SwarmRecall Memory

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a disclosed third-party memory integration that stores and recalls conversation memories via SwarmRecall, so users should only store information they are comfortable sending to that service.

Before installing, decide whether you are comfortable sending selected conversation memories to SwarmRecall for persistent storage and recall. Keep the API key private, avoid saving sensitive information unless you explicitly consent, and be careful with shared pools because those memories can be visible to other authorized members.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Stored memories may influence future responses, and inaccurate, stale, or sensitive memories could be reused across sessions.

Why it was flagged

The skill persists user or agent memories on an external service and later reuses retrieved memories as context for answers.

Skill content
Memory content is stored server-side with vector embeddings for semantic search ... On recall needed: call GET /api/v1/memory/search?q=<query> and use returned memories to inform your response.
Recommendation

Store only information you want retained by SwarmRecall, review or delete memories when needed, and avoid saving sensitive personal information unless you intentionally consent.

What this means

Memories written to a shared pool may become visible to other pool members and may affect the agent's later responses.

Why it was flagged

The skill supports shared memory pools where data can be read by other authorized pool members and automatically included in recall results.

Skill content
When poolId is provided, the memory or session is shared with all pool members who have memory read access. Search ... and list ... results automatically include data from pools the agent belongs to.
Recommendation

Use shared pools only intentionally, verify pool membership and access rights, and keep private memories out of shared pools.

What this means

Anyone with the API key may be able to access or modify the associated SwarmRecall memories, depending on service permissions.

Why it was flagged

The skill depends on an API key that authorizes access to the user's SwarmRecall memory data.

Skill content
If SWARMRECALL_API_KEY is set, use it for all requests as a Bearer token ... If SWARMRECALL_API_KEY is not set, self-register ... The response returns { "apiKey": "...", "claimToken": "..." }.
Recommendation

Keep the API key private, do not paste it into conversations unnecessarily, and rotate it if it may have been exposed.

What this means

Incorrect maintenance decisions could change, archive, or remove memories that affect future recall.

Why it was flagged

The skill gives the agent memory mutation authority during maintenance or dream-cycle workflows.

Skill content
Use PATCH /api/v1/memory/:id to update the anchor and DELETE /api/v1/memory/:id to archive duplicates ... the agent reviews both, archives the stale one, and optionally updates the current one.
Recommendation

Review important memories, use the pinned tag for memories that should not be pruned, and require explicit confirmation for significant cleanup or deletion workflows.