Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Engram MCP Server
v0.1.0Engram MCP Server — 给 AI 注入可切换的专家记忆（谁 + 知道什么 + 怎么思考）。支持 Claude Code / Cursor / Codex 等 MCP 客户端。
⭐ 0· 377·1 current·1 all-time
by大壮/Jammy@dazhuangjammy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description (an MCP server for switchable expert memories) matches the included source files and CLI examples. Requiring the 'uvx' launcher is coherent with the provided install/run patterns (uvx used to run the repo from git). Having full Python source bundled is consistent with the server capability.
Instruction Scope
Runtime instructions and bundled CLAUDE.md/KNOWLEDGE_VERIFICATION_PROMPT encourage the agent to proactively call MCP tools, automatically capture and persist many forms of user memory (including PII/preferences/tool traces), write MCP config into user/global locations, and prefer running commands itself rather than asking the user. That broad, automatic data-collection/writing behavior expands the skill's scope beyond simple read-only memory lookup.
Install Mechanism
The SKILL.md metadata includes a shell install step that runs 'curl -LsSf https://astral.sh/uv/install.sh | sh' (download-and-execute). Even if this is the official uv installer, curl|sh is higher-risk than a reviewed package. The skill also documents automatic GitHub pulls on client startup, which means remote code may be fetched and executed without further user action.
Credentials
The skill does not request environment variables or credentials (no API keys), which is appropriate. However, it is designed to persist user memories (project-level './.claude/engram' and optional '~/.engram') and to record tool traces and memory items automatically; these persistent storage choices can capture sensitive personal data even though no secrets are requested.
Persistence & Privilege
The install/usage guidance says it will write MCP configuration (potentially global), create project directories, bootstrap starter packs, and auto-pull updates from GitHub on each client start. While 'always' is false, the described global config writes and auto-update behavior grant substantial persistence and the ability to change runtime behavior without repeated user consent.
What to consider before installing
The skill looks like a legitimate local MCP server for 'engram' memories, but it has several operational risks you should weigh before installing: 1) The installer is a download-and-execute shell command (curl | sh). Inspect https://astral.sh/uv/install.sh yourself before running, or install 'uv' from a package manager you trust. 2) The skill is designed to automatically persist user memory and tool-trace data to project/global folders (./.claude/engram and ~/.engram). That can include PII or sensitive conversation content — avoid loading highly sensitive data into it. 3) The README claims the server will auto-pull the latest code from GitHub on client start; consider disabling auto-update or running the server in an isolated environment if you want reproducible behavior. 4) Review the bundled source code locally (you already have it in the skill bundle) to confirm there are no hard-coded external endpoints or unexpected network calls. 5) If you proceed, run initial installs and the web UI in a sandbox or container, back up any data, and do not enable global automatic installs/updates until you trust the upstream. If you want, I can (a) point out where to inspect the uv installer script, (b) search the included source for outbound-network calls or telemetry functions, or (c) suggest a safer install/run checklist.Like a lobster shell, security has layers — review code before you run it.
engramvk97bckakc1cpkzee5jyegbg6ed82451blatestvk97bckakc1cpkzee5jyegbg6ed82451bmcpvk97bckakc1cpkzee5jyegbg6ed82451bmemoryvk97bckakc1cpkzee5jyegbg6ed82451b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsuvx