Vanar Neutron Memory

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill coherently implements a disclosed persistent memory service, but users should understand it can send saved or auto-captured conversation content to a remote API and later inject recalled memories into context.

This skill appears coherent and purpose-aligned. Before installing, decide whether you are comfortable sending selected memories, search queries, and optionally full conversation turns to the Vanar Neutron API. Keep the API key secure, and only enable auto-capture or auto-recall when you want persistent memory behavior.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If enabled or used, conversation details may be stored remotely and later shown to the agent as context.

Why it was flagged

The skill intentionally stores conversation content and reuses recalled memories in future context. This is purpose-aligned, but persistent memory can contain sensitive information or stale/untrusted content that may influence later sessions.

Skill content
**Auto-Capture** saves conversations after each AI turn
**Auto-Recall** finds relevant memories before each AI turn and injects them as context
Recommendation

Only save content you are comfortable storing in the Neutron service, enable auto-capture only when desired, and periodically review or manage stored memories through the provider if available.

What this means

Anyone with this API key may be able to access or use the associated Neutron memory account within the provider's permissions.

Why it was flagged

The script reads a Neutron API key from environment variables or a scoped credentials file and sends it as bearer authentication to the configured API endpoint. This is expected for the service, but it is still credential use.

Skill content
API_KEY="${API_KEY:-${NEUTRON_API_KEY:-}}" ... API_KEY=$(jq -r '.api_key // empty' "$CONFIG_FILE" 2>/dev/null) ... -H "Authorization: Bearer ${API_KEY}"
Recommendation

Keep the API key private, avoid committing credentials files, and rotate the key if it may have been exposed.