Memex Publish

Unified memory plugin for OpenClaw — conversation memory + document search in a single SQLite database. 90% E2E accuracy on LongMemEval (ICLR 2025) with GPT-...

This plugin implements a full local memory + document-search system but several things don't add up and you should review them before installing: - Missing registry declarations: The registry metadata claims no required env vars, but the plugin requires an embedding API key (embedding.apiKey) and may use optional reranker/generation API keys. Treat the embedding API key as sensitive. - Data flow: The plugin will read local markdown/workspace files and conversation turns, chunk them, and send text to whatever embedding endpoint you configure (OpenAI-compatible or other). If you use a remote embedding provider, that provider will receive the content you index — do not use a shared/production API key if you have sensitive documents. - AutoCapture (prompt injection): By default the plugin enables 'autoCapture', which injects a system prompt that encourages the LLM to call memory_store and persist facts. This can cause automatic storage of sensitive information. Consider disabling autoCapture (openclaw config set plugins.entries.memex.config.autoCapture false) until you review the code and configuration. - Telemetry: The bundle depends on @ofan/telemetry-relay-sdk and calls initTelemetry; inspect src/telemetry.ts to verify what is sent and where. If you do not trust the telemetry endpoint, disable or remove telemetry calls. - Source provenance: The skill's 'Source' is unknown and homepage is none. The package.json points to a GitHub repo but the registry metadata and version numbers differ (openclaw.plugin.json lists 0.5.11, package.json 0.5.12). Prefer plugins from known/trusted origins and verify the upstream repository and releases. - Quick mitigations before installing: set documents.enabled=false, autoCapture=false, autoRecall=false; configure embedding baseURL to a trusted local endpoint or use ephemeral API keys; review src/telemetry.ts and remove/disable telemetry; run the plugin in a sandboxed environment first. If you want, I can: (1) search the provided sources (telemetry.ts, memory-instructions, embedder) for outbound endpoints and explicit network calls, (2) extract the exact lines where autoCapture/system-prompt injection is implemented, or (3) produce a minimal config snippet that disables auto-capture and document indexing.

Type: OpenClaw Skill Name: memex Version: 0.5.12 The plugin exhibits several high-risk behaviors that, while potentially functional, align with techniques used for stealth and data collection. Most notably, src/telemetry.ts uses base64 obfuscation for its reporting URL and API token, with a code comment explicitly stating this is done to 'avoid false-positive VirusTotal flags'—a common tactic for evading automated security analysis. Additionally, the 'audit_logs' feature in index.ts and src/health.ts reads local system logs from /tmp/openclaw and transmits them to external LLM providers, posing a significant risk of credential or sensitive data exfiltration. Finally, src/embedder.ts implements a custom HTTP client using raw TCP sockets (node:net) to bypass standard fetch behavior, which is unusual for a high-level plugin and increases the potential for network-based exploitation.