memory-attention-router

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a coherent local long-term-memory router, but it runs a Python helper and stores reusable memories that can influence future agent work.

Install this if you want local long-term memory for OpenClaw. Before enabling it, choose a safe MAR_DB_PATH, avoid storing secrets or credentials as memories, and periodically inspect or refresh stored entries so stale or incorrect memories do not affect future tasks.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Incorrect, stale, or sensitive stored memories could be reused in future tasks and shape the agent's decisions or responses.

Why it was flagged

The skill persistently stores reusable memories and routed packets, which can contain task details, preferences, tool outcomes, or summaries that later influence agent behavior.

Skill content
CREATE TABLE IF NOT EXISTS memories (... summary TEXT NOT NULL, details_json TEXT NOT NULL ...); CREATE TABLE IF NOT EXISTS working_memory_packets (... goal TEXT NOT NULL, packet_json TEXT NOT NULL ...)
Recommendation

Use a database path you control, avoid storing secrets, and use the list, inspect, and refresh flows to review or retire stale memory.

What this means

Installing the skill means allowing a local helper script to create and update the memory database during use.

Why it was flagged

The skill instructs the agent to run a local Python helper for routing, adding, reflecting, refreshing, listing, and inspecting memory. This is disclosed and central to the skill's purpose.

Skill content
`python3 {baseDir}/scripts/memory_router.py route --input-json '<JSON>'`
Recommendation

Review the included helper before use and ensure the database path is appropriate for your workspace.

What this means

Users have less provenance context for the helper code and may not realize a Python runtime is needed.

Why it was flagged

The registry metadata lacks source/homepage provenance and does not declare python3 even though the skill documentation invokes the included Python script.

Skill content
Source: unknown; Homepage: none; Required binaries: none; Code file presence: scripts/memory_router.py
Recommendation

Treat the local script as part of the trusted computing base and verify its source before enabling the skill.