Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenClaw 记忆系统

v1.0.0

支持多模态图片和工具调用记忆,细粒度项目和用户隔离,及基于自然语言的记忆修正与版本控制。

0· 183·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for nick-liu1989/openclaw-memory-system.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "OpenClaw 记忆系统" (nick-liu1989/openclaw-memory-system) from ClawHub.
Skill page: https://clawhub.ai/nick-liu1989/openclaw-memory-system
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install openclaw-memory-system

ClawHub CLI

Package manager switcher

npx clawhub@latest install openclaw-memory-system
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name/description promise a full multimodal memory system (many JS modules, search, versioning, Feishu integration). However the provided file list in this submission contains mostly documentation and a single scripts/install.js; the core runtime files referenced throughout SKILL.md (image-memory.js, tool-memory.js, memory-correct.js, etc.) are not actually present. This mismatch suggests the package is incomplete or mispackaged — it does not currently deliver the capabilities it advertises.
!
Instruction Scope
SKILL.md instructs copying many skill and config files into the OpenClaw workspace and running node tests (e.g., node skills/multimodal-memory/test-multimodal.js). Those commands are reasonable when the code exists, but because the bundle here lacks the referenced JS modules and tests, the instructions are misleading. SKILL.md also mentions configuring a Feishu webhook for notifications (optional), which would involve sending data to an external endpoint if enabled — acceptable if deliberate and controlled, but worth noting.
Install Mechanism
There is no network download/install step — the only script (scripts/install.js) creates directories under the OPENCLAW_WORKSPACE and attempts to copy config files from a path inside that workspace. This is low risk in isolation. However package.json references postinstall and a main module that are missing; the install script expects files under WORKSPACE/skills/openclaw-memory-system/, which may never exist for this bundle. The install behavior is local-only (no external URLs) but the packaging inconsistencies are concerning.
Credentials
The skill declares no required environment variables, no credentials, and no privileged config paths. SKILL.md mentions optional Feishu webhook configuration for notifications; that is optional and would require the user to supply a webhook URL. Overall requested environment/credentials are proportionate to the described functionality.
Persistence & Privilege
Flags are default (always: false, agent invocation allowed), and the install script only creates directories and copies config files inside the workspace. There's no evidence the skill requests permanent global privileges or modifies other skills' configs. This aspect appears proportionate.
What to consider before installing
This package's docs and manifest describe many runtime JS modules, but the archive you provided only includes documentation and a small install script — the modules SKILL.md references (image-memory.js, tool-memory.js, memory-correct.js, tests, etc.) are missing. Before installing: 1) verify the full source (e.g., the claimed GitHub repo) contains the runtime files; ask the author for a complete release; 2) inspect any postinstall or install scripts shipped with the real package — here package.json refers to postinstall.js which is absent; 3) avoid running scripts or tests from untrusted packages until you confirm their contents; 4) if you enable Feishu/webhook integrations, use webhooks you control and review what data will be sent. The current inconsistencies look like an incomplete/mispackaged skill rather than clearly malicious code, but treat it with caution and request a complete, verifiable release before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c0pfp9s7y939ap4mrdd541d832wzg
183downloads
0stars
1versions
Updated 22h ago
v1.0.0
MIT-0

OpenClaw Memory System Skill

完整的记忆系统技能包,支持多模态记忆、细粒度隔离、自然语言修正。

技能信息

  • 名称: openclaw-memory-system
  • 版本: 1.0.0
  • 描述: 多模态记忆系统,支持图片/工具记忆、项目/Agent/用户隔离、自然语言修正
  • 作者: 刘哈娜
  • 许可证: MIT

核心功能

P1 - 多模态记忆系统

  • 图片记忆管理(元数据/描述/检索)
  • 工具调用记忆(历史记录/统计分析)
  • 多模态检索(统一 API/跨模态关联)

P2 - 细粒度项目隔离

  • 项目记忆命名空间
  • Agent 记忆隔离与继承
  • 用户记忆与权限控制

P3 - 自然语言记忆修正

  • 反馈意图解析(修正/补充/删除/确认)
  • 版本控制(历史/对比/回滚)
  • 飞书交互卡片

安装步骤

方法 1: ClawHub 安装(推荐)

clawhub install openclaw-memory-system

方法 2: 手动安装

# 1. 复制技能文件
cp -r /path/to/openclaw-memory-system/skills/* \
  ~/.openclaw/workspace/skills/

# 2. 复制配置文件
cp -r /path/to/openclaw-memory-system/configs/* \
  ~/.openclaw/workspace/configs/

# 3. 复制测试文件(可选)
cp -r /path/to/openclaw-memory-system/tests/* \
  ~/.openclaw/workspace/tests/

# 4. 验证安装
node ~/.openclaw/workspace/skills/multimodal-memory/test-multimodal.js

方法 3: Git 安装

cd ~/.openclaw/workspace/skills
git clone https://github.com/your-repo/openclaw-memory-system.git
mv openclaw-memory-system/skills/* .
mv openclaw-memory-system/configs/* ../configs/

