Hypabase Memory

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: hypabase-memory Version: 0.2.4 The skill bundle provides persistent memory for AI agents using a knowledge graph, which is a legitimate and common functionality. It uses standard tools like `uvx` for execution and SQLite for local data storage. While it offers an optional integration with OpenAI for embeddings, requiring an `OPENAI_API_KEY`, this is explicitly declared, configurable, and serves a stated purpose (semantic search). There is no evidence of credential theft, data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or harmful prompt injection attempts in `SKILL.md`. All capabilities are aligned with the stated purpose and lack indicators of intentional malicious behavior.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may remember information beyond the current conversation and use it in later tasks.

Why it was flagged

The skill intentionally stores information for later recall, so user, team, or project facts may persist and influence future agent context.

Skill content
Persistent memory for agents. Stores preferences, decisions, facts, and events as a connected knowledge graph.
Recommendation

Use this only if you want persistent agent memory; avoid storing secrets, periodically review remembered facts, and use the forget tool or database controls for retention.

What this means

Installing the skill depends on the external package resolved by uvx, which could change over time.

Why it was flagged

The runtime MCP server is fetched and run via uvx from a package name without a version pin in the provided artifacts.

Skill content
"command": "uvx", "args": ["--from", "hypabase", "hypabase-memory"]
Recommendation

Verify the package source and repository, and pin a trusted version if your OpenClaw setup supports it.

What this means

If cloud embeddings are enabled, remembered content may be sent to an external provider for embedding.

Why it was flagged

The skill documents an optional OpenAI embedding provider, which may process memory content externally if configured.

Skill content
HYPABASE_EMBEDDER -- Embedder for semantic search: ... openai -- text-embedding-3-small
Recommendation

Use the local default embedder for private data unless you are comfortable with the external provider’s data handling.