Memory Tools
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The files and runtime instructions are internally consistent with a local, file-based memory plugin: it reads/writes markdown memories, optionally uses a local QMD package for semantic search, and can migrate a legacy SQLite DB — defaults are conservative and no external credentials are requested.
This plugin appears to do what it says: local markdown memories + optional local QMD search and an opt-in migration from a legacy SQLite DB. Before installing: (1) review package.json and the code if you require extra assurance (npm install will fetch dependencies); (2) leave autoMigrateLegacy and autoInjectInstructions disabled unless you want the plugin to read your legacy DB or prepend standing instructions to agent prompts; (3) if you enable QMD be aware it may download large local model files (~GBs) on first use; (4) back up any existing ~/.openclaw/memory/tools/memory.db before enabling migration; (5) running the CLI/build commands happens locally — run them in a controlled environment. Overall the skill is coherent and defaults are conservative.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
66/66 vendors flagged this skill as clean.