配置说明

1. 多模态配置

文件:configs/multimodal-config.json

{
  "storage": {
    "baseDir": "memory/multimodal",
    "imagesDir": "images",
    "toolCallsDir": "tool-calls",
    "captionsDir": "captions"
  },
  "limits": {
    "maxStringLength": 5000,
    "maxIndexSize": 1000,
    "cleanupDays": 30
  },
  "validation": {
    "forbiddenDirs": ["/etc", "/root", "/var"],
    "sensitiveKeywords": ["password", "secret", ".ssh"]
  },
  "performance": {
    "cacheSize": 100,
    "cacheTTL": 300000
  }
}

2. 命名空间配置

文件:configs/memory-namespaces.json

{
  "version": "1.0",
  "namespaces": {
    "projects": {
      "default": {
        "path": "memory",
        "description": "默认项目",
        "users": ["liumeng"]
      }
    },
    "agents": {
      "liu-hana": {
        "path": "MEMORY.md",
        "inherit": [],
        "shareWith": []
      }
    },
    "users": {
      "liumeng": {
        "path": "users/user_liumeng",
        "permissions": ["read", "write", "delete", "admin"]
      }
    }
  }
}

快速开始

1. 保存图片记忆

const { ImageMemory } = require('./skills/multimodal-memory/image-memory');
const imgMem = new ImageMemory();

await imgMem.save({
  path: '/path/to/image.png',
  caption: '测试图片',
  tags: ['测试'],
  context: { sessionId: 'test' }
});

2. 记录工具调用

const { ToolMemory } = require('./skills/multimodal-memory/tool-memory');
const toolMem = new ToolMemory();

await toolMem.record({
  toolName: 'web_search',
  parameters: { query: '测试' },
  result: { success: true },
  duration: 1000
});

3. 创建项目

const { ProjectMemory } = require('./skills/project-memory-isolation/project-memory');
const projMem = new ProjectMemory();

await projMem.createProject('my-project', {
  description: '我的项目',
  users: ['liumeng']
});

4. 自然语言修正

const { MemoryCorrect } = require('./skills/memory-feedback/memory-correct');
const corrector = new MemoryCorrect();

await corrector.autoCorrect('不对,我其实不喜欢健身,喜欢游泳');

测试

# 安装依赖
cd ~/.openclaw/workspace
npm install --save-dev jest

# 运行所有测试
npm test

# 运行单个测试
node skills/multimodal-memory/test-multimodal.js
node skills/memory-feedback/feedback-parser.js "不对,我不喜欢健身"

性能指标

指标目标实际
图片检索延迟<100ms<50ms
工具检索延迟<50ms<30ms
安全评分>9092
测试覆盖率>70%70%

安全特性

  • ✅ 路径验证(禁止访问系统目录)
  • ✅ 权限控制(三级权限)
  • ✅ 原子写入(防止数据损坏)
  • ✅ 版本控制(可回滚)
  • ✅ 敏感信息过滤

常见问题

Q: 图片保存失败?

A: 检查 configs/multimodal-config.json 中的路径配置,确保目录存在。

Q: 权限验证失败?

A: 检查 configs/memory-namespaces.json 中的用户配置,确保用户有相应权限。

Q: 如何启用飞书通知?

A: 在 memory-correct.js 中配置飞书 webhook URL。

依赖要求

  • Node.js >= 14.0.0
  • OpenClaw >= 2026.2.26
  • Jest(测试用,可选)

更新日志

v1.0.0 (2026-03-17)

  • ✅ P1 多模态记忆系统
  • ✅ P2 细粒度项目隔离
  • ✅ P3 自然语言记忆修正
  • ✅ 13 个问题修复
  • ✅ 完整测试覆盖

贡献指南

欢迎提交 Issue 和 Pull Request!

许可证

MIT License

联系方式

Comments

Loading comments...