Memory-Auditor

Audits an agent's claims against stored memory to detect fabricated or drifted details and assess memory consistency with token-level analysis.

Before installing or invoking: (1) Confirm whether you expect the audit to run locally or to be sent to an external hosted service — SKILL.md claims local analysis but documents a remote endpoint and includes worker code. (2) Do not send sensitive or private memory contents to this endpoint unless you trust the operator and their Terms/Privacy, because the skill requires POSTing full 'current_behavior' and 'stored_memory' and demands a payment header. (3) Ask the author/source for clarification about the hard-coded EXA_API_KEY in wrangler.toml and worker.js; request removal of embedded keys or an explanation of their purpose. (4) Verify the service domain (memory-auditor.cvapi.workers.dev) and who controls it; prefer an implementation that truly runs locally if privacy is a concern. (5) If you still want to use it, request a version that performs the analysis locally (no external network calls) or review hosting/ownership/legal terms and ensure the payment mechanism cannot be abused.

Type: OpenClaw Skill Name: memory-auditor Version: 1.0.0 The skill bundle implements a memory auditing service as described, but it contains a hardcoded API key (EXA_API_KEY: d6aa75ee-d815-4a48-8262-ac16131e9323) in both worker.js and wrangler.toml. While the code performs local token analysis and does not currently exfiltrate data, the inclusion of hardcoded credentials is a significant security vulnerability and poor practice.