Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Evermemos Openclaw Plugin

Install and configure EverOS for OpenClaw natural-language memory. Use when users say: - "install everos" - "setup everos" - "install everos plugin" - "enabl...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 33 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match what the files implement: a context-engine plugin that queries and writes to an EverOS backend. Declared behavior (recall before reply, save after turn) matches the code. Required resources (writes to ~/.openclaw, modifying openclaw.json, using a backend URL) are expected for this purpose.
Instruction Scope
SKILL.md and README instruct health checks, cloning/running EverMemOS, and running installer commands (npx/npm) or manual installer. Those steps are within the purpose, but they explicitly direct the operator to run network actions (git clone, docker compose, and a third‑party bootstrap script via curl | sh) that are external to OpenClaw; they also instruct changing OpenClaw config (setting contextEngine and disabling memory slot) and restarting the gateway. These are legitimate for onboarding but elevate operational risk and privacy exposure because conversation data will be sent to the configured backend.
Install Mechanism
There is no registry install spec in the package metadata, but the package contains a local installer (bin/install.js) and package.json including a bin `everos-install`. The recommended onboarding uses npx (fetches package from npm) or cloning GitHub and running the included installer. The SKILL.md also suggests running an external install script (https://astral.sh/uv/install.sh). These are expected for installing a backend/CLI but are higher‑risk than purely local installers because they execute code obtained from remote sources.
Credentials
The skill requests no environment variables or credentials and uses only HOME/USERPROFILE for locating configuration and plugin path. Network calls are limited to the configured EverOS baseUrl (default http://localhost:1995). There are no unrelated secret requests or references to other services' credentials.
Persistence & Privilege
always is false. The plugin will modify OpenClaw configuration (plugins.load.paths, plugins.allow, slots) and copy files into ~/.openclaw/plugins, which is appropriate for a plugin installer but is a persistent change to the agent environment. The runtime engine autonomously intercepts conversation turns (default platform behavior) and will transmit conversation content to the EverOS backend configured by the user.
Assessment
This plugin appears to be what it claims: a ContextEngine that fetches and saves conversation memory to an EverOS backend. Before installing, consider: 1) Privacy — the plugin will send user and assistant messages to the configured EverOS server (default http://localhost:1995). If you point baseUrl to a remote host you do not control, your conversation content will be transmitted to that host. 2) Configuration changes — the installer will modify ~/.openclaw/openclaw.json (set contextEngine to this plugin and set plugins.slots.memory = "none") and copy files into ~/.openclaw/plugins; this can disable other memory plugins. 3) Remote code execution — onboarding instructs running npx/npm and a third‑party curl | sh script for auxiliary tooling; these fetch and run code from the network. Review the remote URLs (npm package and the astral.sh script) or run installation in an isolated environment if you are uncomfortable. 4) Logs may include request/response bodies; if you have sensitive content, audit logging behavior. If you want stronger assurance, run the EverOS backend locally (per the README) and inspect the installer script contents before running. Proceed if you trust the upstream repo/package and are comfortable with the described configuration changes and data flow.
bin/install.js:217
Shell command execution detected (child_process).
bin/install.js:17
Environment variable access combined with network send.
!
bin/install.js:149
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.4.0
Download zip
latestvk9765xskjnraavqearmfnqtp7d835s6h

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

EverOS

EverOS OpenClaw Plugin gives OpenClaw persistent memory through the ContextEngine API.

Important distinction:

  • This is a context-engine plugin, not a memory slot plugin.
  • Users do not need to call memory tools manually.
  • Memory is triggered by normal conversation:
    • before reply: relevant memory is recalled and injected
    • after reply: new conversation content is saved back automatically

Trigger phrases

Use this skill when the user wants to:

  • install EverOS
  • set up EverOS memory for OpenClaw
  • enable long-term memory for OpenClaw
  • make natural-language conversations persist across sessions
  • configure the EverOS context engine

When to use this skill

Use this skill when the user wants:

  • persistent memory across OpenClaw sessions
  • automatic recall and save during normal conversation
  • a self-hosted EverOS backend
  • memory without manually calling memory_store / memory_search

When NOT to use this skill

Do not use this skill for:

  • cloud-only memory onboarding
  • troubleshooting unrelated OpenClaw issues
  • temporary context that only matters in the current session

What the user gets

Automatic lifecycle behavior:

HookTriggerWhat happens
bootstrap()Session startsBackend health check and session state init
assemble()Before each turnSearches relevant memory and injects it as context
afterTurn()After each turnSaves new messages from the turn
compact()Compaction checkParticipates in token-budget decisions
dispose()Session endsClears in-memory session state

User-facing result:

  • the user chats naturally
  • EverOS recalls relevant past context automatically
  • EverOS stores new useful context automatically

Definition of Done

This task is not complete until all of the following are true:

  1. the EverOS backend is reachable or the user has been explicitly told it still needs to be started
  2. the plugin is installed
  3. openclaw.json is configured correctly
  4. OpenClaw has been restarted
  5. the user has been given a natural-language verification step
  6. the full final handoff message has been sent

Onboarding

Step 0 - Set expectations

Before changing anything, tell the user:

OpenClaw will need a restart during setup. After restart, wait about 1 minute, then send a short natural-language message here to verify memory.

Do not skip this notice if you are going to restart OpenClaw automatically.

