Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Memory V2 Skill
v2.5.4Memory Lucia - Local SQLite-based memory system for OpenClaw agents. Features: (1) Priority analysis and tracking, (2) Learning progress with milestones, (3)...
⭐ 0· 80·0 current·0 all-time
bysnowy@wen521
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose (local SQLite memory for agent data) matches the code: modules interact with a local sqlite3 DB, no outbound network calls or credentials are requested. However there are mismatches across versions/filenames (e.g., api uses './memory-v2.db' while QueryModule defaults to './memory-v2.5.db') and SKILL.md/version strings differ; these are coherence problems (likely bugs) but not evidence of external exfiltration.
Instruction Scope
SKILL.md instructs local installation (npm install sqlite3, node scripts/init-memory.js) and claims no external API calls. The instructions reference a migration script (node migrations/v1-to-v2.js) that does not exist in the package — that is an explicit mismatch. The docs promise 'automatic database backups' and a migration path, but provided files do not clearly implement or support those steps; this is scope/documentation drift.
Install Mechanism
There is no packaged install spec; the skill is instruction-first and requires the sqlite3 Node package. No remote downloads, shorteners, or extract operations are present in the provided files, so install risk is low — but package.json (not shown) should be inspected for additional dependencies.
Credentials
The skill requests no environment variables or credentials and the code does not read any env vars in the provided files. This is proportionate to a local SQLite memory implementation.
Persistence & Privilege
The skill is not marked always:true, and uses only local files (database and schema). It does not request elevated agent privileges or modify other skills. Its potential to run autonomously (default) is normal for skills and not marked here as an extra privilege.
What to consider before installing
Key issues to consider before installing or using this skill:
- Code/schema mismatches: Several modules reference database columns that don't exist in database/schema.sql (examples: LearningModule.insert uses milestone_name but schema column is title; completeMilestone updates is_completed/completed_date while schema uses status/completed_at; EvolutionModule attempts to insert old_level/new_level into memory_evolution_history though the schema expects event_type/event_data). These mismatches will likely cause runtime SQL errors or silent data corruption.
- Logical bugs: EvolutionModule.recordUsage shadows the function parameter named 'result' with a const result from db.run, which breaks the success/failure logic and the XP/level flow. Expect incorrect behavior or exceptions.
- Missing artifacts: SKILL.md and other docs reference migration scripts (migrations/v1-to-v2.js) and demo initializers that are not present or inconsistent. Also SKILL.md reports inconsistent version numbers in places (2.5.4 vs 2.0.2). This indicates the package may be incomplete or poorly maintained.
- Filenames and DB names differ: api/index.js uses './memory-v2.db' while QueryModule defaults to './memory-v2.5.db' — ensure the module actually opens the intended DB file to avoid fragmentation of data across files.
- No external network activity or secret access detected in provided files, which is good — but you should still inspect the omitted files (modules/version.js, scripts, package.json, and any other truncated files) before trusting the package.
Recommendations:
1) Do NOT deploy this against sensitive or production data until the above issues are fixed. Run it in an isolated environment or container for evaluation.
2) Review the remaining files (package.json, modules/version.js, scripts/init-memory.js, scripts/init-demo.js, and any omitted files) for any network calls, downloads, or env var usage. Confirm package.json dependencies and any postinstall scripts.
3) Fix the DB schema vs code mismatches or regenerate schema to match code; add parameterized queries where template interpolation occurs (some SQL uses string interpolation for time offsets).
4) Run unit tests or simple smoke tests: init DB, call api.init(), call a few API methods, and watch for SQL errors. Verify where the DB file is created and that backups (if any) are local.
5) If you need migration support, ask the author for the missing migration script and for consistent versioning; otherwise treat the project as requiring manual migration.
If you want, I can parse the omitted files (package.json, version module, remaining code) to check for network calls or other inconsistencies — provide those files and I will re-evaluate.Like a lobster shell, security has layers — review code before you run it.
latestvk979rvqre8chprr5bmm9am5ceh83j2z1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
