Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Layered Memory Sys

v1.1.3

提供基于6层架构的分层记忆管理,支持SQLite存储、本地嵌入搜索、中文分词、时间衰减及REST/WebSocket接口。

0· 103·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for 141553/layered-memory-sys.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Layered Memory Sys" (141553/layered-memory-sys) from ClawHub.
Skill page: https://clawhub.ai/141553/layered-memory-sys
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install layered-memory-sys

ClawHub CLI

Package manager switcher

npx clawhub@latest install layered-memory-sys
Security Scan
Capability signals
CryptoRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, SKILL.md and code consistently implement a layered memory system (TTL, consolidation, archive, dream cycle, REST/WS panel, TF‑IDF, optional embedding/tokenizer). Reading session logs and managing a local memory index is coherent with the stated purpose, but this capability requires access to user conversation logs and filesystem paths which are high‑impact and should be expected/explicit.
!
Instruction Scope
Runtime instructions and code read session log files and update a memory index (memory/index.json, archive.md, dream-log.md, stats files). The auto-write/dream-cycle logic scans recent session .jsonl files and may automatically create memory entries from conversation content. Additionally, one module (scripts/session-search.mjs) hardcodes SESSION_DIR as '/root/.openclaw/agents/main/sessions' instead of using the configurable path — an inconsistency that can cause the skill to access session data even if you configured a different directory.
Install Mechanism
No install spec is provided (instruction-only skill). The package is source code only; installing requires running npm install per README. No external URL downloads or opaque installers were observed in the provided files.
Credentials
Registry metadata declares no required env vars, but README and assets reference environment variables and API keys (MEMORY_DIR, SESSION_DIR, DOUBAO_API_KEY, DASHSCOPE_API_KEY, MEMORY_WORKSPACE). Optional embedding providers may require API keys. The skill will operate without credentials for local TF‑IDF/SQL storage, but if you enable cloud/local embedding you may need to provide keys — these env vars are mentioned in docs but not declared by the registry, which is an inconsistency you should confirm.
Persistence & Privilege
The skill does not request 'always: true'. It includes a heartbeat handler and scripts intended to be run periodically (or by a heartbeat system) and registers an API/WS server on localhost when started. Autonomous invocation is allowed by default (normal), which combined with session-reading code increases blast radius if the agent is allowed to run the skill unattended. It does not appear to modify other skills or global configs.
What to consider before installing
This skill implements a local memory system that reads your agent session logs and writes a memory index, archive files, dream logs and stats. Before installing or enabling it: - Review and approve which directory it will use (MEMORY_DIR/SESSION_DIR). Note: one file hardcodes /root/.openclaw/agents/main/sessions — update or audit that path if you don't want it to read system sessions. - Expect it to automatically create memory entries from recent conversations (auto-write/dream-cycle). If that behaviour is undesirable, turn off autoWrite in config. - If you enable embedding providers, the skill may require API keys (DOUBAO/DASHSCOPE/@xenova) not declared in the registry metadata — confirm which secrets you supply. - Run the skill in an isolated environment or with restricted filesystem permissions until you are comfortable with its behavior; inspect the omitted/remaining files (embedder/tokenizer and any network code) before granting network or session access. - If you plan to run the API/WS panel, bind it to localhost or a controlled interface and consider firewalling the ports. These inconsistencies look like sloppy configuration rather than clear malicious intent, but they materially affect privacy — treat the skill as potentially sensitive and verify config/paths and optional code before use.
src/search/embedder.mjs:34
Environment variable access combined with network send.
src/search/llm-summarizer.mjs:40
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk9755tzfz0tf6jqmdm549r1hed85gp55
103downloads
0stars
6versions
Updated 3d ago
v1.1.3
MIT-0

layered-memory-sys

分层记忆系统 — 6层架构的智能记忆管理。

6层记忆架构

  • 核心层 (永久) → MEMORY.md
  • 沉淀层 (90天) → 重要决策/项目经验
  • 关注层 (30天) → 反复讨论的话题
  • 活跃层 (7天) → 正在进行的任务
  • 闪存层 (3天) → 临时查询/一次性问答
  • Session (实时) → 当前对话上下文

功能

  • 📊 分层 TTL 管理 — 自动升级/归档/遗忘
  • 💤 梦境模式 — 巩固、归档、遗忘、合并
  • 🔍 TF-IDF 搜索 — 中文关键词搜索
  • 📈 统计面板 — HTML 可视化健康报告
  • ⚙️ 路径配置化 — 支持环境变量和配置文件
  • 🤖 自动写入检测 — 从对话中识别值得记住的内容

快速开始

测试

cd skills/layered-memory-sys
node scripts/test-v2.mjs

梦境模式

node scripts/dream-cycle.mjs

统计面板

node scripts/stats-panel.mjs

使用方式

该技能通过记忆索引 (memory/index.json) 管理记忆数据。

记忆层级

层级TTL说明
flash3天临时查询、一次性问答
active7天正在进行的任务
attention30天反复讨论的话题
settled90天重要经验、决策记录

升级规则

  • 同一话题被召回 ≥3 次 → flash → active
  • 多天连续被召回 → active → attention
  • 召回 ≥10 次 → attention → settled
  • 用户说"记住这个" → 直接进沉淀层

配置

支持环境变量 + 配置文件 (memory/config.json) + 默认值三级覆盖:

环境变量说明
MEMORY_DIR记忆数据目录
SESSION_DIRSession 日志目录

依赖

依赖用途必需
sql.jsSQLite WASM 存储
nodejieba中文分词推荐
wsWebSocket可选

版本历史

  • v1.1.2 — bug fix: 合并跳过提醒记忆 / 过滤系统消息
  • v1.1 — 向量搜索/路径配置化/统计面板/自动写入检测
  • v1.0 — 6层架构 + 梦境模式

Comments

Loading comments...