Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Knowledge Management

v2.1.0

Organize and classify OpenClaw knowledge entries into local folders by content type (Research, Decision, Insight, Lesson, Pattern, Project, Reference, Tutori...

0· 1.1k·5 current·6 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description align with the actual behavior: reading local MEMORY.md and daily memory/*.md files, classifying entries, and writing timestamped markdown files. Requiring a local 'km' binary is coherent because package.json exposes that CLI. However, the tool relies on a local CLI (index-local.js) rather than an external service — that matches purpose but deserves attention because installation (npm link or placing the script on PATH) is necessary. Minor concern: the code defaults to /home/ubuntu/.openclaw/workspace which may be unexpected on non-ubuntu systems.
!
Instruction Scope
Instructions and code describe only local filesystem operations (parsing MEMORY.md, writing files, maintaining local state), which is appropriate. However there are multiple inconsistencies between docs and code about environment variable names and default locations: SKILL.md/README reference OPENCLAWORKSPACE (no underscore) or WORKSPACE while index-local.js checks OPENCLAW_WORKSPACE (with underscore). SKILL.md and README say default is ~/.openclaw/workspace, but the code falls back to /home/ubuntu/.openclaw/workspace. The tool also supports a --cleanup operation that will delete 'orphaned' files; if the state file is incorrect or out-of-sync this could remove user files. These mismatches and the destructive cleanup option are reasons to review behavior carefully before running.
Install Mechanism
No remote install spec is provided (instruction-only skill + included JS file). The project exposes a local CLI via package.json's 'bin' field; installation is local (npm link or placing the script on PATH). There are no downloads from external URLs and no unexpected installers in the manifest, which reduces install risk.
Credentials
The skill requests no secrets and no external credentials, which is appropriate. The only required 'credential' is the local 'km' binary. But documentation and code disagree on environment variable names (OPENCLAWORKSPACE vs OPENCLAW_WORKSPACE vs WORKSPACE), which can lead to confusing behavior. Also the hardcoded fallback to /home/ubuntu/.openclaw/workspace may cause the tool to read/write in an unexpected location if environment detection fails.
Persistence & Privilege
always:false (good). The skill writes files into a workspace and maintains a local state file (memory/local-sync-state.json) — this is expected for the purpose. The notable privilege is the '--cleanup' operation which will remove files not referenced in the state mapping; that is a normal feature for sync tools but has real destructive potential if the state file is corrupted or if the workspace path detection is wrong. The skill does not request system-wide configuration changes or credentials for other skills.
What to consider before installing
This skill appears to do what it says (parse local MEMORY.md and create organized markdown files), but there are a few red flags you should check before installing or running it: - Review and fix env var inconsistencies: SKILL.md/README mention OPENCLAWORKSPACE or WORKSPACE, but the code checks OPENCLAW_WORKSPACE. Decide which variable you will set and ensure the code or docs are aligned. - Check the default path: the code falls back to /home/ubuntu/.openclaw/workspace if no workspace is detected. On non-Ubuntu machines this may point to a non-existent or wrong home — set the workspace explicitly via --workspace or the correct environment variable. - Run in dry-run first: use km sync --dry_run (or km cleanup --dry_run) to preview changes before any files are written or deleted. - Back up your workspace: before running km sync --cleanup, back up memory/ and MEMORY.md so you can recover if the state file is wrong. - Inspect the bundled script: look through index-local.js (you have it) to confirm behavior (directory creation, file writes, hashing logic) meets your expectations; ensure no unexpected network calls are added later. - Install locally and trust source: the package exposes 'km' via package.json. Only npm link or add to PATH a copy you trust (don't run code from unknown servers). If these checks are satisfied and you run in dry-run mode first, the tool is usable; if you cannot confirm the workspace path or if you rely on shared/important files in the workspace, treat the cleanup step as potentially dangerous.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📚 Clawdis
Binskm
latestvk970aep8a7f6cr037jbhans9ws81v8nf
1.1kdownloads
0stars
2versions
Updated 7h ago
v2.1.0
MIT-0

Knowledge Management Skill (Local Storage)

Organize your OpenClaw memory files into a structured local knowledge base. Automatically parses MEMORY.md and daily memory files, classifies entries by content type, and stores each as a timestamped markdown file in the appropriate folder.

Available Tools

Core Commands

  • km sync [options] - Sync memory entries to local files
  • km classify [options] - Parse and classify without storing (JSON output)
  • km summarize [options] - Generate index files for each content type
  • km cleanup [options] - Remove orphaned files
  • km list_types - List all available content types

Setup

No API keys needed! The skill uses two locations:

  • Input Workspace: Where MEMORY.md and memory/ daily files are read from.
  • Output Directory: Where organized folders (Research/, Decision/, etc.) are written.

Both are detected automatically:

Input Workspace (source files)

  1. OPENCLAWORKSPACE environment variable
  2. --workspace <path> CLI argument
  3. Current working directory (if it contains MEMORY.md)
  4. Default: ~/.openclaw/workspace

Output Directory (organized files)

  1. --output-dir <path> CLI argument (relative to workspace or absolute)
  2. Default: <workspace>/memory/KM

The skill will create the output directory and all content-type folders automatically.

