Hybrid Memory

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only memory skill is coherent, but it relies on persistent memory systems and an external Graphiti setup that users should review before use.

This skill appears purpose-aligned and instruction-only. Before using it, decide what information the agent is allowed to store in Graphiti, and review the external Graphiti Docker/sync-daemon setup before installing any background components.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Information the agent logs may be reused in future answers, so personal or sensitive facts could persist beyond the immediate conversation.

Why it was flagged

The skill explicitly supports storing facts in a persistent temporal memory system, including user-personal context. This matches the memory purpose but can retain sensitive or incorrect information for later reuse.

Skill content
Log important facts:

```bash
graphiti-log.sh GROUP_ID user "Name" "Fact to remember"
```

Common group IDs:
- `main-agent`
- `user-personal`
Recommendation

Use clear rules for what should be logged, avoid storing unnecessary sensitive details, and periodically review or delete persistent memory entries if the Graphiti setup supports it.

What this means

Installing the external Docker stack or sync daemons could add background memory-related services to the environment.

Why it was flagged

The skill itself is instruction-only, but it directs users to external setup steps and background components. This is relevant to the stated purpose, yet the external repository and daemon behavior are not contained in the reviewed artifact.

Skill content
Full setup guide: https://github.com/clawdbrunner/openclaw-graphiti-memory

**Part 2: Graphiti** — Deploy Docker stack, install sync daemons
Recommendation

Before following the external setup guide, review the repository, daemon configuration, data paths, and update process to ensure they match your privacy and operational expectations.