Synthetic Supermemory

Full automated memory pipeline for OpenClaw agents. Scribe session transcripts into structured daily memory files, ingest them into Supermemory for semantic...

Security Scan

The skill's code, instructions, and requested credentials are consistent with a memory-scribing + ingestion pipeline that sends transcripts to a summarization LLM and indexes them in Supermemory.

Purpose & Capability

Name/description (scribe transcripts → create daily memory files → ingest into Supermemory → recall/search) matches the included scripts (scribe.js, ingest.js, recall.js, add.js, search.js). Requested binaries (node) and primary credential (SUPERMEMORY_API_KEY) are appropriate for the stated functionality. One minor mismatch: SKILL metadata declares OPENAI_API_KEY as the second required env var but the code also supports ANTHROPIC_API_KEY; ANTHROPIC_API_KEY is not listed in requires.env.

Instruction Scope

Instructions and scripts legitimately read OpenClaw session transcripts (~/.openclaw/agents/.../sessions/*.jsonl), summarize them via an external LLM (OpenAI or Anthropic), write local daily memory files, and upload/index content to Supermemory. This does mean session contents (which may include secrets/PII) are sent to external services — the SKILL.md includes a privacy notice. The scripts do not appear to read unrelated system credentials or hidden endpoints beyond OpenAI/Anthropic and Supermemory.

Install Mechanism

There is no packaged install spec (instruction-only), which keeps surface area low. However, SKILL.md instructs running `npm install` in the skill directory while the registry metadata does not declare dependencies and the skill bundle does not include a package.json. The scripts require the 'supermemory' npm module but that dependency is not declared in the package bundle — the user will need to install dependencies manually. This is an operational inconsistency (not a direct malicious indicator) but worth attention before running.

Credentials

The two required credentials (SUPERMEMORY_API_KEY and an LLM API key) are proportionate to the task. PrimaryEnv is correctly set to SUPERMEMORY_API_KEY. Minor documentation inconsistency: scripts accept ANTHROPIC_API_KEY as an alternative, but ANTHROPIC_API_KEY is not listed under required env vars in the metadata.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide settings. It writes state files (.scribe-state.json, .ingest-state.json) into the scripts directory and writes memory files where the user specifies — this is expected for the feature. The agent can invoke the skill autonomously (platform default), which is appropriate for an automated memory pipeline.

Assessment

This skill appears to do what it says: it reads OpenClaw session transcripts, summarizes them via an external LLM, writes local memory files, and indexes them in Supermemory. Before installing, consider: - Privacy: session contents (potentially including secrets or PII) will be sent to OpenAI/Anthropic and to Supermemory. Use a low-privilege LLM key with spend limits and avoid including sensitive sessions in the scribed directories. - Secrets handling: follow the SKILL.md advice to store keys securely (not in crontab); verify your crontab lines do not leak secrets in process lists or logs. - Dependencies: the scripts require the 'supermemory' npm package but the bundle has no package.json; you will likely need to install required npm modules yourself. Inspect package source and run npm install in a controlled environment before scheduling cron jobs. - Configuration: point --memory-dir and --agents-dir to only the directories you intend to index; do not point ingest to broad system directories to avoid accidental ingestion of sensitive files. - Minor documentation mismatches: the skill supports ANTHROPIC_API_KEY but the metadata does not list it — set that env if you plan to use Anthropic. Confirm the Supermemory endpoint (api.supermemory.ai) and validate the client library provenance. If you accept these trade-offs and install dependencies manually after inspecting package sources, the skill is coherent with its stated purpose.

Full memory pipeline for OpenClaw agents. Three components that work together:

session transcripts
      ↓ scribe.js (hourly system cron)
memory/YYYY-MM-DD.md
      ↓ ingest.js (every 2h system cron)
Supermemory (containerTag per agent)
      ↓ recall.js (session startup)
enriched context

No gateway involvement. No context bloat. Fully automated.

⚠️ Privacy notice

scribe.js sends conversation transcript content to an external LLM (OpenAI or Anthropic) for summarization. If your sessions contain secrets, API keys, or PII — be aware that content will be sent to the provider. Use a dedicated low-privilege API key with spend limits.

Quick setup

# Install dependencies
cd /path/to/skills/synthetic-supermemory && npm install

# Store keys securely (do NOT put secrets in crontab)
mkdir -p ~/.openclaw/secrets
echo "sk-your-openai-key" > ~/.openclaw/secrets/scribe-key && chmod 600 ~/.openclaw/secrets/scribe-key
echo "sm-your-supermemory-key" > ~/.openclaw/secrets/supermemory-key && chmod 600 ~/.openclaw/secrets/supermemory-key

# Test scribe (dry-run)
SUPERMEMORY_API_KEY=$(cat ~/.openclaw/secrets/supermemory-key) \
node scripts/scribe.js \
  --agents-dir ~/.openclaw/agents \
  --all-sessions \
  --memory-dir ~/.openclaw/workspace/memory \
  --api-key-file ~/.openclaw/secrets/scribe-key \
  --dry-run

# Test recall
SUPERMEMORY_API_KEY=$(cat ~/.openclaw/secrets/supermemory-key) \
node scripts/recall.js --container my-agent

Cron setup (add via crontab -e)

# Scribe active sessions hourly
0 * * * * SUPERMEMORY_API_KEY=$(cat ~/.openclaw/secrets/supermemory-key) node /path/to/synthetic-supermemory/scripts/scribe.js --agents-dir ~/.openclaw/agents --all-sessions --memory-dir ~/.openclaw/workspace/memory --api-key-file ~/.openclaw/secrets/scribe-key >> /tmp/scribe.log 2>&1

# Ingest changed memory files into Supermemory every 2 hours
0 */2 * * * SUPERMEMORY_API_KEY=$(cat ~/.openclaw/secrets/supermemory-key) node /path/to/synthetic-supermemory/scripts/ingest.js --dir ~/.openclaw/workspace/memory --container my-agent >> /tmp/ingest.log 2>&1

Scripts

Script	Purpose	Usage
scribe.js	Summarize session transcripts → daily memory files + Supermemory	Hourly cron
ingest.js	Ingest changed memory files → Supermemory (upsert, change-tracked)	Every 2h cron
recall.js	Retrieve context at session startup	Session start
add.js	Add a single memory from CLI or stdin	On demand
search.js	Semantic search across memories	On demand

scribe.js options

Flag	Description	Default
--agents-dir <dir>	OpenClaw agents directory	—
--all-sessions	Scribe all recently active sessions	—
--sessions <dir>	Single agent sessions directory	—
--session-id <id>	Specific session UUID	—
--auto-session <key>	Auto-resolve session by key suffix	—
--memory-dir <dir>	Directory for daily memory files	required
--provider <name>	LLM provider: openai or anthropic	auto-detected
--model <model>	Summarization model	gpt-4o-mini
--api-key-file <path>	LLM API key file (600 permissions)	—
--sm-container <tag>	Supermemory container override	--agent value
--agent <id>	Agent label for memory headers	agent
--active-within-hours <n>	Only scribe sessions active within window	1
--min-turns <n>	Minimum new turns before scribing	3
--dry-run	Print without writing	false

ingest.js / recall.js / search.js / add.js options

All take --container <tag> to namespace memories per agent.

# Ingest a directory
node scripts/ingest.js --dir ~/.openclaw/workspace/memory --container sapphire

# Recall context at session start
node scripts/recall.js --container sapphire --query "recent projects and identity"

# Add a one-off memory
node scripts/add.js --container sapphire --content "Kitsune prefers dark mode"

# Search
node scripts/search.js --container sapphire --query "TokTeam deployment"

References

• references/api.md — Full Supermemory API reference (batch add, delete, container management)
• references/transcript-format.md — OpenClaw session transcript JSONL structure