Memory Tree

🌳 记忆树 — 周报自动生成，永久记忆标记，关键词搜索。说句话就能用。

This skill appears to implement the advertised local weekly-report/search/mark features, but the documentation and security note contain inconsistencies about cloud fallbacks and automatic cron installation. Before installing: 1) Inspect scripts/memory_tree.py yourself (it is included) to confirm there are no network calls or reference to cloud API keys in the shipped version. 2) Check your environment for OPENAI/ZHIPU (or other cloud) API keys if you require strictly local operation — remove/unset them or run the script in an isolated environment. 3) If you don't want persistent scheduling, do not run the 'setup' command (or inspect the exact crontab entries the setup would create). 4) Backup ~/.openclaw/workspace and review openclaw.json (the skill will read it to detect channels). 5) If anything in the README/SECURITY.md doesn't match the actual code you see, treat that as a red flag and ask the author to clarify.

Type: OpenClaw Skill Name: memory-tree Version: 2.0.1 The skill is classified as suspicious due to significant discrepancies between the documentation and the actual code, as well as its access to sensitive configuration files. While the script (scripts/memory_tree.py) claims to be a simplified v2.0, the README.md and SECURITY.md describe high-risk features like automated cron job persistence and cloud API fallbacks (OpenAI/Zhipu) that are not present in the provided source. Most notably, the script reads the user's primary 'openclaw.json' configuration file to extract communication channel IDs (e.g., Feishu chat_ids), which is a high-privilege action that could be leveraged for unauthorized data exposure.