EchoMemory

• Analyzed: May 18, 2026, 8:37 AM
• Findings: 1
• Version: 0.2.6
• Hash: ebd1c127a63571493e4e648522b93ce06db7d67abe1356f3bcd6874b340bc5c8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The EchoMemory skill bundle is a legitimate plugin designed to synchronize local markdown memories with a cloud service (iditor.com) and provide a local workspace viewer. The bundle contains extensive documentation and instructions (SKILL.md) that guide the AI agent in assisting users with installation, account connection via OTP, and troubleshooting common setup issues. While the plugin interacts with sensitive areas like the OpenClaw configuration (~/.openclaw/.env) and reads local markdown files, these actions are essential for its stated functionality. The provided utility script (start-local-ui.mjs) follows standard practices for a local helper tool, and no evidence of malicious intent, unauthorized data exfiltration, or prompt injection was found.