Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Moore Pyramid Memory System

v1.1.0

Moore 金字塔记忆系统 — 5层记忆架构,确保跨 session 连续性。每次启动时自动加载,新 session 开始时必须执行此 skill。

0· 93·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tosspi/moore-pyramid-memory-system.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Moore Pyramid Memory System" (tosspi/moore-pyramid-memory-system) from ClawHub.
Skill page: https://clawhub.ai/tosspi/moore-pyramid-memory-system
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install moore-pyramid-memory-system

ClawHub CLI

Package manager switcher

npx clawhub@latest install moore-pyramid-memory-system
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (a 5‑layer persistent memory system) aligns with instructions to load and update MEMORY.md, .todos.md and per‑day/month files. However the SKILL.md lists scripts (startup-read.js, weekly-archive.js, monthly-archive.js) and cron schedules even though no code files or install steps are included — claiming automatic execution without providing the scripts or an install mechanism is an incoherence.
!
Instruction Scope
Instructions require reading and writing persistent files under ~/.openclaw/workspace/ (MEMORY.md, memory/*.md, .todos.md) and mandate writing conversation summaries after every conversation. That is functionally within a 'memory' skill, but it directs persistent logging of conversation content (potentially sensitive) and instructs automatic script execution at startup. The skill does not document access controls, retention, or how the startup automation is implemented, giving broad discretion to the agent and raising privacy and scope‑creep concerns.
Install Mechanism
No install spec and no code files are provided. This lowers code supply risk, but is inconsistent with the SKILL.md which references scripts and cron jobs—either the skill expects the runtime to already contain these scripts or the SKILL.md is incomplete. That mismatch should be resolved before trusting automatic behaviors.
Credentials
The skill requests no environment variables, credentials, or external services, which is proportionate for a local memory system. One note: the SKILL.md references an absolute user path (~/.openclaw/workspace/scripts/) but does not declare or justify access to system config paths or other skills' data.
!
Persistence & Privilege
The description asserts the skill 'must be executed' on new sessions and that a startup script 'executes automatically', but the skill is not marked always:true and provides no mechanism to install or register itself to run at startup. This is an unresolved claim: if the skill attempts to create persistent startup hooks or cron jobs, that would be a privileged action that should be explicitly disclosed and consented to.
Scan Findings in Context
[no_code_files_found] unexpected: SKILL.md references multiple JavaScript scripts (startup-read.js, weekly-archive.js, monthly-archive.js) and cron schedules but the skill package contains no code files or install spec; this is unexpected and suggests the documentation is incomplete or the skill relies on external artifacts not provided.
What to consider before installing
This skill is plausible for keeping cross‑session notes, but it currently has gaps and privacy implications. Before installing or enabling it: (1) ask the publisher for the actual scripts and an explicit install/registration plan (how startup execution and cron jobs are created); (2) verify where files will be stored and who can read them (these files will contain conversation summaries and todos); (3) prefer a manual review step before any agent creates persistent startup hooks or cron jobs; (4) if you proceed, run it in a restricted workspace or sandbox, and review the content of any created scripts for unexpected network access or credential use. If the author cannot provide the missing scripts/install instructions, treat the SKILL.md as incomplete and avoid enabling automatic behaviors.

Like a lobster shell, security has layers — review code before you run it.

latestvk970tyhy7g09f5wf98ayhq6fyd83y6k5
93downloads
0stars
1versions
Updated 3w ago
v1.1.0
MIT-0

Moore 金字塔记忆系统

Moore's self-developed memory system ensures continuity across sessions. Never forget a cross-session task again.

The Problem It Solves

Before: Cross-session tasks were forgotten because there was no persistent todo tracking.

After: A 5-layer pyramid with a dedicated .todos.md file ensures every cross-session task persists.

Architecture

Workspace Memory (5 Layers)
├── MEMORY.md              — Permanent essence (always loaded at startup)
├── memory/monthly/        — Monthly summaries
├── memory/weekly/         — Weekly summaries
├── memory/*.md            — Daily diaries (last 14 days)
└── .todos.md             — Cross-session todo list (CRITICAL!)

Core Files

FilePurpose
scripts/startup-read.jsLoads all 5 layers on every startup
scripts/weekly-archive.jsGenerates weekly summaries (cron: Monday 9AM)
scripts/monthly-archive.jsGenerates monthly summaries (cron: monthly, last day)
.todos.mdCross-session todo list — THE key mechanism

How Startup Works

On every session start, startup-read.js executes automatically:

Layer 1: MEMORY.md — Permanent essence
Layer 2: memory/monthly/*.md — All monthly summaries
Layer 3: memory/weekly/weekly-review-*.md — This month's weeks
Layer 4: memory/*.md — Last 14 days diaries
Layer 5: .todos.md — Cross-session todos ⭐

The .todos.md Rule (Critical!)

When to write to .todos.md:

  • Masone asks you to create something that can't be completed immediately
  • Any cross-session project, agreement, or pending action
  • Examples: "publish this skill when network restores", "wait for Masone's input"

Format:

## 进行中
- [ ] Task description here

## 已完成
- [x] Completed task (keep for history)

After completion: Move the line from "进行中" to "已完成"

Conversation Summary Rule

After every conversation with Masone ends, write a summary immediately.

  • When: Trigger words ("好的"/"就这样"/"结束了"), topic switch, 5 min silence
  • Length: ≤2000 characters
  • Where: memory/YYYY-MM-DD.md (today's diary)
  • Format:
    1. Topic (1 sentence)
    2. Core content (bullet points)
    3. Masone's preferences/corrections
    4. Todo items
    5. Self-reflection

Cron Configuration

TaskCronScript
Weekly reviewMonday 9AMweekly-archive.js
Monthly archiveLast day of month 10AMmonthly-archive.js

Scripts Location

All scripts: ~/.openclaw/workspace/scripts/

Related Skills

  • memos-memory-guide — MemOS memory tools (memory_search, etc.)
  • memory-never-forget — Atkinson-Shiffrin memory model

History

DateEvent
2026-03-22Initial creation
2026-03-27Enhanced with .todos.md, startup-read.js updated to 5 layers
2026-03-29Added conversation summary rule
2026-03-31Fixed: scripts separated, monthly cron added, template newlines fixed

This skill documents Moore's own memory system.

Comments

Loading comments...