Memory Compress

Never let your agent forget what matters. Compress verbose daily logs into structured summaries — 4-8x compression, zero information loss. Inspired by classi...

This skill appears to implement the advertised compression logic and does not contact networks or request credentials. However, the script resolves input file paths against OPENCLAW_WORKSPACE (defaulting to ~/.opencl/workspace) rather than the current working directory — a behavior not documented in SKILL.md. Before installing/using: 1) inspect the script (done) and confirm the workspace path is acceptable; 2) run it first on a non-sensitive test file and pass explicit absolute paths for input and output to avoid accidental reads of other files; 3) if you prefer behavior tied to the current directory, modify the script to resolve relative to process.cwd() or set OPENCLAW_WORKSPACE explicitly; 4) avoid running it directly on production or sensitive memory until you’re comfortable with its file access and output locations.

Type: OpenClaw Skill Name: memory-compress Version: 1.2.1 The skill contains a path traversal vulnerability in `scripts/memory-compress.js` because it uses `path.resolve(WORKSPACE, DAILY_LOG)` and `path.resolve(OUTPUT)` without validating that the resulting paths remain within the intended workspace. This allows the script to read from or write to arbitrary locations on the filesystem if the input arguments are manipulated. While the code lacks evidence of intentional malice, such as network exfiltration or obfuscation, the insecure file handling is a high-risk flaw.