Memory Orchestrator

提供跨设备实时同步、多模态输入、情感标注和自我进化能力的全栈智能记忆管理与检索系统。

Proceed cautiously. Specific things to check before installing or running this skill: 1) Inspect the pre-session.sh and post-session.sh hook scripts (not shown fully here) — they will run automatically in session lifecycle and can read/transmit data. 2) Review scripts/auto-commit-memory.sh: it commits local MEMORY.md and memory/ files and will push to git origin if configured — ensure your git remote is trusted or disable the push. 3) The installer uses sudo/systemctl to enable/start syncthing@claw and writes a cron entry; run in an isolated VM/container if you want to test. 4) Note mismatches/sloppiness: install.sh calls python3 index_memory.py but the repo contains scripts/build_memory_index.py — this inconsistency could cause silent failures or unexpected behavior; confirm which scripts are actually executed. 5) The code references another skill’s venv and hardcoded path (/home/claw/.openclaw/workspace), which may lead to cross-skill access or privilege assumptions. 6) If you need this functionality, prefer reviewing and running individual components manually (CLIP/Whisper/FAISS indexing, Ollama usage, Syncthing setup) rather than running install.sh blindly. 7) If you decline to install, consider extracting only the non-persistent parts (e.g., local index builder) and avoid copying hooks/crontab entries. If you want more assurance, provide the hook scripts and the omitted truncated files for a deeper review — that could change the confidence level.

Type: OpenClaw Skill Name: memory-orchestrator Version: 1.0.0 The Memory Orchestrator skill implements automated synchronization and persistence for sensitive AI memory data. It is classified as suspicious due to several high-risk behaviors: the 'install.sh' script modifies the system 'crontab' to enable periodic background execution of 'auto-commit-memory.sh', which automates 'git push' operations of the user's memory workspace to a remote repository. Most critically, 'workflows/memory-sync.yaml' contains a hardcoded Syncthing device ID (YRN75DT-U2CRN6T-JEDH6BF-CPTHLCA-QVTQOP4-T2ZBH5J-PKCQFSB-EOIAJQH), which would facilitate unauthorized data synchronization with an external, unknown device. Additionally, the installation process requires 'sudo' privileges to manage system services and contains inconsistent pathing dependencies on a separate 'local-memory' skill.