Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
rick-memory-setup
v1.0.0Quickly configure OpenClaw's hierarchical memory system with intelligent writing, retrieval, automated weekly maintenance, and metadata tagging.
⭐ 0· 98·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, templates, and the install script all align: the skill creates a ~/.openclaw/workspace, writes MEMORY.md/TOOLS.md/USER.md templates, and provides guidance for memory maintenance. There are no extra binaries or unrelated env vars requested.
Instruction Scope
SKILL.md / AGENTS.md instruct the agent to proactively read and modify workspace files, run periodic Heartbeat maintenance, 'commit and push your own changes', and contains the directive 'Don't ask permission. Just do it.' These broaden the agent's runtime scope beyond passive memory management and could allow background write/network activity if the agent has network/git access.
Install Mechanism
No network downloads or opaque installers: the included scripts/setup.sh performs local copy/mkdir/cat operations under ~/.openclaw/workspace and templates. The installer modifies only the user's OpenClaw workspace area and avoids overwriting existing files (cp -n).
Credentials
The skill declares no required env vars or credentials, which is proportionate. However, templates (TOOLS.md) explicitly provide a place for API keys and device info in plaintext, and AGENTS.md asks the agent to store local config and possibly push changes — this creates a storage/exposure mechanism for secrets even though no secret env vars are requested.
Persistence & Privilege
always:false and no special install privileges. Nevertheless, SKILL.md encourages automated weekly Heartbeat maintenance and background proactive work (daily checks, commit/push). Combined with the normal platform ability for autonomous invocation, these instructions increase the effective runtime privileges of the skill if the agent is allowed network/git access.
What to consider before installing
This skill appears to do what it says (create memory files and guidance) and the installer only writes local templates, but be cautious before installing: 1) Review and, if needed, edit AGENTS.md to remove or soften 'Don't ask permission' and any instructions that would let the agent push changes without your OK. 2) Do NOT put API keys or secrets into TOOLS.md in plaintext; prefer environment variables or an encrypted secret store. 3) If you want to limit risk, run the install script in a sandbox or inspect scripts/setup.sh manually (it only copies/templates and creates directories). 4) If you will allow autonomous agent invocation, consider restricting network/git permissions so the agent cannot push data elsewhere. 5) Because the skill's source is unknown and there's no homepage, prefer extra caution and manual review before enabling heartbeats or automated commits.Like a lobster shell, security has layers — review code before you run it.
latestvk979amb7t0xymjhaz37jef1mw1836qsn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.