Hypabase Memory

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may remember information beyond the current conversation and use it in later tasks.

Why it was flagged

The skill intentionally stores information for later recall, so user, team, or project facts may persist and influence future agent context.

Skill content
Persistent memory for agents. Stores preferences, decisions, facts, and events as a connected knowledge graph.
Recommendation

Use this only if you want persistent agent memory; avoid storing secrets, periodically review remembered facts, and use the forget tool or database controls for retention.

What this means

Installing the skill depends on the external package resolved by uvx, which could change over time.

Why it was flagged

The runtime MCP server is fetched and run via uvx from a package name without a version pin in the provided artifacts.

Skill content
"command": "uvx", "args": ["--from", "hypabase", "hypabase-memory"]
Recommendation

Verify the package source and repository, and pin a trusted version if your OpenClaw setup supports it.

What this means

If cloud embeddings are enabled, remembered content may be sent to an external provider for embedding.

Why it was flagged

The skill documents an optional OpenAI embedding provider, which may process memory content externally if configured.

Skill content
HYPABASE_EMBEDDER -- Embedder for semantic search: ... openai -- text-embedding-3-small
Recommendation

Use the local default embedder for private data unless you are comfortable with the external provider’s data handling.