ClawHub

Dual memory

v1.0.11

Run memory-core AND external memory providers (like SuperMemory) together in one slot — with full dreaming support. OpenClaw only allows one memory plugin, s...

⭐ 0· 122·0 current·0 all-time
byAlex Dobrin@dobrinalexandru
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (dual local+cloud memory) matches the code and manifest: it proxies memory-core and a SuperMemory backend, merges search results, and writes to both backends. Required/declared credential (SUPERMEMORY_OPENCLAW_API_KEY) is appropriate for the stated cloud integration.
ℹ
Instruction Scope
SKILL.md and the code instruct installing a sibling openclaw-supermemory extension and disabling the individual plugins so the composite holds the memory slot — this is expected. However, default configuration (autoCapture: 'everything') means conversation content may be sent to the cloud provider; that's a privacy/operation impact rather than a coherence issue.
✓
Install Mechanism
No remote download/install URL is used; this is an instruction-only skill that ships source files and a package.json and expects npm install. No extract-from-URL or shorteners present. The plugin expects a sibling extension directory (openclaw-supermemory) which is reasonable but requires manual installation or ClawdHub.
ℹ
Credentials
Only SUPERMEMORY_OPENCLAW_API_KEY is used as the primary credential (and openclaw.plugin.json marks it optional). That is proportionate for a cloud memory integration. Users should note that the plugin's auto-capture/auto-recall features will send conversation content to the cloud if an API key is provided.
✓
Persistence & Privilege
always is false; the plugin does not seek forced-permanent inclusion. It operates by registering a composite memory capability and does not modify other plugins' code or system-wide agent settings beyond normal plugin registration. The requirement to disable the original plugins is a config change, not an automatic privilege escalation.
Assessment
This plugin appears to do what it says: it combines local memory-core (with dreaming) and a SuperMemory cloud backend via proxying. Before installing: (1) Review and trust the SuperMemory provider — the plugin will send captured conversation content to that service if you supply an API key and enable autoCapture. (2) Consider setting autoCapture to a restrictive mode or turning it off for sensitive usage. (3) Use an API key with limited scope where possible, and verify the sibling openclaw-supermemory extension code (the SupermemoryClient implementation) because the cloud client lives there. (4) Expect to disable the standalone memory-core and openclaw-supermemory plugins per the README; test in a non-sensitive environment first. If you want stronger assurance, provide the openclaw-supermemory client code for review (network calls and upload behavior are implemented there).

Like a lobster shell, security has layers — review code before you run it.

latestvk979j7ap4jhemxtyhrvwha1jdd84frj0

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Primary envSUPERMEMORY_OPENCLAW_API_KEY

Comments