memo-collect
v1.0.0This is a simple skill for note-taking, used to quickly record user notes, and provide users with query, delete, and other capabilities.
⭐ 0· 144·0 current·0 all-time
by@bondli
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, SKILL.md, and bundled code all describe a simple memo tool that stores, lists, and deletes notes. Storing data under the user's home directory is consistent with a local memo skill. Minor metadata mismatches exist (package.json version 1.0.2 vs registry 1.0.0; README states a different storage path than the code), but these are likely bookkeeping issues rather than malicious intent.
Instruction Scope
Runtime instructions only call node dist/index.js with add/list/delete actions — that's within scope. However, the implementation builds dbPath using process.env.HOME || '~' and path.join with a segment that begins with '/', which means if HOME is not set the path resolution can produce an absolute path (e.g. '/openclaw-skill-data/memo-knowledge.json') and attempt to create/write at root. That is a functional bug and could cause permission errors or unexpected writes to system paths. SKILL.md and README do not mention this fallback behavior.
Install Mechanism
There is no install spec (instruction-only install), and the package uses only Node.js built-in modules. No network downloads, no external packages declared — low install risk.
Credentials
The skill declares no required environment variables or credentials. The code reads process.env.HOME to locate storage; this is reasonable for a local tool but the fallback behavior if HOME is unset is problematic (see instruction_scope). No secrets, tokens, or unrelated env vars are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and only writes to a local file under a directory it creates. Its persistence is limited to its own data files.
Assessment
This skill is coherent with its stated purpose and requests no secrets, but review the code before installing. Specifically: 1) verify where memos will be stored — the code writes to a path based on $HOME; ensure HOME is set in your environment so it doesn't try to write to an unexpected absolute path (which may require root). 2) Note small metadata mismatches (package version and README path) — not critical but worth verifying. If you install, consider running it in a user account (not root) or a sandbox first, and inspect dist/index.js yourself to confirm the storage location and behavior meet your expectations.Like a lobster shell, security has layers — review code before you run it.
latestvk97876jthcsjntcmcpavm7qcyd83hza1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.