWithOpenClawVersion": "0.1.0",
  "pluginApiRange": ">=2026.3.23"
}
Capabilities
{
  "bundledSkills": [],
  "capabilityTags": [
    "executes-code"
  ],
  "channels": [],
  "commandNames": [],
  "configSchema": true,
  "configUiHints": false,
  "executesCode": true,
  "hooks": [],
  "httpRouteCount": 0,
  "materializesDependencies": false,
  "providers": [],
  "runtimeId": "notes",
  "serviceNames": [],
  "setupEntry": false,
  "toolNames": []
}
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
Name/description align with the implementation: the code implements local note creation, search, append history and storage to a JSON file (default ~/.openclaw/state/notes/notes.json). No network calls or unrelated binaries are requested. The package-lock shows many npm packages, but that is likely due to transitive dependencies (e.g., the platform's 'openclaw' dependency) rather than the plugin itself requesting unrelated credentials or services.
ℹ
Instruction Scope
SKILL.md runtime instructions limit behavior to the notes_* tools and local JSON storage; the code reads/writes only the configured storagePath and does not reference other system files or network endpoints. However the skills/notes/SKILL.md includes YAML metadata setting openclaw.always to true, which expands runtime scope by telling the agent to always consider using these tools — this is not explained or justified in the prose and is a behavioral expansion compared with a normal optional plugin.
✓
Install Mechanism
There is no remote download URL or extract step; installation is standard npm (the README suggests npm install and build). No suspicious external download hosts are used. The package-lock contains many dependencies (truncated in the manifest) but they appear to come from normal npm packages; there is no evidence of custom remote installers or URL-shortened downloads.
✓
Credentials
The plugin declares no required environment variables or credentials. It only needs filesystem access to read/write the user-storage JSON file. Note: storagePath is configurable and can point to any path the user supplies; this is expected for a notes plugin but means a user-supplied path could overwrite files if misconfigured.
!
Persistence & Privilege
The SKILL.md header includes metadata setting openclaw.always to true (skills/notes/SKILL.md). That would make the skill persistently eligible for invocation on every agent run. The registry metadata provided with the skill shows always: false at the top-level, so there is a discrepancy between the registry flags and the SKILL.md metadata. 'always: true' is a significant privilege and should only be used with clear justification.
What to consider before installing
The plugin's code implements a straightforward local notes store and is coherent with its description, but check the SKILL.md metadata: it sets openclaw.always=true (making the plugin always considered for invocation). Confirm whether you want a notes plugin to be always active — if not, disable or remove that metadata before installing. Also review or restrict the configured storagePath so the plugin cannot be pointed at sensitive files, and inspect the package-lock or run the build in an isolated environment if you want to validate third-party dependencies before use.
Verification
{
  "hasProvenance": false,
  "scanStatus": "pending",
  "scope": "artifact-only",
  "sourceCommit": "23f665bf8e731ece36f25b91bc82a6269ff8318f",
  "sourceRepo": "clawic/plugins",
  "sourceTag": "main",
  "summary": "Validated package structure and linked the release to source metadata.",
  "tier": "source-linked"
}
Tags
{
  "latest": "0.1.0"
}

Notes Plugin

Native OpenClaw plugin that adds local note management with:

  • note creation, listing, retrieval, updates, append-only note entries, and deletion
  • notebooks, tags, pinning, and local JSON persistence
  • search across titles, note bodies, and appended entries

Install

npm install
npm run build
openclaw plugins install .
openclaw plugins enable notes
openclaw gateway restart

Config

{
  plugins: {
    entries: {
      notes: {
        enabled: true,
        config: {
          storagePath: "~/.openclaw/state/notes/notes.json",
          defaultNotebook: "inbox",
        },
      },
    },
  },
}

If storagePath is omitted, the plugin stores data in ~/.openclaw/state/notes/notes.json.

Tools

  • notes_create
  • notes_list
  • notes_get
  • notes_update
  • notes_append
  • notes_delete