MemOS Cloud Integration
v1.0.0Recall memories from MemOS Cloud before responding. Use this skill when you need context about user's previous conversations, preferences, or decisions.
⭐ 0· 339·1 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill says it will recall memories from MemOS Cloud and instructs calling a Node script at ~/.claude/plugins/memos-cloud/memos-api.js. However the registry lists no required binaries (Node) and no required environment variables, while the README documents MEMOS_API_KEY, MEMOS_USER_ID, and MEMOS_BASE_URL. The declared requirements do not align with what the README and SKILL.md imply is needed.
Instruction Scope
SKILL.md tells the agent to run a local script (node ~/.claude/plugins/memos-cloud/memos-api.js search "{user_query}"). The package actually contains only SKILL.md and README; the referenced memos-api.js is not present in the published files. The instructions are silent about what data is sent to the remote service and do not declare the API key usage they imply. Running a local script by path can execute arbitrary code if that file exists, and the skill gives no explicit constraints on what is transmitted to MemOS endpoints.
Install Mechanism
This is instruction-only (no install spec), which minimizes installer risk. However the README documents an installation/configuration flow that writes ~/.claude/.env and expects memos-api.js to be placed under ~/.claude/plugins/memos-cloud/. That manual install behavior is not reflected in the registry metadata — a mismatch to be aware of.
Credentials
Registry metadata declares no required env vars or primary credential, but README explicitly instructs creating MEMOS_API_KEY, MEMOS_USER_ID, and MEMOS_BASE_URL in ~/.claude/.env. This is a substantive inconsistency: the skill will likely need secrets (an API key) to contact MemOS Cloud, but the published requirements do not declare them.
Persistence & Privilege
The skill is not marked always:true and is user-invocable only; it does not request persistent platform privileges in the registry metadata. There is no evidence it modifies other skills or global agent settings.
What to consider before installing
The skill appears to intend contacting MemOS Cloud via a local Node script and an API key, but the registry metadata does not declare Node or any environment variables — that's an inconsistency. Before installing or allowing the agent to invoke this skill: (1) ask the publisher to clarify and publish the required env vars (MEMOS_API_KEY, MEMOS_BASE_URL, etc.) and why they are needed; (2) verify the presence and content of ~/.claude/plugins/memos-cloud/memos-api.js and inspect it for what it sends/receives; (3) only provide an API key with minimal scope and consider using a throwaway/test key first; (4) if you cannot inspect the script, run the skill in a constrained sandbox or deny it access to secrets; (5) prefer a version that declares its requirements in the registry metadata so you can make an informed decision.Like a lobster shell, security has layers — review code before you run it.
claude-codevk97f3gd3atvrmmfgpb6t3w7arx82ck19cloudvk97f3gd3atvrmmfgpb6t3w7arx82ck19latestvk97f3gd3atvrmmfgpb6t3w7arx82ck19memoryvk97f3gd3atvrmmfgpb6t3w7arx82ck19memosvk97f3gd3atvrmmfgpb6t3w7arx82ck19
License
MIT-0
Free to use, modify, and redistribute. No attribution required.