Memory System V2 1.0.0
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is a coherent local memory tool, but it will persist captured information across sessions and should be used with clear memory boundaries.
Install this if you want a local persistent memory system for your agent. Before enabling any auto-capture workflow, decide what kinds of information may be stored, avoid secrets and private data, and periodically inspect or clean $HOME/clawd/memory.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Memories may contain personal, work, preference, or decision history and can influence future agent answers when recalled.
Captured content is written to persistent Markdown logs and a JSON index under the user's home directory.
MEMORY_DIR="$HOME/clawd/memory" ... echo "$content" >> "$daily_file" ... '.memories += [$entry]'
Use clear rules for what may be captured, avoid storing secrets or highly sensitive details, and periodically review or delete the memory directory.
Publisher identity is slightly ambiguous, so users should not rely on metadata alone to establish provenance.
The packaged _meta.json owner ID differs from the registry owner ID shown in the supplied metadata, which is a provenance inconsistency even though the included runtime code is visible.
"ownerId": "kn78s2gvpy22gb3axem6qfkgjn80aavs"
Verify the ClawHub listing, homepage repository, and publisher identity before installing in sensitive environments.
A user could overestimate the level of external review or safety assurance.
The documentation contains strong self-approval language; it should be treated as a project claim, not as independent security validation.
Recommendation: DEPLOY TO PRODUCTION NOW ✅ ... Status: ✅ APPROVED FOR PRODUCTION
Treat the approval wording as documentation/marketing and base trust on the actual artifacts and your own deployment requirements.