Step 1 - Check the EverOS backend

Default backend:

curl -sf http://localhost:1995/health && echo "OK" || echo "NOT_RUNNING"

If the backend is healthy, continue.

If it is not healthy, tell the user plainly:

The EverOS backend is not reachable yet. I can still finish plugin installation now, but automatic recall/save will not work until the backend is running.

If the user asks how to start the backend, give the shortest useful path:

git clone https://github.com/EverMind-AI/EverMemOS.git
cd EverMemOS
docker compose up -d
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp env.template .env
# edit .env
uv run python src/run.py

Step 2 - Install plugin

Preferred one-shot install:

npx --yes --package @evermind-ai/openclaw-plugin everos-install

Manual alternative:

npm install -g @evermind-ai/openclaw-plugin
everos-install

What the installer does:

  • adds the plugin path to plugins.load.paths
  • adds evermind-ai-everos to plugins.allow
  • sets plugins.slots.contextEngine = "evermind-ai-everos"
  • sets plugins.slots.memory = "none" to avoid slot conflicts
  • creates or updates plugins.entries["evermind-ai-everos"]

Step 3 - Manual config fallback

If the installer is unavailable, patch ~/.openclaw/openclaw.json manually.

Expected config shape:

{
  "plugins": {
    "allow": ["evermind-ai-everos"],
    "slots": {
      "memory": "none",
      "contextEngine": "evermind-ai-everos"
    },
    "entries": {
      "evermind-ai-everos": {
        "enabled": true,
        "config": {
          "baseUrl": "http://localhost:1995",
          "userId": "everos-user",
          "groupId": "everos-group",
          "topK": 5,
          "memoryTypes": ["episodic_memory", "profile", "agent_skill", "agent_case"],
          "retrieveMethod": "hybrid"
        }
      }
    }
  }
}

Merge-safe patch:

jq '
  .plugins = (.plugins // {}) |
  .plugins.load = (.plugins.load // {}) |
  .plugins.load.paths = ((.plugins.load.paths // []) + ["/path/to/evermemos-openclaw-plugin"] | unique) |
  .plugins.allow = ((.plugins.allow // []) + ["evermind-ai-everos"] | unique) |
  .plugins.slots = (.plugins.slots // {}) |
  .plugins.slots.memory = "none" |
  .plugins.slots.contextEngine = "evermind-ai-everos" |
  .plugins.entries = (.plugins.entries // {}) |
  .plugins.entries["evermind-ai-everos"].enabled = true |
  .plugins.entries["evermind-ai-everos"].config = (
    (.plugins.entries["evermind-ai-everos"].config // {}) + {
      "baseUrl": "http://localhost:1995",
      "userId": "everos-user",
      "groupId": "everos-group",
      "topK": 5,
      "memoryTypes": ["episodic_memory", "profile", "agent_skill", "agent_case"],
      "retrieveMethod": "hybrid"
    }
  )
' ~/.openclaw/openclaw.json > tmp.json && mv tmp.json ~/.openclaw/openclaw.json

Step 4 - Restart OpenClaw

Restart command:

openclaw gateway restart

Immediately before restart, tell the user:

EverOS is installed. I am restarting OpenClaw now. After about 1 minute, send a short message so we can verify memory recall.

Step 5 - Verify

Verification has two parts.

Backend:

curl http://localhost:1995/health

User-facing natural-language test:

Say: "Remember: I like espresso."

Then ask: "What coffee do I like?"

This is the preferred validation because it checks the real user flow instead of just config.


Final handoff

After successful setup, send this handoff message in the user's language. Do not remove sections.

EverOS is ready.

-- WHAT YOU CAN DO NEXT --

From now on, you can use normal natural language to make OpenClaw remember information.
You do not need to call memory tools manually.

Examples:
- "Remember: I like espresso."
- "Remember: this project uses PostgreSQL by default."
- "My coding style prefers small functions and explicit naming."

Later you can ask:
- "What coffee do I like?"
- "What database does this project use by default?"

-- CURRENT CONNECTION --

EverOS backend:
BASE_URL: <base-url>

OpenClaw config file:
~/.openclaw/openclaw.json

-- RECOVERY --

1. Keep your EverOS backend data and configuration
2. Reinstall this plugin on the new machine
3. Write the same `baseUrl`, `userId`, and `groupId` back into `openclaw.json`
4. Restart OpenClaw to reconnect to the same memory space

-- BACKUP --

- Back up `~/.openclaw/openclaw.json`
- Back up the EverOS backend data directory or database
- Back up the EverMemOS `.env` and deployment configuration

Troubleshooting

SymptomFix
Plugin not loadingCheck plugins.allow, plugins.load.paths, and plugins.slots.contextEngine
Backend unhealthyCheck baseUrl and ensure the EverOS backend is running
No recallVerify the backend contains memories and the query is meaningful
No saveVerify afterTurn() is running and backend write API is reachable
Memory plugin conflictMake sure plugins.slots.memory = "none"

API reference

Base: http://localhost:1995

MethodPathDescription
GET/healthHealth check
POST/api/v1/memoriesSave memory
GET/api/v1/memories/searchSearch memory
DELETE/api/v1/memoriesDelete memory

Communication style

When talking to users:

  • say this is automatic natural-language memory
  • do not describe it as a memory slot plugin
  • keep the next step concrete: restart, then try one short memory sentence
  • prefer real conversational verification over low-level API demos

Files

17 total
Select a file
Select a file to preview.

Comments

Loading comments…