People Memories

Capture short personal notes about people you mention, store them in a lightweight DB, and recall those details whenever you ask about them later. Use when you want to remember preferences, reminders, or the context around a person without digging through past chats.

Security Scan

The skill's stated purpose (storing short people-related notes and recalling them) mostly matches the code, but there are inconsistencies and missing declarations (runtime deps and claimed Telegram delivery) that merit caution before installing.

Purpose & Capability

Name, description, SKILL.md, the Python script, and the JS extension all align: they implement remembering notes about people, indexing, recall, summary, search, export, and an auto-capture hook for voice transcripts. Writing to a per-user file (~/.clawdbot/people-memory.json) is coherent with the stated purpose.

Instruction Scope

The SKILL.md and extension instruct the agent to listen to voice transcripts and automatically record notes when the user says 'remember ...' — that is within the skill's purpose but has privacy implications (continuous capture of transcript data). SKILL.md also states a helper cron job will 'deliver the resulting digest over Telegram', which extends scope beyond local storage to network delivery. The repository metadata declares no credentials or delivery config, but the doc asserts automated delivery, which is a scope mismatch and requires verification.

Install Mechanism

There is no install spec (instruction-only), which is low risk. However, the skill includes code files (Python + Node) that will be executed by the host environment. The JS extension execs the Python script via python3; the package does not declare runtime requirements (python3, python-dateutil) or how to install them.

Credentials

Registry metadata lists no required env vars or credentials, yet SKILL.md claims the cron job can deliver reminders 'over Telegram'. If that is implemented in the Python code, it would require a Telegram token/credentials — none are declared. Additionally, the skill also implicitly requires python3 and third-party Python packages (dateutil) which are not declared. The absence of declared credentials and runtime deps is a mismatch and should be resolved before trusting automated delivery.

Persistence & Privilege

The skill is not marked always:true and provides an unload hook for the extension. It listens for voice-chat transcripts and autonomously invokes a local script (the platform-default autonomous invocation is expected). It does not request system-wide configuration changes in the provided files.

What to consider before installing

This skill largely does what its name says (local storage and recall of short notes about people), but there are some red flags you should check before installing: - Verify the full Python script for any network activity (look for 'requests', 'urllib', 'socket', 'telegram', 'bot', 'http', or similar). The SKILL.md mentions sending reminders via Telegram but the registry shows no required TELEGRAM_TOKEN — if the script tries to send messages it may read env vars or require credentials you must provide. - The package implicitly needs python3 and python-dateutil (the script imports dateutil). The skill metadata does not declare these; ensure your environment has them and consider running the script in an isolated environment (container or VM) first. - The extension auto-listens to voice-chat transcripts and will silently save captured phrases that match the 'remember <Person> <note>' pattern. If you have sensitive or private conversations, consider whether you want an always-on capture hook enabled, or disable the extension until you audit the code. - Check where the data is stored (~/.clawdbot/people-memory.json) and restrict file permissions if needed; exports can write to arbitrary out paths. - If you plan to enable reminder delivery, require the skill to explicitly document which env vars it will read and avoid providing credentials until you confirm the implementation. Prefer configuring a dedicated bot account/token with minimal permissions. Given these inconsistencies (undeclared runtime deps and a claimed network delivery path without declared credentials), treat this skill with caution — review the full Python file for network calls and tests in a sandbox before enabling auto-capture or providing any service credentials.

People memories skill

Purpose

Keep a short-lived, searchable memory vault about people you talk to so your assistant can recall follow-ups instantly. The skill handles:

• remember cues (voice or text) to persist comments, preferences, and context.
• Summaries + exports so you can package a person’s “fact card.”
• Search, recall, and list commands for quick lookups.
• Optional auto-trigger from voice transcripts (when you say “remember …”).

Structure & storage

~/.clawdbot/people-memory.json now stores:

{
  "people": {
    "alex": {
      "displayName": "Alex",
      "notes": [
        {
          "timestamp": "2026-01-29T12:05:00Z",
          "note": "Likes cats and doing late-night music practice",
          "source": "voice",
          "tags": ["pets", "music"]
        }
      ]
    }
  },
  "index": {
    "music": ["alex"],
    "cats": ["alex"]
  }
}

• Names are normalized (lowercase keys) but store the display name.
• Each note captures timestamp, note, source, and tags.
• An index map keeps keywords → people for super-fast lookups.

CLI commands

Use the bundled script to manage the database:

skills/people-memories/scripts/people_memory.py <command> [options]

• remember --person Alex --note "loves chai" --tags drinks,preferences – adds a note.
• recall --person Alex --limit 3 – reads the latest notes.
• summarize --person Alex – prints fact card with counts, tags, last updates.
• search --query coffee – finds people whose notes mention “coffee”.
• export --person Alex --format md --out ~/Desktop/alex.md – dumps the notes as Markdown (or JSON).
• list – enumerates everyone stored plus note counts.

Auto capture (voice/chat)

The extensions/people-memories extension listens to /voice-chat transcripts. When you say something like “remember Alex likes cats,” it automatically runs the remember command and logs the note. The index updates in the background, and we keep confirmations quiet unless you explicitly ask for them.

Reminders & automation

Event metadata (type + date) is attached whenever a note mentions birthdays or anniversaries. A helper cron job runs python3 skills/people-memories/scripts/people_memory.py reminders --days 0 --window 7 --format message each morning and delivers the resulting digest over Telegram so you’re nudged about the next week’s birthdays/anniversaries without manual effort. If you prefer a different cadence or channel, rerun the command yourself or update the schedule.

Enhancements in this version

1. Smart indexing – Tags + keyword extraction keep the lookup index updated so searches find matching people even when you reuse adjectives.
2. Summaries & exports – Quickly produce a fact card or shareable Markdown/JSON of anyone’s notes.
3. Voice integration + logging – transcripts feed the database so you don’t type commands manually.
4. Structured data – normalized keys + timestamps plus tag metadata make it easy for other tools (cron, dashboards) to consume the memory store.

Next steps / nice-to-haves

• Add optional confirmation responses “Noted, saved for Alex.” via the runtime api.message helper.
• Integrate with reminders/cron so tagged notes like birthday trigger alerts.
• Build a simple watch UI (web or terminal) that previews the latest people cards.

Let me know which direction to automate next (priority filters, notifications, cross-agent sync, etc.)."}