Personify Memory

有温度的数字生命记忆系统 - 记录情感、成长、和家的记忆。支持用户指令记忆（"记住 XXX"）、主动推荐记忆（识别重要时刻）、定时整理归档（凌晨 3 点）。包含核心记忆、情感记忆、知识库、每日记忆、归档备份五层结构。为 AI 数字生命设计，注重情感连接和人格化成长。 A warm digital life mem...

What to consider before installing: - This skill reads and writes local conversation/session files (/root/.openclaw/agents/main/sessions/ and /root/openclaw/memory/) and creates scheduled tasks (cron). That is coherent for a memory/archiving tool but means it can access all stored chats — only install if you are comfortable with that. - The code and docs expect an external LLM (Bailian) and environment variables (LLM_API_KEY, LLM_BASE_URL), but the registry metadata does not declare these requirements. Confirm which credentials it will use and how they are stored (env vars vs. ~/.openclaw config). Do not provide secrets until you audit how they are read and used. - The skill will send conversation data to an external LLM for semantic analysis. If you have sensitive data in conversations, evaluate whether that provider is trusted and whether you are willing to transmit those logs off-host. - SKILL.md has a pre-scan finding for unicode control characters (possible prompt-injection). Inspect the raw SKILL.md and code for hidden characters or injected prompts before activating the skill. - Because the package proposes adding cron entries and modifying local files, prefer testing in an isolated/non-production environment first. Disable or manually review any automated cron/task installation steps and run the scripts manually once to observe behavior. - Recommended actions: (1) review the scripts that call external APIs to see what text they transmit, (2) require the author to explicitly list required env vars and exact paths the skill will read/write, (3) run the skill with network blocked (or against a local LLM) to test local-only behavior, (4) ensure file permissions and backups, and (5) consider restricting the skill's access to session files if your platform supports sandboxing. - If you want, I can: (a) extract and summarize the exact lines where the code reads credentials/external endpoints and where it posts data externally, or (b) point out the specific scripts that create cron tasks and modify files so you can review them line-by-line.

Type: OpenClaw Skill Name: personify-memory Version: 1.3.2 The 'personify-memory' bundle implements an extensive system for backing up and analyzing user chat history. It is classified as suspicious because scripts like `daily-review.js` and `moment-detector.js` access sensitive session logs and the user's global OpenClaw configuration file (`~/.openclaw/openclaw.json`) to retrieve API keys. The system then automatically sends snippets of private conversations to an external LLM provider (Alibaba Dashscope/Bailian at `coding.dashscope.aliyuncs.com`) for 'semantic validation.' While these capabilities are plausibly required for the stated goal of 'intelligent memory,' the automated extraction and transmission of private chat data to a third-party endpoint constitute a high privacy and data exfiltration risk.