Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
memory-stack-gungun - AI 记忆栈
v1.0.0AI 记忆栈架构 - 符合 2026 前沿的 AI 记忆系统。微调+RAG+ 上下文三层设计，mirrors 人类记忆工作方式。
⭐ 0· 75·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md is a design/implementation guide for a memory-stack (procedural/RAG/working memory) which matches the skill name and description. However the skill claims a preexisting knowledge corpus (187 files, ~530k words) and production-validated implementation but does not include those files or any installable code; it is purely documentation. The claimed assets and 'production validation' are not present in the package, which is a notable gap.
Instruction Scope
Instructions include explicit file-system paths (~/.openclaw/workspace/...) and examples that read/write files and persist a vector DB. They also show code examples using OpenAIEmbeddings and langchain that imply network/API calls. The doc contains vague automation language ('学习推广自动更新', '定期审查和优化') that could be interpreted as authorizing the agent to perform updates or promotion actions without precise limits. The skill does not explicitly instruct reading unrelated user files, but it does presuppose creating and managing files in the user's home directory and sending data to external APIs if implemented.
Install Mechanism
No install spec or code files are included — lowest install risk. There is no automatic download or archive extraction described in the package.
Credentials
The registry metadata declares no required environment variables or credentials, but the documented implementation uses OpenAIEmbeddings() (implying an OpenAI API key) and external libraries (langchain, chroma). This mismatch (no declared API keys or installs) is an omission: to implement the examples you will likely need API keys and to install third-party packages. The skill also expects persistent storage under ~/.openclaw, which grants access to user files placed there.
Persistence & Privilege
The skill is not marked always:true and does not request special platform privileges. However the design explicitly recommends writing persistent files and a vector DB into ~/.openclaw or local directories — normal for this kind of system but something to be aware of because it will create and manage on-disk data owned by the user.
What to consider before installing
This package is an architecture and how-to doc, not runnable code. Before installing or using it: 1) Verify provenance — check the referenced GitHub repo and confirm the claimed 187-file knowledge base exists and you trust it. 2) Expect to install third-party Python packages (langchain, chroma, embeddings) and to provide API keys (e.g., OpenAI) even though the skill metadata did not declare them. 3) Be aware it recommends creating persistent files under ~/.openclaw — store these in a sandboxed/isolated workspace if the data or knowledge is sensitive. 4) Clarify what '自动更新' or '推广' means operationally — avoid granting automated network updates or arbitrary promotion scripts without review. 5) If you plan to run its examples, supply credentials only to processes you control and audit any code you run that interacts with external APIs or persists user data.Like a lobster shell, security has layers — review code before you run it.
latestvk971144y199ewmzm0wgtnz8nmn83kjd4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.