memo-bridge

This skill should be used when the user wants to export, import, backup, migrate, or transfer AI memory/context between different AI tools. It handles memory...

Security Scan

The skill's instructions promise a Node CLI that reads/writes many local tool files, but the package contains no code or install spec — this mismatch and the file-access behavior merit caution.

Purpose & Capability

The SKILL.md repeatedly references a Node.js CLI (node dist/cli.js), Node >= 22, and direct file reads/writes for many tools (e.g., ~/.openclaw/workspace, ~/.hermes/memories, CLAUDE.md). However the skill bundle contains no code files and no install specification. That means the declared capability (a CLI that can scan and modify local AI memory files) is not actually provided by this package — an incoherence that could indicate an incomplete upload, developer error, or misdirection.

Instruction Scope

The runtime instructions direct scanning arbitrary directories (--scan-dir), reading/writing specific per-tool files (appending to MEMORY.md, trimming Hermes payloads, reading .codebuddy/.memory), and generating prompts for cloud tools. Those actions are consistent with a memory-migration tool, but because no executable is included, it's unclear how the actions are meant to be performed. The instructions also encourage registering third-party adapters (runtime code) via a public registry API — this permits executing arbitrary adapter code that can read/modify any paths the adapter author chooses. The SKILL.md grants broad discretion (scan, extract, import, overwrite) which could access sensitive local files and tool tokens.

Install Mechanism

No install specification and no code files are present, yet the documentation requires Node.js and a project-root CLI (node dist/cli.js). This is inconsistent: a user following these instructions will have nothing to install or run from the skill package itself. Legitimate CLI-based skills should include an install step or the binary/source; its absence is a serious red flag.

Credentials

The skill declares no required environment variables or credentials, which superficially seems least-privileged. But its described operations involve reading many local tool data locations that often contain user secrets or API tokens. Because the skill encourages direct file reads/writes and third-party adapters, those actions could access credentials even though none are declared. The lack of declared envs combined with implicit file access makes the required privileges unclear and disproportionate to what is actually present in the package.

Persistence & Privilege

The skill does not set always:true and does not declare system-wide config modifications. That is appropriate. However it instructs registering runtime adapters and performing file writes/overwrites — if the agent is allowed to autonomously invoke this skill, that increases the blast radius. Autonomous invocation alone isn't a disqualifier, but combined with the other inconsistencies it is worth noting.

What to consider before installing

Do not install or run this skill as-is. The SKILL.md describes a Node CLI and direct file access but the package contains no code or install steps — ask the publisher for the source/installation artifacts and a clear provenance. Before installing: (1) obtain and inspect the CLI source or a signed release; (2) confirm exactly which files/paths the tool will read/write and whether it will transmit data externally; (3) avoid registering third‑party adapters or running adapters from untrusted registries; (4) prefer running any migration tool in an isolated environment (local VM or container) and run with dry-run first; (5) if you must proceed, review the code for exfiltration (network calls, uploads) and ensure you keep backups of any files the tool will modify.

MemoBridge — AI Memory Migration Skill

Purpose

MemoBridge extracts, standardizes, and migrates AI memories across tools and workspaces. AI assistants accumulate valuable context over time — user preferences, project history, knowledge progress, vocabulary lists, daily routines. This skill ensures none of that is lost when switching tools or machines.

When to Use

• User wants to switch AI coding tools (CodeBuddy → Claude Code → Cursor → OpenClaw → Hermes)
• User wants to export or backup their AI memory
• User wants to onboard a new AI assistant with existing context
• User wants to share AI context with a teammate
• User is setting up a new machine or workspace
• User mentions "记忆迁移", "导出记忆", "memory export/import/migrate"

Prerequisites

Node.js >= 22.0.0 must be installed. The MemoBridge CLI is available at the project root.

Supported Tools (8 total)

Tool	Extract	Import	Method
CodeBuddy	✅	✅	Direct file read (.codebuddy/ + .memory/)
OpenClaw	✅	✅	Direct file read (~/.openclaw/workspace/)
Hermes Agent	✅	✅	Direct file read (~/.hermes/memories/)
Claude Code	✅	✅	Direct file read (CLAUDE.md + ~/.claude/)
Cursor	✅	✅	Direct file read (.cursorrules + ~/.cursor/)
ChatGPT	✅ (prompt)	✅	Prompt-guided export, instruction-based import
Doubao / 豆包	✅ (prompt)	✅	Prompt-guided export, instruction-based import
Kimi	✅ (prompt)	✅	Prompt-guided export, context injection import

Core Workflow

Step 1: Detect installed tools

Run the detect command to discover all AI tools on the system:

cd {project_root}
node dist/cli.js detect

This scans for local tools (CodeBuddy/OpenClaw/Hermes/Claude Code/Cursor) and lists cloud tools (ChatGPT/Doubao/Kimi) that require prompt-guided export.

