Vanar Neutron Memory

Save and recall agent memory with semantic search. Context that persists across every session.

This skill appears to do what it claims, but you should be aware of privacy implications before enabling auto-capture/auto-recall: enabling those hooks will send user messages and assistant responses to a third‑party API (api-neutron.vanarchain.com). Recommendations: (1) Only enable VANAR_AUTO_CAPTURE/VANAR_AUTO_RECALL if you trust the provider and accept that conversation content will be transmitted and stored. (2) Store your API key with care — prefer a credentials file restricted to your user (chmod 600 ~/.config/neutron/credentials.json) or use a short‑lived key, and avoid committing keys to dotfiles in shared repos. (3) Verify the API endpoint and provider (openclaw.vanarchain.com / api-neutron.vanarchain.com) independently and review their privacy/retention policies. (4) If you enable hooks, test with non-sensitive data first. (5) Note the small documentation mismatch: SKILL.md says "No local files are read" but the scripts will read an optional credentials file if present; consider that when configuring. If you need higher assurance, run the scripts in an isolated environment and monitor outbound network calls before trusting them with sensitive data.

Type: OpenClaw Skill Name: vanar-neutron-memory Version: 1.3.2 The OpenClaw AgentSkills skill bundle is classified as benign. All scripts (`hooks/*.sh`, `scripts/neutron-memory.sh`) consistently use `jq` to safely construct JSON payloads from user and agent inputs, effectively preventing shell injection vulnerabilities. The skill's functionality is clearly defined as saving and searching agent memory via a specific external API (`api-neutron.vanarchain.com`), and it explicitly states what data is sent and what is not. Auto-capture and auto-recall features are opt-in, and there is no evidence of unauthorized data exfiltration, persistence mechanisms, or other malicious behaviors.