Memory Ops

Manage mandatory PostgreSQL memory operations with context retrieval, prompt logging, delegation tracking, and audit event recording using Memory_openclaw an...

Before installing: (1) Ask the author to explicitly list how the agent connects to the database (required env vars or connection string) and do not provide DB credentials unless you control the target database. (2) Verify the DB, schema, and sample data are deployed in an isolated/test database you control. (3) Remove or parameterize the hardcoded user_id='ian' and agent='jarvis' values so the skill cannot accidentally write other users' data. (4) Confirm where embeddings come from and whether an embedding model key is needed; ensure that is documented and minimal-scoped. (5) Require a retention and PII/secret-filtering policy — the skill logs every prompt/delegation and could persist sensitive data. (6) If you will allow autonomous invocation, restrict which agents can use this skill and audit the memory_audit table regularly. If the author cannot explain the DB connectivity and data governance, treat the skill as unsafe to enable in production.

Type: OpenClaw Skill Name: memory-ops Version: 0.1.2 The skill bundle is designed for memory management and auditing within a PostgreSQL database. While the `SKILL.md` instructions are benign and even include a positive security instruction ('Não salvar segredos sensíveis sem necessidade explícita'), the SQL files (`references/queries.sql`, `references/schema.sql`, `scripts/memory_ops_template.sql`) consistently use a hardcoded `user_id = 'ian'` and `agent = 'jarvis'`. This indicates a potential vulnerability related to multi-tenancy or user context management, where data might be inadvertently shared or accessed across users if the OpenClaw platform does not strictly enforce user isolation, classifying it as suspicious rather than benign due to this design flaw.