Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Memory Maintenance 2.0.0
v2.0.0高性能记忆维护与任务执行器，实现深度分层记忆管理、异步并行优化及理性资源调度与错误处理。
⭐ 0· 52·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, skill.json and the included Python entrypoint align: this is a memory management + task executor that spawns sub-sessions and manages session lifecycle. Declared dependencies (sessions, cron) match the described capabilities.
Instruction Scope
SKILL.md and code provide concrete routines to read arbitrary memory files (MEMORY_DIR, MEMORY.md), selectively extract content (examples explicitly include filter_keywords like 'API key'), cache and persist memory tiers. That means the skill is designed to locate and store sensitive tokens/keys from local files — behavior that goes beyond harmless bookkeeping and could surface secrets to models or other agents.
Install Mechanism
No install spec; code is included as a local subagent script. No remote downloads or installers were specified, so nothing will be fetched from arbitrary URLs at install time.
Credentials
The skill declares no required env vars, which is reasonable, but the memory tier examples explicitly include 'API 密钥' as permanent memory. That implies the skill will accept, store and index secrets from user files without requesting explicit credential configuration. Requesting no explicit credentials but still designed to ingest keys is a proportionality risk: users may unintentionally have secrets persisted and reused.
Persistence & Privilege
always:false (good). The skill runs as a subagent and can autonomously spawn/terminate other sessions (sessions_spawn, process(action='kill',...)). Those are powerful capabilities but consistent with a session manager; combined with the instruction scope concerns this increases potential blast radius if misused.
What to consider before installing
This skill appears to do what its name says, but it is explicitly designed to read, extract and persist content from local memory files — including examples that target 'API 密钥' (API keys). Before installing: 1) Review the full src/execute_task.py to confirm where MEMORY_DIR/MEMORY_PATH are defined and ensure they point to safe locations; 2) Do not allow it access to directories containing secrets (credentials, ~/.aws, .env, private config) unless you intend them to be managed; 3) Consider running it in a sandboxed environment first (non-production account) and test what it reads/records; 4) Disable autonomous invocation or restrict who can invoke it until you trust it; 5) Ask the author for source/homepage and a security rationale for persisting API keys; 6) If you must store secrets, prefer platform-provided secret stores rather than plaintext memory files. If you want, I can list specific lines in the code to inspect or suggest safeguards (e.g., deny-list patterns, encryption-at-rest, and audit logging).Like a lobster shell, security has layers — review code before you run it.
latestvk979t36fkwwec6q30hsp3enyks83z5ta
License
MIT-0
Free to use, modify, and redistribute. No attribution required.