Openclaw Semantic Memory

Local semantic memory with vector search and Transformers.js. Store, search, and recall conversation context using embeddings (fully local, no API keys).

Security Scan

The skill's code, instructions, and configuration are consistent with a local semantic-memory plugin: it requires Node/npm, downloads a local embedding model, optionally persists to ~/.openclaw-memory/, and optionally sends data to a configured Qdrant server — nothing in the package requests unrelated credentials or surprising system access.

Purpose & Capability

The name/description (local semantic memory with Transformers.js and optional Qdrant) matches the code and manifest. Required binaries (node, npm), dependencies (@xenova/transformers, @qdrant/js-client-rest) and configuration options (qdrantUrl, persistToDisk, storagePath, autoCapture) are all appropriate and expected for this functionality.

Instruction Scope

SKILL.md describes installing, downloading a ~25MB model from Hugging Face, persisting memories to ~/.openclaw-memory/, and optional auto-capture that is disabled by default. The runtime instructions and code reference only local disk paths, the optional Qdrant URL, and the Transformers.js pipeline — they do not instruct the agent to read unrelated system files, environment secrets, or post data to unexpected endpoints. The autoCapture feature can capture user text if enabled; the skill warns about PII and provides opt-in controls.

Install Mechanism

The registry entry includes no automated install spec (instruction-only), which limits automatic disk writes. The project does include package.json and package-lock; following the README or manual install will pull dependencies from npm (including native modules such as sharp and onnxruntime). That is normal for an ML plugin but increases install-time surface (network downloads and native build requirements). No opaque or shortener URLs or extract-from-arbitrary-URL installs were found.

Credentials

The skill declares no required environment variables or primary credential. The only external connection is an optional qdrantUrl configuration (user-provided) and downloading the embedding model from Hugging Face (no API key required). There are no requests for unrelated secrets or multiple unrelated credentials.

Persistence & Privilege

The skill does persist data by default to a user-owned directory (~/.openclaw-memory/) which is appropriate for a memory plugin. always: false and standard autonomous invocation are set. The plugin does not request system-wide privileges or modify other skills' configs. AutoCapture is opt-in and PII capture requires a separate opt-in flag.

Assessment

This plugin appears internally consistent with its stated purpose. Before installing: 1) Be aware it will by default store memories under your home directory (~/.openclaw-memory/); disable persistToDisk if you want volatile memory. 2) The first run downloads a ~25MB model from huggingface.co and npm install will fetch and may build native modules (sharp, onnxruntime) — ensure you have build tools or prefer running in an isolated/test environment. 3) Do not enable autoCapture or allowPIICapture in shared or production environments unless you understand the privacy implications. 4) If you plan to use an external Qdrant server, only configure a trusted endpoint. 5) If concerned, review index.js and package-lock.json locally and install with npm ci to lock dependency versions.

semantic-memory

Use when you need your OpenClaw agent to remember and recall information across conversations using semantic search.

⚠️ Privacy Notice: The optional autoCapture feature (disabled by default) can capture PII like emails and phone numbers if you enable allowPIICapture. Only enable if you understand the privacy implications.

Local semantic memory plugin powered by vector search and Transformers.js embeddings. Zero configuration, fully local, no API keys required.

Features

• Semantic search with local Transformers.js embeddings
• In-memory mode (zero config) or persistent Qdrant storage
• Optional auto-capture of conversation context (opt-in, disabled by default)
• Context-aware memory recall
• Fully local, no API keys or external services required

Installation

clawhub install semantic-memory

First-time setup: This plugin downloads a 25MB embedding model from Hugging Face on first run and may require build tools for native dependencies (sharp, onnxruntime). See README for detailed installation requirements.

Configuration

Enable in your OpenClaw config:

{
  "plugins": {
    "semantic-memory": {
      "enabled": true
    }
  }
}

Options:

• persistToDisk (default: true) - Save memories to disk in memory mode. Data stored in ~/.openclaw-memory/ survives restarts. Set to false for volatile memory.
• storagePath (optional) - Custom storage directory. Leave empty for default ~/.openclaw-memory/.
• autoCapture (default: false) - Auto-record conversations. Privacy protection enabled by default: text containing PII (emails, phone numbers) is automatically skipped.
• allowPIICapture (default: false) - Allow capturing PII when autoCapture is enabled. Only enable if you understand the privacy implications.
• autoRecall (default: true) - Auto-inject relevant memories
• qdrantUrl (optional) - External Qdrant server (leave empty for in-memory)

Usage

Three tools available:

memory_store - Save information

memory_store({
  text: "User prefers Opus for complex tasks",
  category: "preference"
})

memory_search - Find relevant memories

memory_search({
  query: "workflow preferences",
  limit: 5
})

memory_forget - Delete memories

memory_forget({ memoryId: "uuid" })
// or
memory_forget({ query: "text to forget" })

Privacy & Security

• Disk persistence (default): Memories saved to ~/.openclaw-memory/ and survive restarts. Set persistToDisk: false for volatile memory.
• In-memory mode: When persistToDisk: false, data cleared on restart
• Qdrant mode: Data sent to configured server (use trusted servers only)
• Network: Downloads ~25MB model from Hugging Face on first run
• PII Protection: By default, autoCapture skips text containing emails or phone numbers. Set allowPIICapture: true only if you understand the privacy implications.
• autoCapture: Disabled by default for privacy. When enabled, only captures text matching semantic triggers (preferences, decisions, facts) and skips PII unless explicitly allowed.

Technical Details

• Vector DB: Qdrant (in-memory or external)
• Embeddings: Xenova/all-MiniLM-L6-v2 (local)
• Module: ES6 with factory function pattern

Links

• GitHub: https://github.com/zuiho-kai/openclaw-semantic-memory
• Issues: https://github.com/zuiho-kai/openclaw-semantic-memory/issues