Claw Memory Guardian

This package is not obviously malicious, but there are consistency and implementation issues you should review before installing: - Review install.js and index.js: the installer copies files into ~/.openclaw/workspace/skills and writes an executable shim to workspace/bin. If you install, these local files will be created/overwritten under your user account. - Check the auto_save.sh content before running it: it contains an infinite loop and expects 'jq' to be present. The script may not behave as described in the docs (it appears not to perform git commits/backups). Do not run it as a background service until you inspect it and test in a sandbox. - Confirm which config file is used: the code reads OPENCLAW_WORKSPACE/config.json (default ~/.openclaw/workspace/config.json) but SKILL.md tells you to edit ~/.openclaw/config.json — ensure you edit the actual file the code reads or set OPENCLAW_WORKSPACE explicitly. - Verify git behavior and scope: the code initializes a git repo in your workspace and performs commits of memory files. If your workspace contains other sensitive data, double-check .gitignore contents and the commands used (the code adds and commits './memory/*' but the initial git init operates at the workspace root). - Test in an isolated environment first: run the provided simple_test.js/test.js in a disposable directory or VM to observe real behavior before adding to your primary workspace. If you want me to, I can: point to the exact lines that write files, show the auto_save.sh contents and where jq is referenced, or suggest minimal edits to make the scripts safer (e.g., limiting git scope, not writing a globally reachable bin shim, requiring explicit start of auto-save).