If you want to pre-create:

mkdir -p ~/.openclaw/workspace/memory/KM/{Research,Decision,Insight,Lesson,Pattern,Project,Reference,Tutorial}

Usage Examples

Default locations (input at workspace root, output in memory/KM)

# From any directory (workspace auto-detected)
km sync --days_back 7 --cleanup

Custom input workspace and output directory

km sync --workspace /custom/input/workspace --output-dir /custom/output/KM --days_back 7

Using environment variables

export OPENCLAWORKSPACE=/custom/input/workspace
km sync --output-dir /custom/output/KM --days_back 7

Dry run (preview only)

km sync --dry_run --days_back 1

Classify entries and export JSON

km classify --days_back 3 > entries.json

Generate index files (default: output directory)

km summarize
# or specify different location
km summarize --output_dir ~/some/other/folder

Preview orphan cleanup

km cleanup --dry_run

List content types

km list_types

Storage Structure

Assuming default configuration:

  • Input workspace: ~/.openclaw/workspace
  • Output directory: ~/.openclaw/workspace/memory/KM
~/.openclaw/workspace/
├── MEMORY.md                (source file - you edit this)
├── memory/                  (daily memory files)
│   ├── 2025-02-11.md
│   ├── 2025-02-12.md
│   └── ...
└── memory/KM/               (organized output by the skill)
    ├── local-sync-state.json
    ├── local-sync-log.md
    ├── Research/
    │   ├── 20260215T1448_Title_Here_HASH.md
    │   └── ...
    ├── Decision/
    ├── Insight/
    ├── Lesson/
    ├── Pattern/
    ├── Project/
    ├── Reference/
    ├── Tutorial/
    ├── Research_Index.md
    ├── Decision_Index.md
    └── ... (other index files)

File Naming

Format: YYYYMMDDTHHMM_Title_With_Underscores_8CHARHASH.md

The 8-character content hash suffix prevents filename collisions when titles are identical but content differs.

File Content (YAML Frontmatter)

---
title: "Protocol Name"
content_type: "Research"
domain: "OpenClaw"
certainty: "Verified"
impact: "Medium"
confidence_score: 8
tags: ["AI", "Automation"]
source: "MEMORY.md"
source_file: "MEMORY.md"
date: "2026-02-11"
content_hash: "e4b30e75d0f5a662"
---

Entry body content starts here...

How It Works

  1. Parses MEMORY.md and recent daily memory/*.md files
  2. Classifies each entry (content type, domain, certainty, impact, tags, confidence)
  3. Computes content hash for deduplication
  4. Checks sync state (memory/local-sync-state.json) to skip already synced entries
  5. Writes to appropriate folder with timestamp + hash filename
  6. Updates state mapping (hash → filepath)
  7. Optional cleanup removes files not in state

Classification Logic

  • Content Type: Keyword matching (Research, Lesson, Decision, Pattern, Tutorial, Reference, Insight)
  • Domain: Contextual inference (AI Models, OpenClaw, Cost, Trading, etc.)
  • Certainty: Based on language (Verified, Likely, Speculative, Opinion)
  • Impact: Importance indicators (High, Medium, Low, Negligible)
  • Tags: Auto-extracted from predefined keyword map
  • Confidence Score: 1–10 heuristic (source credibility, length, data mentions)

Customize by editing the EntryClassifier class in index-local.js.

State Management

memory/local-sync-state.json maps content hashes to file paths:

{
  "e4b30e75d0f5a662": "/path/to/Research/202602151440_Title_e4b30e75.md"
}

This enables idempotent syncs and fast duplicate detection.

Do not edit manually unless recovering from corruption.

Cron Integration

Automate daily syncs:

openclaw cron add \
  --name "Daily Knowledge Sync" \
  --cron "0 5 * * *" \
  --tz "Asia/Singapore" \
  --session isolated \
  --message "km sync --days_back 7"

Note: By default, the skill reads MEMORY.md from ~/.openclaw/workspace and writes organized files to ~/.openclaw/workspace/memory/KM. Use --workspace or --output-dir to customize these locations.

Troubleshooting

"km: command not found"

  • Run npm link in the skill directory, or add ~/workspace/bin to PATH.

No entries found

  • Ensure MEMORY.md uses ## section headers and ### entry titles within recognized sections.

Files not created

  • Check write permissions; run with --verbose.

Old entries not syncing

  • They may already be in state. Clear memory/KM/local-sync-state.json to force re-sync (caution: may duplicate files).

Duplicate files

  • Run km cleanup to remove orphans, then km sync to create missing files.

Version: 2.0.0 Changed: 2026-02-15 — Switched from Notion to local storage, added hash suffixes for uniqueness. Author: Claire (OpenClaw Agent) License: MIT

Comments

Loading comments...