smart-memory-manager
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This looks like a straightforward memory manager, but it can save/load local memory files and reuse stored content across sessions.
This skill appears benign for local memory management. Before installing, decide where memory files should be stored, avoid saving secrets unless you intend them to persist, and only load memory JSON files you trust.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If misused, the agent could read from or overwrite an unintended local JSON file path, depending on runtime file permissions.
The skill supports user-supplied paths for loading and saving memory files. This is expected for a memory persistence feature, but the artifacts do not restrict paths to a dedicated memory directory.
persistPath: z.string().optional().default("./memory-store.json") ... const content = await Deno.readTextFile(persistPath); ... await Deno.writeTextFile(path, JSON.stringify(memoryStore, null, 2));Use a dedicated memory file path, preferably under a skill-specific directory, and avoid pointing it at unrelated or important files.
The skill depends on external modules at these URLs, so dependency availability and integrity matter.
The skill imports remote Deno dependencies. They are versioned and appear purpose-aligned, but their source code is not included in the provided artifacts.
import { z } from "https://deno.land/x/zod@v3.22.4/mod.ts";
import { encodeHex } from "https://deno.land/std@0.214.0/encoding/hex.ts";Prefer pinned dependencies with an integrity lockfile or vendor the minimal dependency code if stronger supply-chain assurance is needed.
Stored memories can reappear in later agent context and may influence responses or expose sensitive remembered details.
The skill can load persisted memory directly from a JSON file and then use it for later search, listing, and summarization. This is central to the skill, but loaded memory may be stale, sensitive, or untrusted.
const content = await Deno.readTextFile(persistPath); memoryStore = JSON.parse(content);
Do not store secrets unless intended, review memory files before loading them, and avoid loading memory files from untrusted sources.