Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Memory LanceDB Setup

v1.0.0

Configure OpenClaw's memory-lancedb plugin to enable local semantic vector memory using LanceDB and an OpenAI-compatible embedding provider.

0· 239·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ssyvonne/memory-lancedb-setup.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Memory LanceDB Setup" (ssyvonne/memory-lancedb-setup) from ClawHub.
Skill page: https://clawhub.ai/ssyvonne/memory-lancedb-setup
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install memory-lancedb-setup

ClawHub CLI

Package manager switcher

npx clawhub@latest install memory-lancedb-setup
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match what the skill asks you to do: enable the memory-lancedb plugin, configure an OpenAI-compatible embedding endpoint, install @lancedb packages, and patch a native binding issue on Apple Silicon. All requested actions and files are relevant to that goal.
Instruction Scope
SKILL.md instructs the user to run openclaw config set commands, npm installs under /usr/local/lib/node_modules/openclaw, and a local Python patch script that edits a packaged native.js. These actions are within the plugin's scope but do modify system-installed package files and write the embedding API key into OpenClaw config (plaintext in config commands). The instructions do not read or transmit unrelated files or secrets to external endpoints beyond the embedding provider endpoint the user configures.
Install Mechanism
This is an instruction-only skill (no remote install). The only install actions are npm install commands that the user is told to run. The included Python patch script edits a file under node_modules; no third-party downloads or obscure URLs are embedded in the skill files.
Credentials
The skill declares no required environment variables or credentials. It instructs the user to obtain an embedding API key and place it into OpenClaw's config, which is proportional to configuring an embedding provider. No unrelated credentials or config paths are requested.
Persistence & Privilege
The skill does not request 'always' presence and does not contain autonomous privileges beyond normal skill behavior. However it instructs patching a third-party package file inside system node_modules (writes to /usr/local/...), which requires filesystem privileges and is persistent until changed; backup and caution are advised.
Assessment
This skill appears to do what it says — install LanceDB bindings and patch a packaging bug — but it will modify system-installed node_modules and store an embedding API key in OpenClaw's config. Before running anything: (1) confirm OpenClaw is actually installed at the path used in the instructions (or update commands to your install path); (2) back up the target native.js (e.g., copy /usr/local/lib/node_modules/openclaw/extensions/memory-lancedb/node_modules/@lancedb/lancedb/dist/native.js to native.js.bak) so you can revert; (3) run npm installs with the correct architecture package and only from the official npm registry; (4) inspect the included patch_native.py locally before running it (it performs a simple text replace but will write to system files); (5) be aware that putting API keys into application config may store them in plaintext — consider whether OpenClaw has a secure secret store or prefer environment-based secrets where supported; and (6) prefer an upstream fix or official package if available rather than long-term local patches. If any of these steps or paths look unfamiliar (different install path, different LanceDB layout, or unexpected native.js content), stop and investigate before proceeding.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cst3xkqp3mft04fkgfh99v183vfz2
239downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

memory-lancedb Setup

Enables semantic vector memory in OpenClaw: memories stored with memory_store are embedded and indexed locally, then recalled on-demand via memory_recall — no full-context load.

Prerequisites

  • OpenClaw installed at /usr/local/lib/node_modules/openclaw
  • An OpenAI-compatible embedding API key (Gemini AI Studio free key works well)

Setup Steps

1. Get a Gemini API Key (free)

Go to aistudio.google.com → Get API key → Create API key.

2. Configure the plugin

openclaw config set plugins.entries.memory-lancedb.enabled true
openclaw config set plugins.entries.memory-lancedb.config.embedding.baseUrl "https://generativelanguage.googleapis.com/v1beta/openai/"
openclaw config set plugins.entries.memory-lancedb.config.embedding.model "text-embedding-004"
openclaw config set plugins.entries.memory-lancedb.config.embedding.apiKey "YOUR_API_KEY"
openclaw config set plugins.entries.memory-lancedb.config.embedding.dimensions 768

3. Install dependencies

# Step 1: install main package in openclaw root
cd /usr/local/lib/node_modules/openclaw
npm install @lancedb/lancedb

# Step 2: install platform-specific native binding in plugin dir
cd /usr/local/lib/node_modules/openclaw/extensions/memory-lancedb
npm install @lancedb/lancedb-darwin-arm64   # Apple Silicon (arm64)
# npm install @lancedb/lancedb-darwin-x64   # Intel Mac
# npm install @lancedb/lancedb-linux-x64-gnu  # Linux x64

4. Patch native.js (Apple Silicon only)

LanceDB's native.js tries x64 first, hits break on failure, and never reaches arm64. Run the patch script:

python3 ~/.openclaw/workspace/skills/memory-lancedb-setup/references/patch_native.py

5. Restart gateway and verify

openclaw gateway restart

Then test:

memory_store → should return: Stored: "..."
memory_recall → should return matching entries with similarity %

Migrating from MEMORY.md

If MEMORY.md is large, migrate key facts to the vector store and shrink MEMORY.md to a 20-30 line index. Group by topic and call memory_store for each:

  • Identity & permissions
  • Execution rules
  • Project configurations (cron IDs, doc tokens)
  • Technical knowledge (API quirks, field names)
  • Workflows and SOPs

Keep only "must-know-every-session" rules in MEMORY.md.

Troubleshooting

See references/troubleshooting.md for common errors and fixes.

Comments

Loading comments...