Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
马斯克精英记忆
v1.0.0终极AI智能体记忆系统。WAL协议 + 向量搜索 + git-notes + 云备份。6层记忆架构：热RAM(SESSION-STATE)、温存储(LanceDB向量)、冷存储(Git-Notes知识图)、精选档案(MEMORY.md)、云备份(SuperMemory)、自动提取(Mem0)。
⭐ 0· 56·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description, README, and bin/elite-memory.js are coherent: the skill creates SESSION-STATE.md, MEMORY.md, and a memory/ directory and provides CLI helpers for initializing and checking status. However, SKILL.md and README also discuss integrations (LanceDB, Git-Notes, SuperMemory, Mem0, OpenAI provider) that require additional tooling and credentials which are not declared in the skill's formal requirements. This omission is a design inconsistency (not necessarily malicious) but reduces transparency.
Instruction Scope
SKILL.md instructs the agent to enforce a write-ahead-log behavior (write to SESSION-STATE.md before responding) which forces persistent writes of conversational context. It also shows commands that read/write local config paths (~/.openclaw/memory/lancedb), run python3 memory.py with a $DIR, clear vectors with 'rm -rf ~/.openclaw/memory/lancedb', export memories to JSON, and suggests adding files to agent context. Those instructions can cause persistent storage of potentially sensitive conversation data and include a destructive maintenance command (rm -rf) that could delete local vector stores. The instructions also reference environment variables and external services (SUPERMEMORY_API_KEY, MEM0_API_KEY, OpenAI key) that are not declared in the registry metadata.
Install Mechanism
There is no install spec in the registry; this is an instruction-only skill with a small CLI script. The included package.json names an optional dependency 'mem0ai', but no automated download from untrusted URLs or archive extraction is present. The install footprint is minimal and visible in repository files.
Credentials
The registry lists no required environment variables, yet SKILL.md/README reference SUPERMEMORY_API_KEY, MEM0_API_KEY, and an OpenAI key (for memory_search). package.json lists mem0ai as an optionalDependency. Requesting cloud API keys and suggesting cloud backups without declaring them is disproportionate and reduces clarity about what secrets would be needed and when data could be transmitted off-device.
Persistence & Privilege
The skill does not request always:true and does not autonomously alter other skills. It creates persistent files in the current workspace (SESSION-STATE.md, MEMORY.md, memory/) and suggests optional cloud backup; persistent storage is expected for a memory system. The combination of forced write-ahead logging plus optional cloud sync means enabling the feature will persist conversational state locally and potentially send it externally if the user enables backups — the skill itself does not escalate privileges but its behavior can increase data persistence and exposure.
What to consider before installing
This skill appears to be a legitimate local memory helper that writes persistent files and offers optional cloud integrations, but there are several mismatches you should consider before installing:
- Secrets & cloud services: SKILL.md and README reference SUPERMEMORY_API_KEY, MEM0_API_KEY, and an OpenAI key, but the registry metadata declares no required env vars. If you enable SuperMemory, Mem0, or OpenAI integrations you will supply API keys that could allow memory data to be sent to external services. Only enable cloud backups if you trust those services and are comfortable that your saved memories may be transmitted.
- Persistent storage: The skill enforces a write-ahead rule (write to SESSION-STATE.md before responding). That means conversational context (including sensitive details) may be written to files in your workspace. Review and control what you store there; do not let the agent write secrets (passwords, keys, PII) into these files.
- Destructive maintenance command: The README/ SKILL.md show a command to clear vectors: rm -rf ~/.openclaw/memory/lancedb. That will delete local data; back up before running, and avoid running such commands unless you understand the consequences.
- Metadata inconsistencies: The skill's registry metadata lists no env requirements and an unknown source/homepage, while package.json points to a GitHub repo and _meta.json shows a different ownerId. Treat source provenance as uncertain; prefer packages with a verifiable repository and author identity.
- Safe testing recommendations: Run npx elite-longterm-memory init in an isolated test directory (not your real workspace), inspect the created files, and verify behavior. If you plan to enable cloud integrations, do so in a controlled environment and review what data is exported (use minimal/test accounts/keys). Consider auditing any optional library (mem0ai) before installing and do not add secrets into MEMORY.md or SESSION-STATE.md.
If you want, I can list the exact lines where undeclared env vars and the rm -rf appear, or produce a checklist to safely evaluate and sandbox this skill before enabling cloud backups.Like a lobster shell, security has layers — review code before you run it.
latestvk970p466w288eqajcaepkyg86h84qa21
License
MIT-0
Free to use, modify, and redistribute. No attribution required.