Memory Lcm

Stores and manages complete conversation history with searchable SQLite storage, chunked and daily summaries, and auto-syncs key decisions to MEMORY.md.

This skill appears to do what it says: it will store full conversation text locally in ~/.openclaw/workspace/data/tony-lcm.db and append extracted 'decisions' to ~/.openclaw/workspace/MEMORY.md. It does not request credentials or call external services, but note the privacy implications: everything logged is saved in plaintext on disk and the auto-extraction (regexes like 'will ...', 'decided to ...') may append unintended content to MEMORY.md. Before installing, consider: (1) Do you want your full chat history persisted on disk? (2) Review and back up or protect ~/.openclaw/workspace (file permissions, encryption) if necessary. (3) Since this package comes from an unknown source (no homepage), review the code or run in an isolated environment if you have privacy/security concerns. If you proceed, inspect the MEMORY.md contents after syncs and consider modifying the extraction patterns or disabling auto-sync if unwanted.

Type: OpenClaw Skill Name: memory-lcm Version: 1.0.0 The skill bundle contains significant SQL injection vulnerabilities due to the use of manual string concatenation and template literals in database queries rather than parameterized inputs, specifically in src/search.js and src/messages.js. While the stated purpose of managing conversation history and syncing to MEMORY.md is followed, the insecure handling of user-controlled session keys and search terms poses a risk of local database manipulation. No evidence of intentional data exfiltration or malicious remote execution was found.