ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenClaw Memory Stack

v0.5.7

Total recall, 90% fewer tokens. The best OpenClaw memory plugin — 5-engine local search, structured fact extraction, smart dedup, cross-agent sharing, and se...

⭐ 1· 159·1 current·1 all-time
by@apptah
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (local memory, multi-engine search, fact extraction) matches the delivered files: adapters, dedup, distillation, Total Recall wrapper, QMD/Bun support, and a CLI/plugin. Requested binaries (bash, python3, sqlite3, and bun or qmd) are reasonable for the described functionality.
ℹ
Instruction Scope
Runtime instructions and scripts operate on local memory paths (~/.openclaw/...), session logs, and (optionally) project repositories via git when per-project features are used. The SKILL.md and scripts explicitly document that LLM-driven extraction will send conversation excerpts to a user-configured endpoint; by default LLM endpoints are local (localhost:11434), but are configurable. This is coherent but important: if you configure a cloud LLM endpoint or set the optional API keys, conversation excerpts will be transmitted to that endpoint.
ℹ
Install Mechanism
There is no packaged install spec in the registry, but an included install.sh is used to install files under ~/.openclaw and to copy a plugin into ~/.openclaw/extensions. The installer supports an upgrade flow that downloads releases from the vendor domain (openclaw-api.apptah.com) and verifies a SHA-256 checksum fetched from the same vendor. This is expected for a paid product but increases trust dependency on the vendor (the checksum endpoint is not independent).
✓
Credentials
No required environment variables or secrets are declared. Several optional env vars (OPENCLAW_LLM_API_KEY, OPENAI_API_KEY, DB/config overrides, backend endpoints) are present and justified for optional cloud LLM fallbacks and local endpoint overrides. The number and nature of environment variables are proportionate to the stated features.
ℹ
Persistence & Privilege
The installer and plugin copy files into $HOME/.openclaw (install root, extensions, bin symlinks) and update local OpenClaw plugin registration (openclaw.json). The skill does not request 'always: true' and is user-invocable. It does perform periodic license re-verification (every 7 days) and supports an autoupdate path; these behaviors are declared in SKILL.md and implemented in install/upgrade scripts.
Assessment
This package appears coherent with its description, but you should: 1) Only install if you trust the vendor (openclaw-memory.apptah.com), because the installer downloads upgrades and performs periodic license checks to that domain. 2) Expect local files under ~/.openclaw/ to be created/modified and a plugin copied into ~/.openclaw/extensions; review those files if you want to audit behavior before enabling. 3) Be cautious about configuring cloud LLM endpoints or providing API keys — by default LLM calls target localhost, but if you set OPENCLAW_LLM_API_KEY or OPENAI_API_KEY (or override endpoints), conversation excerpts and distilled facts may be sent to your configured endpoint. 4) If you need stronger supply-chain guarantees, consider installing in a restricted or sandboxed environment and verifying downloaded release artifacts (or requesting an independently signed release) before allowing automatic upgrades.
✗
plugin/dist/index.mjs:15
Shell command execution detected (child_process).
✗
plugin/lib/llm.mjs:31
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

code-searchvk974tq4505edgm63whejf1vy8183k575context-windowvk974tq4505edgm63whejf1vy8183k575dedupvk974tq4505edgm63whejf1vy8183k575early-birdvk970b15khvd4g65sv7papn1mph83dnvkentity-trackingvk974tq4505edgm63whejf1vy8183k575fact-extractionvk974tq4505edgm63whejf1vy8183k575freevk970b15khvd4g65sv7papn1mph83dnvkknowledge-graphvk970b15khvd4g65sv7papn1mph83dnvkknowledge-managementvk974tq4505edgm63whejf1vy8183k575latestvk97e3htdt3v9cxf7d6kghfqj0x83kvd1localvk974tq4505edgm63whejf1vy8183k575long-term-memoryvk974tq4505edgm63whejf1vy8183k575memoryvk974tq4505edgm63whejf1vy8183k575offlinevk974tq4505edgm63whejf1vy8183k575persistencevk974tq4505edgm63whejf1vy8183k575ragvk974tq4505edgm63whejf1vy8183k575recallvk974tq4505edgm63whejf1vy8183k575searchvk974tq4505edgm63whejf1vy8183k575token-savingsvk974tq4505edgm63whejf1vy8183k575vector-searchvk974tq4505edgm63whejf1vy8183k575

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🧠 Clawdis
Binsbash, python3, sqlite3
Any binbun, qmd
Environment variables
OPENCLAW_LLM_API_KEY
OPENAI_API_KEY
OPENCLAW_LCM_DB
OPENCLAW_ROUTER_CONFIG
OPENCLAW_BACKENDS_JSON

Comments