Structured Memory
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This appears to be a legitimate workspace memory organizer, but it persistently indexes daily memory and operational facts, so users should avoid storing secrets and review generated files.
Install only if you want OpenClaw to maintain persistent structured memory for the workspace. Before running setup, decide whether to backfill historical memory; use --no-backfill if not. Avoid placing passwords, tokens, or other secrets in daily memory, and periodically review memory-index/, memory-modules/, memory-entities/, and critical-facts/ for sensitive content.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Operational details like hosts, endpoints, usernames, paths, and account identifiers can be copied into long-lived workspace memory.
The skill intentionally stores operational identifiers and account-related facts in persistent memory files for future recall. This is purpose-aligned, but users should understand that these facts may be retained and reused across sessions.
Store reusable execution-critical facts such as: - IPs - domains - usernames - stable paths - service endpoints - cron identifiers - chat or account identifiers
Do not put passwords, tokens, or sensitive secrets into daily memory. Review generated critical-facts/ files periodically, and use the documented no-backfill option if historical indexing is not desired.
Sensitive text already present in daily memory may be copied into additional generated memory files.
Extracted critical facts preserve the full source line as a note. If a daily-memory line contains a secret near an IP, path, URL, or account identifier, that line could be duplicated into generated critical-fact files.
'note': line.strip(),
Keep secrets out of memory entries, especially on the same line as operational identifiers, and consider adding redaction before critical-fact extraction.
Running initialization may process historical daily memory and create or update multiple memory-index, module, entity, and critical-fact files.
First-time setup can automatically rebuild all existing daily memory files into structured indexes. This is disclosed and purpose-aligned, but it can modify many generated workspace files at once.
for day in days:
subprocess.run(['python3', str(REBUILD_ONE_DAY), day], check=True)Run setup only in the intended workspace, back up important memory files if needed, and use --no-backfill when you do not want historical memory processed.
A user may not realize from metadata alone that the skill expects local Python script execution.
The registry metadata does not declare an install mechanism or required binaries, while the skill documentation instructs use of local python3 scripts. This is a transparency/completeness note, not evidence of malicious behavior.
No install spec — this is an instruction-only skill.
Confirm python3 is available and inspect the local scripts before running them, especially because the source is listed as unknown.