Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ultra Memory
v3.1.0ultra-memory 是多模型 AI 的超长会话记忆系统。 【必须触发-中文】用户说以下任意词：记住、别忘了、记录一下、不要忘记、上次我们做了什么、帮我回忆、继续上次的、从上次继续、记忆、帮我记、追踪进度 【必须触发-英文】用户说以下任意词：remember、don't forget、recall、what...
⭐ 0· 19·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, SKILL.md and provided scripts (init, log, recall, summarize, restore, profile, entities, etc.) align with a long-term memory system. Filesystem storage under ~/.ultra-memory, session management and entity/knowledge stores are expected for this purpose. It requests no unrelated credentials or env vars.
Instruction Scope
SKILL.md and SYSTEM_PROMPT direct the agent to auto-initialize sessions, log after nearly every significant action (file reads/writes, shell commands, tool calls, user messages), and to show script outputs raw to users. Hooks (clawbot_hook, hooks.yaml examples) and the System Prompt recommend automatically appending assistant/user messages and command details to ops.jsonl and knowledge files. That behavior can capture secrets (commands with embedded keys, file contents, tokens) unless filters are correctly configured; the instructions rely on user/administrator to configure sensitive_patterns and skip_paths but do not make those protections mandatory.
Install Mechanism
Registry metadata lists no install spec but the bundle contains package.json and node/python entry points (mcp-server.js, platform/server.py). No remote downloads from untrusted URLs are present in the provided files. However the absence of an explicit install spec in the registry vs. presence of npm packaging is an inconsistency to be aware of (manual installation / npx npm install is suggested).
Credentials
The skill declares no required env vars or credentials; it uses a local ULTRA_MEMORY_HOME path (configurable via env). Advanced docs mention optional shared/S3 backends and team modes that would need credentials if enabled, but those are optional and not required by default.
Persistence & Privilege
The skill is not always-enabled by default. It offers an HTTP REST server and an MCP/Node mode which, if started with host 0.0.0.0 or integrated into OpenClaw/claude config, can increase its runtime presence and attack surface. It also provides hook examples that auto-log conversation turns — these produce persistent on-disk data. None of this is automatically installed, but it requires operator caution when enabling network modes or automatic hooks.
What to consider before installing
This skill appears to do what it claims (a persistent multi-layer memory for agents), but it encourages automatic logging of many types of data (user messages, assistant replies, file paths, command strings, details) which can capture secrets or sensitive information if not configured correctly. Before installing or enabling:
- Review the scripts (init.py, log_op.py, recall.py, restore.py, mcp-server.js, platform/server.py, clawbot_hook.py) to confirm what gets read/written and when.
- Run the REST/MCP server only on localhost (127.0.0.1) unless you add authentication; avoid starting with --host 0.0.0.0.
- Set ULTRA_MEMORY_HOME to a controlled path and restrict permissions (chmod 700 ~/.ultra-memory).
- Configure sensitive_patterns and skip_paths in config.json to redact or skip any application-specific secrets (API keys, token patterns, ~/.ssh, /etc, etc.). Do not rely solely on the 'Do NOT log secrets' guidance — implement explicit filters.
- If you plan to enable team/shared modes (S3, NAS), review the sharing/authentication setup and only provide credentials after auditing code that performs syncs.
- Avoid enabling automatic hooks (clawbot hooks, automatic post_turn logging) until you’re confident about what will be logged. Prefer manual or audited logging calls.
- Consider running the skill in an isolated environment (container or dedicated user account) first, and test what gets written to ops.jsonl/knowledge_base before using on sensitive projects.
If you want, I can: list exact places in the code where user messages, file contents or command lines are written to disk (file names and functions), or suggest concrete config edits (regex patterns and skip_paths) to reduce leak risk.scripts/mcp-server.js:31
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk979vff72e4z0jb6xccbv23gws84d60r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.