Step 2: Extract memories

For local tools (direct file access):

# CodeBuddy — auto-scans all workspaces
node dist/cli.js extract --from codebuddy -o ./memo-bridge.md

# CodeBuddy — specific workspace
node dist/cli.js extract --from codebuddy --workspace /path/to/project -o ./memo-bridge.md

# OpenClaw
node dist/cli.js extract --from openclaw -o ./memo-bridge.md

# Hermes Agent
node dist/cli.js extract --from hermes -o ./memo-bridge.md

# Claude Code
node dist/cli.js extract --from claude-code -o ./memo-bridge.md

# Cursor (with workspace for project rules)
node dist/cli.js extract --from cursor --workspace /path/to/project -o ./memo-bridge.md

For cloud tools (prompt-guided), generate the optimal export prompt:

node dist/cli.js prompt --for doubao
node dist/cli.js prompt --for kimi
node dist/cli.js prompt --for chatgpt

Then instruct the user to: copy the prompt → paste into the AI tool's chat → copy the AI's response → save as a file.

Step 3: Import memories

For file-based tools:

# To Claude Code (appends to CLAUDE.md)
node dist/cli.js import --to claude-code --input ./memo-bridge.md

# To Hermes Agent (auto-trims to 2200 UTF-8 bytes)
node dist/cli.js import --to hermes --input ./memo-bridge.md

# To OpenClaw (appends to MEMORY.md)
node dist/cli.js import --to openclaw --input ./memo-bridge.md

# To Cursor (requires --workspace)
node dist/cli.js import --to cursor --input ./memo-bridge.md --workspace /path/to/project

# To CodeBuddy
node dist/cli.js import --to codebuddy --input ./memo-bridge.md --workspace /path/to/project

For instruction-based tools:

# Generates text for user to paste into ChatGPT/Doubao/Kimi
node dist/cli.js import --to doubao --input ./memo-bridge.md
node dist/cli.js import --to chatgpt --input ./memo-bridge.md
node dist/cli.js import --to kimi --input ./memo-bridge.md

Step 4: One-step migration (shortcut)

node dist/cli.js migrate --from codebuddy --to claude-code
node dist/cli.js migrate --from openclaw --to hermes

Key Options

Option	Description
--workspace <path>	Specify a single workspace path
--scan-dir <path>	Specify root directory for auto-discovery
--output <path>	Output file path (default: ./memo-bridge.md)
--input <path>	Input file path
--dry-run	Preview mode, no actual writes
--overwrite	Overwrite existing files instead of appending
--verbose	Detailed output

Extending with Custom Adapters

Third-party adapters can be registered at runtime via the public registry API — useful when a user has a proprietary or yet-unsupported tool:

import { extractorRegistry, importerRegistry, BaseExtractor } from 'memo-bridge';

class MyToolExtractor extends BaseExtractor {
  readonly toolId = 'my-tool' as any;
  async extract() { /* ... */ }
}

extractorRegistry.register('my-tool' as any, () => new MyToolExtractor());

See references/adapter-guide.md for the full three-step adapter recipe.

Intermediate Format

The standard interchange format is memo-bridge.md — Markdown with YAML front matter. See references/format-spec.md for the complete specification.

Key properties:

• Human-readable (any text editor)
• LLM-friendly (can be used directly as CLAUDE.md)
• Git-friendly (plain text, version-trackable)
• Tool-namespaced extensions section preserves tool-specific data (Hermes skills, OpenClaw SOUL/DREAMS, …) across migrations without polluting the common memory lists.

Security Features

• Privacy sanitization: Automatically redacts 18 types of sensitive information (API keys, passwords, tokens, SSH keys, emails, private IPs, Authorization headers, custom API headers like X-API-Key, database connection strings with embedded credentials).
• Path validation: Prevents path traversal and symlink attacks; case-insensitive on Windows so c:\program files can't bypass the denylist.
• Content size limits: 5MB write limit, 10MB read limit enforced on every extractor file read (no more unbounded reads).
• System directory protection: Blocks writes to /etc, /bin, /usr, etc. — except OS-managed temp subtrees (/var/folders/, /var/tmp/, /private/tmp/).
• Strict tool-id validation: CLI --from / --to / --for args are validated against the registered tool list before dispatch.

Error Handling

• If no workspaces found: suggest --workspace or --scan-dir flags
• If tool not detected: suggest installing the tool or using prompt-guided export
• If import fails due to permissions: suggest checking file permissions or using --dry-run first
• If Hermes import exceeds limit: content is automatically prioritized and trimmed

Building from Source

To build the CLI before first use:

cd {project_root}
npm install
npm run build

The project has 395 unit tests and a GitHub Actions CI that runs lint → test → build on every push. To verify the local install:

npm test    # ~500ms