Recall Local

Local memory search for OpenClaw agents. Runs a lightweight Node.js server that indexes all files in ~/clawd/memory/ plus MEMORY.md and WORKING.md, then expo...

The code does what it says (indexes ~/clawd memory files and serves a search UI), but before installing: 1) verify you have Node.js and update the LaunchAgent path or run the server manually; the skill metadata failing to declare Node as a required binary is an oversight. 2) The server binds to 0.0.0.0 (accessible from your LAN) even though the README emphasizes localhost—if you want local-only access change server.listen to '127.0.0.1' or firewall the port. 3) Inspect scripts/server.js yourself (it's small) to confirm it only reads the intended files; remove the LaunchAgent if you prefer not to persist. 4) Because it will expose your agent's memory, review the contents of ~/clawd/memory, MEMORY.md, and WORKING.md for sensitive data before enabling network access. These inconsistencies look like sloppy packaging rather than overtly malicious behavior, but they materially affect privacy and exposure, so proceed with caution.

Type: OpenClaw Skill Name: recall-local Version: 1.0.0 The skill implements a persistent background service via a macOS LaunchAgent to index and search agent memory files (~/clawd/memory/). While the documentation in SKILL.md claims 'nothing leaves your machine,' the Node.js server (scripts/server.js) binds to 0.0.0.0, exposing the agent's full history, logs, and decisions to the entire local network without any authentication. This creates a significant data exposure risk, as anyone on the same network can query the unauthenticated /search endpoint to retrieve sensitive information.