Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Overkill Memory System
v1.9.5Provides a neuroscience-inspired 6-tier automated memory system with WAL protocol, semantic search, emotional tagging, and value-based retention for OpenClaw...
⭐ 0· 548·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description (a local multi-tier memory system) is consistent with the shipped code (search, WAL, ChromaDB integration, spaced repetition, error-tracking modules). However the registry metadata claims no required env vars or binaries while the code and integration docs clearly depend on external tools and services: fd/rg for fast file search, ChromaDB/redis for vector/cache tiers, optional Ollama/OpenAI/Claude CLIs (ACC_MODELS) for LLM screening, AGENT_ID for multi-agent namespacing, and optional cloud backup (Supermemory). The skill legitimately needs many of these — but they should be declared. The lack of declared requirements is an incoherence and increases risk.
Instruction Scope
SKILL.md and many subdocs/scripts instruct the agent to read and write many files under ~/.openclaw (diary, daily logs, memory dirs, .learnings, git-notes), run cron jobs (background maintenance, periodic analyses), and invoke external CLIs (LLM commands via ACC_MODELS, fd/rg, rg JSON parsing). The instructions also show code that will walk user memory directories and ingest transcripts. Those actions are plausible for a memory system, but they give broad file access and persistent background activity. The runtime instructions are specific (cron entries, install.sh, scripts) — they are not limited or sandboxed, and they reference environment variables not declared in the registry.
Install Mechanism
Registry lists 'instruction-only' (no install spec), but the package includes several install scripts (e.g., acc-error-memory/install.sh) and many shell scripts that set up cron jobs and create state under the user's home (~/.openclaw). There is no single verified package repository or signed release; code will live on disk and contains many shell invocations and subprocess.run calls. While there are no external download URLs in the manifest, the included install scripts could modify crontab and write persistent files — a moderate install risk that should be manually audited before execution.
Credentials
The skill metadata declares no required environment variables, but the code/docs expect several: ACC_MODELS (LLM CLI commands), AGENT_ID (namespacing for ChromaDB), ChromaDB/OLLAMA/OpenAI credentials or settings (mentioned in .env example), and likely cloud backup credentials for 'Supermemory'. The code also expects fd/rg on PATH and may expect Redis/ChromaDB storage. Requiring LLM CLIs and cloud backup credentials is reasonable for some features, but the omission from the declared requirements is a serious mismatch and could lead to accidental credential exposure if users export keys without realizing.
Persistence & Privilege
always:false (no forced presence), but the package explicitly supports and documents setting cron jobs (install.sh --with-cron, ACC pipeline scheduled 3x/day) and persistent directories under the user's home. This is expected for an agent memory system (background sync, WAL flush), but it is persistent: cron tasks and files will remain and run outside immediate user actions. Because persistent background tasks are present but not highlighted in registry metadata, treat this as notable and audit install scripts before enabling cron.
What to consider before installing
This package contains a complete, locally runnable memory system and many helper modules — but its registry metadata understates what it needs. Before installing or enabling it: 1) Review install.sh and every script that writes to crontab or ~/.openclaw to see what will be created and scheduled. 2) Search the code for references to ACC_MODELS, AGENT_ID, ChromaDB, Ollama, Redis, fd, rg, and any network endpoints (Supermemory) — these indicate credentials and binaries the system will use. 3) If you plan to run it, run inside a contained environment (container or isolated user account) first; do not blindly export API keys into your global environment. 4) If you only want limited features, ask the author for a minimal configuration or disable cron/background sync and cloud backup. 5) Prefer setting required env vars locally and narrowly, and avoid giving broad credentials (cloud backups, LLM keys) unless you trust the source. Finally, request the upstream source/homepage or a reproducible build/release — the package currently lists 'source: unknown' and no homepage, which makes verification harder.Like a lobster shell, security has layers — review code before you run it.
aivk972gpqt5m9kn9ryb9bgexx22x81vy7bai-brainvk975fgbswrpbccqk3baezch0xd81tv8wbrain-regionsvk975fgbswrpbccqk3baezch0xd81tv8werror-trackingvk977d8qwdvf173d4s9yabwxm4h81vbr7habitsvk975fgbswrpbccqk3baezch0xd81tv8wlatestvk97erf6c6cc4ahj8sx8bzrs0z181tg0pmemoryvk975fgbswrpbccqk3baezch0xd81tv8wmulti-agentvk975fgbswrpbccqk3baezch0xd81tv8wneurosciencevk975fgbswrpbccqk3baezch0xd81tv8woptimizationvk972gpqt5m9kn9ryb9bgexx22x81vy7bproductivityvk972gpqt5m9kn9ryb9bgexx22x81vy7bspaced-repetitionvk975fgbswrpbccqk3baezch0xd81tv8w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.