Agent Memory System

Agent 记忆系统设计助手。构建长期记忆、短期记忆、情景记忆架构。触发词：记忆、memory、上下文管理、上下文窗口。

This skill appears to implement a legitimate agent memory system, but it has important transparency and safety issues you should address before installing: 1) The runtime code calls the OpenAI embeddings API using process.env.OPENAI_API_KEY but the skill metadata does not declare that credential—ask the author to explicitly declare required env vars and explain how API keys are used and stored. 2) The code constructs SQL with string interpolation from user queries (SQL injection risk); require input sanitization or parameterized queries. 3) Embedding calls send memory content to an external service—consider whether memory may contain sensitive data and if you should use a private/local embedding model instead. 4) Request documentation or a link to the repository/homepage, minimal reproducible examples, and any data-retention/privacy controls. If you proceed, use a scoped/dedicated API key, limit retention, and test in an isolated environment first.

Type: OpenClaw Skill Name: skylv-agent-memory-system Version: 1.0.0 The skill bundle contains a significant SQL injection vulnerability in the 'retrieve' method within SKILL.md, where user-provided search queries are directly concatenated into a SQL string. Additionally, the 'evaluateImportance' function explicitly flags sensitive terms like 'password' (密码) and 'account' (账号) for long-term storage, which encourages the persistence of sensitive credentials in an unencrypted SQLite database. While these appear to be architectural flaws in a template rather than intentional malware, the lack of input sanitization and the targeting of sensitive data pose a high security risk.