ClawHub

Membox Cloud Sync

v0.1.12

Private zero-knowledge encrypted cross-device memory sync, backup, and recovery for OpenClaw. Helps agents install Membox, pair devices, securely sync `MEMOR...

⭐ 1· 214·0 current·0 all-time
byTingrui Zhang@pupillen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the instructions: the SKILL.md consistently describes installing the Membox plugin, pairing devices, using membox_* tools, and interacting with membox.cloud APIs. There are no unrelated environment variables, binaries, or config paths requested.
✓
Instruction Scope
Runtime instructions stay within the stated scope: they direct the agent to install/use the Membox plugin or use the documented HTTP endpoints, handle local passphrase/recovery files, and explicitly forbid sending secrets into chat. The skill does not instruct the agent to read arbitrary system files or exfiltrate data to unexpected endpoints.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is downloaded or written by the skill itself. The install steps it recommends (npm plugin and ClawHub skill install) are expected for the functionality described.
✓
Credentials
No environment variables, credentials, or config paths are declared. Authentication and tokens are handled via the plugin/device-flow and local files as documented, which is proportionate to the sync/restore purpose.
✓
Persistence & Privilege
The skill is not always-enabled (always: false). agents/openai.yaml sets allow_implicit_invocation: true (enables implicit invocation when relevant), and model invocation is allowed (the platform default). These are normal for a user-invocable skill and are not excessive by themselves.
Assessment
This skill appears internally consistent, but before installing: 1) Verify the plugin package source (@membox-cloud/membox on npm) and the ClawHub skill identity to ensure you get the official package. 2) Prefer to run the openclaw/plugins install commands manually (or review what they will install) rather than allowing an agent to install automatically. 3) Follow the SKILL.md rules: never paste passphrases, recovery codes, or decrypted bundles into chat; store them in local private files (e.g., .membox-secrets) with strict permissions. 4) Confirm the default API base (https://membox.cloud/api/v1) matches your expectations or change it for self-hosting. 5) If you want stronger isolation, perform plugin install and initial pairing in a separate VM or sandbox and inspect the plugin code/tarball from npm before trusting it.

Like a lobster shell, security has layers — review code before you run it.

backupvk97bhkkvwcscbh52mq9tjsd07x82r2q3cross-devicevk97bhkkvwcscbh52mq9tjsd07x82r2q3encryptionvk97bhkkvwcscbh52mq9tjsd07x82r2q3latestvk97bhkkvwcscbh52mq9tjsd07x82r2q3memboxvk97bhkkvwcscbh52mq9tjsd07x82r2q3memoryvk97bhkkvwcscbh52mq9tjsd07x82r2q3openclawvk97bhkkvwcscbh52mq9tjsd07x82r2q3privacyvk97bhkkvwcscbh52mq9tjsd07x82r2q3recoveryvk97bhkkvwcscbh52mq9tjsd07x82r2q3syncvk97bhkkvwcscbh52mq9tjsd07x82r2q3zero-knowledgevk97bhkkvwcscbh52mq9tjsd07x82r2q3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments