ClawHub

Memory-Master | 超级记忆大师

v4.1.0

AI Memory System with LLM Wiki

⭐ 0· 39·1 current·1 all-time
by@cp3d1455926-svg
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoRequires wallet
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (AI Memory System / LLM Wiki) aligns with the supplied code: modules implement capture, compaction, curation, filtering and retrieval. Declared dependencies (openclaw, yaml, glob) and package.json scripts are consistent with an on-disk memory/ wiki workflow.
ℹ
Instruction Scope
SKILL.md is minimal and the real runtime instructions live in the code. The code will create and modify files and directories under the workspace (memory/, memory/raw, memory/wiki, MEMORY.md and per-date .md files). The curator concatenates raw files and constructs an extraction prompt that is passed to SimpleChat.complete — if SimpleChat is wired to a real API (OpenClaw or other LLM), large amounts of combined memory could be sent externally. Filtering logic exists, but sending aggregated content to an external service is possible when integrated.
✓
Install Mechanism
There is no install spec; the package ships source and compiled JS files (dist/) only. No remote downloads or extraction-from-URL steps are present in the manifest. This reduces install-time risk.
ℹ
Credentials
The skill does not declare any required env vars or credentials, yet package.json depends on an 'openclaw' package and the SimpleChat implementation comments reference using OpenClaw sessions_send or direct API calls. That implies the skill may expect platform-provided model/session credentials at runtime even though none are declared. This is plausible but worth noting: the skill may attempt network/model calls without explicitly listing credentials.
✓
Persistence & Privilege
always is false and the skill does not request system-wide configuration or modify other skills. It writes to its own workspace files (memory/), which is normal for a local memory skill.
Scan Findings in Context
[base64-block] expected: The compiled JS files include embedded source maps (data:application/json;base64,...) which triggered the base64-block detection. This is benign and expected for bundled/dist JS files; it is not evidence of exfiltration by itself.
Assessment
What to consider before installing: - This skill stores and manipulates memory on disk (memory/, MEMORY.md, per-date .md files). If you install it, expect it to create and edit files under the agent workspace — back up any important files first. - The curator merges many raw memory files and prepares prompts that are intended to be sent to an LLM. The provided SimpleChat is a placeholder; when connected to a real model/runtime (OpenClaw or another API), aggregated memory content could be transmitted externally. If you have sensitive data, verify how the runtime provides model credentials and whether transmissions are acceptable. - The project includes a sensitive-data filter module; do not assume filtering is perfect. Avoid storing high-value secrets (private keys, passwords, API tokens) in the memory workspace unless you audit and trust the filtering logic. - No install-time downloads or remote installers are used, which reduces supply-chain risk, but review any CLI scripts (dist/cli, scripts referenced in package.json) and the omitted files for hidden network calls before running automated curation/compact operations. - If you want to test safely: run in an isolated environment, use dry-run options where available, inspect the code paths that call network/model APIs, and confirm what credentials (if any) the runtime will pass to the skill.

Like a lobster shell, security has layers — review code before you run it.

agentvk975wwwyz7nnb7cne3tbfrppnx84dpgxaivk975wwwyz7nnb7cne3tbfrppnx84dpgxanthropicvk975wwwyz7nnb7cne3tbfrppnx84dpgxkarpathyvk975wwwyz7nnb7cne3tbfrppnx84dpgxlatestvk975wwwyz7nnb7cne3tbfrppnx84dpgxmemoryvk975wwwyz7nnb7cne3tbfrppnx84dpgxopenclawvk975wwwyz7nnb7cne3tbfrppnx84dpgxskillvk9793p7e6xgmq1fdj4f0q0qpqs84a6fj

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments