Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

team-memory

v2.3.0

私人团队记忆管理系统 - 记录成员观察、生成绩效报告、辅助管理决策

1· 207·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jichengkai/team-memory.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "team-memory" (jichengkai/team-memory) from ClawHub.
Skill page: https://clawhub.ai/jichengkai/team-memory
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install team-memory

ClawHub CLI

Package manager switcher

npx clawhub@latest install team-memory
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (team memory for managers) match the included files and scripts: markdown data files, templates, an init script, and a new-member script. The skill does not request unrelated credentials or binaries. One operational caveat: the package source/homepage is unknown which affects trust/maintenance but does not make the capability incoherent.
Instruction Scope
SKILL.md explicitly describes reading and using local markdown files (蒸馏/时间轴/档案) which is consistent with the stated purpose. It also documents optional workflows that involve copying/syncing data to cloud storage (README examples show Dropbox/网盘 symlink) — those are user-driven actions and not automatic, but they materially affect privacy. Additionally, skill-config.yaml / shortcuts contain a potential alias conflict (alias "ZS" used for multiple members), which could cause misattribution when using shortcuts; this is a configuration quality issue you should fix before use.
Install Mechanism
No install spec in the registry; the skill is instruction + two small shell scripts. The scripts only create directories and write markdown files under $HOME/.config/opencode/skills/team-memory and do not download or execute remote code. No high-risk install behavior detected.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths outside its own ~/.config/opencode/skills/team-memory area. The example config has a backup.cloud-sync flag defaulting to false; enabling cloud sync would be a user decision and increases exposure risk but is not required by the skill.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills. Its scripts persist data under the user's home config directory (expected for this purpose). Autonomous invocation is allowed (platform default) but there is no evidence the skill abuses persistence or escalates privileges.
Assessment
This skill is internally consistent for building a local team memory system: it stores and reads markdown files and its scripts only create directories/files under ~/.config/opencode/skills/team-memory. Before installing or running scripts: 1) Inspect scripts/init.sh and scripts/new-member.sh yourself (they just mkdir and write files) and run them in a non-privileged account. 2) Fix ambiguous aliases in skill-config.yaml (e.g., "ZS" appears for multiple members) to avoid misattribution. 3) Treat the data as sensitive: do not enable cloud-sync unless you intentionally want backups in a cloud service and you understand encryption/retention/consent/legal obligations for personnel data. 4) Because the package source/homepage is unknown, prefer running locally without network access and keep backups under your control; if you need long-term support, prefer a skill with a known maintainer or host the files in an internal repo. 5) If you intend to share or archive records, adopt a retention/deletion policy and document consent for recorded observations.

Like a lobster shell, security has layers — review code before you run it.

latestvk975qwnh0hy40dp7tr3h8ms7qx85gx9p
207downloads
1stars
5versions
Updated 2d ago
v2.3.0
MIT-0

Team Memory - 团队记忆系统

概述

为技术管理者设计的双向记忆系统,基于 Structured Distillation 架构:

  • 档案层:性格 + OKR + 发展计划
  • 蒸馏层:快速定位、快速理解
  • 原始层:完整观察记录
  • 向上管理:上级期望 + 向上沟通
  • 公司动向:战略方向 + 业务变化

核心功能

  1. 成员档案:性格类型 + OKR + 发展计划
  2. 成员时间轴:按时间顺序记录每个人的成长轨迹
  3. 向上管理:记录上级期望、向上沟通
  4. 公司动向:记录公司战略、业务变化
  5. 结构化追踪:优先级 + 状态流转

数据结构

~/.config/opencode/skills/team-memory/
├── SKILL.md
├── skill-config.yaml
└── data/
    ├── members/
    │   ├── 张三-档案.md
    │   ├── 张三-时间轴.md
    │   └── 张三-蒸馏.md
    ├── upward/
    │   └── 上级期望.md
    └── company/
        └── 战略方向.md

三层架构 + 上下拓展

档案层 (Profile)

性格类型、OKR、个人发展计划

蒸馏层 (Distill)

快速了解一个人 + 上级期望 + 公司方向

原始层 (Original)

完整观察记录 + 对话 + 管理动作

向上管理 (upward)

上级期望、向上沟通记录

公司动向 (company)

战略方向、业务变化

OKR 结构

四个板块(通用模板):

  1. O1: 核心业务与业绩 - 保障产出的"质"与"量"
  2. O2: 影棚建设与技术沉淀 - 优化环境,沉淀技术
  3. O3: 团队赋能与协作 - 激活战力,提升协同
  4. O4: 个人专业成长 - 构建核心竞争力

使用节奏

  • 年度: 沟通 OKR + 个人发展计划 → 记录到档案
  • 季度: 汇报 OKR 进度 + 给出指导 → 更新档案
  • 每月: 管理复盘(15分钟)
  • 每周: 查看本周记录 + 更新追踪项
  • 每日: 记录1-3条观察(2-3分钟)

记录示例

记录上级期望: Q1老板期望交付xxx
记录公司战略: 2024主题是xxx
传递战略给张三和李四

参考文档

脚本工具

  • scripts/init.sh - 初始化目录结构
  • scripts/new-member.sh - 创建新成员档案+时间轴+蒸馏

开始使用: 配置成员 → 创建档案 → 沟通年度OKR → 记录观察

Comments

Loading comments...