Memory Sync Enhanced

PassAudited by ClawScan on May 10, 2026.

Overview

This local memory helper looks purpose-aligned, but it stores persistent memory relationships and its docs reference helper scripts that are not included.

This appears safe to install as a local memory/co-occurrence tracker, but check what it stores before using it with private notes. Review or delete ~/.config/cortexgraph/co_occurrence.db when needed, avoid putting secrets into memory files, and do not run separately obtained sync/search/GC helper scripts unless you inspect them first.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI06: Memory and Context Poisoning

What this means

Personal notes, memory IDs, and relationships may remain on disk and be reused later; stale or incorrect associations could affect future answers.

Why it was flagged

The skill explicitly describes permanent long-term memory and a SQLite graph of relationships between memories. This is core to the skill, but it means retained context and associations can persist and influence future retrieval.

Skill content

### LTM (长期记忆)
- Obsidian Markdown
- 永久存储
...
### Co-occurrence Graph
- SQLite 边表
- 记录记忆之间的关联

Recommendation

Use deliberate memory files, avoid storing secrets, and periodically review or delete the local memory database and long-term notes.

Low

#ASI06: Memory and Context Poisoning

What this means

A direct test run may add dummy memory associations to the user's real local co-occurrence database.

Why it was flagged

Running the script directly writes demo co-occurrence entries into the default persistent database. This is local and visible in the script, but it can pollute memory state with test entries.

Skill content

if __name__ == "__main__":
    tracker = CoOccurrenceTracker()
    ...
    test_memories = ["mem_001", "mem_002", "mem_003"]
    ...
    tracker.record_co_occurrence(test_memories)

Recommendation

Run demos against a temporary database or change the script to require an explicit demo flag before writing test records.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The documented commands may fail as supplied, or a user might later obtain unreviewed helper scripts with additional file access or deletion behavior.

Why it was flagged

The documentation references several helper shell scripts, but the supplied file manifest only includes scripts/co_occurrence_tracker.py under scripts. Those workflows are therefore absent or unreviewed in the provided artifacts.

Skill content

./scripts/sync-memory.sh
./scripts/sync-daily.sh 2026-02-19
./scripts/search-enhanced.sh "量化交易"
./scripts/gc.sh --threshold 0.1

Recommendation

Only run helper scripts that are included in the package or that you have inspected separately; treat the missing commands as documentation gaps.