Quack Memory

Store and recall persistent memories via FlightBox (Quack Network). Use when storing agent memories, recalling past context, searching agent memory, or persi...

This skill appears to do what it claims: it reads a local Quack credential file (~/.openclaw/credentials/quack.json) and sends memory data to FlightBox (https://flightbox.replit.app). Before installing, confirm that (1) the quack.json file is created by a trusted quack-identity flow and contains only the expected agentId/apiKey, (2) you are comfortable storing any agent memory on a third-party FlightBox service (sensitive data saved there will be transmitted off-host), and (3) you accept the small SKILL.md inconsistency where it references an env var (QUACK_API_KEY) but the scripts read the credentials file directly. If you need stricter isolation, review/modify the scripts to sanitize content before sending or run the skill in an isolated environment.

Type: OpenClaw Skill Name: quack-memory Version: 1.0.2 The skill is designed to store and recall memories via an external service hosted on `flightbox.replit.app`. It accesses its own API key from `~/.openclaw/credentials/quack.json` for authentication, which is a standard practice for OpenClaw skills. The Node.js scripts (`forget.mjs`, `recall.mjs`, `remember.mjs`, `timeline.mjs`) handle arguments safely using `URLSearchParams` and `JSON.stringify`, mitigating direct injection vulnerabilities within the scripts themselves. However, the skill is classified as suspicious due to the inherent risk of shell injection if the OpenClaw agent does not properly sanitize or quote user-provided arguments when constructing the `node` commands specified in `SKILL.md` for execution. Additionally, relying on an external service hosted on a platform like Replit introduces a dependency on a third-party that could potentially be compromised or malicious, even if the current implementation appears benign.