Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AOI Triple Memory (Lite)
v0.1.2AOI Triple Memory (Lite) — file search + decision notes templates (no plugins).
⭐ 0· 798·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description, SKILL.md, and code all align on two features: workspace search and creating decision-note templates. However, the code calls the external 'rg' (ripgrep) binary for search while the registry metadata / requirements claim no required binaries. That is an internal inconsistency (the skill effectively requires 'rg').
Instruction Scope
SKILL.md and the binary behavior match: search runs ripgrep across the workspace and new-note writes a markdown file into ./context. The instructions do not reach outside the workspace or network. Note: search will read all files under the workspace and output matching lines — running this in a repo with secrets could expose sensitive content in the command output.
Install Mechanism
No install spec or remote downloads are present. The package is instruction-only with a local executable (skill.js) and no external dependencies — low install risk.
Credentials
The skill does not request credentials or environment variables, only optionally uses WORKSPACE (or cwd) as the root. This is proportionate, but because it reads files under the workspace and prints matches, users should be aware it can surface sensitive file contents if run in a sensitive directory.
Persistence & Privilege
The skill is not always-enabled and does not modify other skills or system-wide settings. It writes files only under the workspace 'context/' directory (expected for a note-taking tool).
What to consider before installing
This skill is largely what it claims to be (search + note templates), but check a few things before installing/using: 1) The code relies on the 'rg' (ripgrep) binary for searches, but the registry metadata says no binaries are required — ensure 'rg' is installed or searches will fail. 2) The search command reads all files under your workspace and prints matching lines/paths; do not run it in a directory containing secrets or sensitive configs unless you understand the output will include those matched lines. 3) The skill writes new notes into ./context in whatever workspace root is used (WORKSPACE env or current directory) — verify that location is acceptable. 4) No network access or credentials are requested, and there are no remote installs, so risk is limited to local file I/O; if you trust the code (you can review skill.js), it's probably safe to use in non-sensitive projects. If you want higher assurance, ask the author to update metadata to declare the 'rg' requirement or modify code to fallback to a pure-Node search if 'rg' is unavailable.Like a lobster shell, security has layers — review code before you run it.
latestvk977vkf72q8q10zd67yyangtas8166sk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.