← Back to Skills Marketplace
482
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install openclaw-memory-2
Description
Agent memory with ALMA meta-learning, LLM fact extraction, and full-text search. Observer calls remote LLM APIs (OpenAI/Anthropic/Gemini). ALMA and Indexer w...
Usage Guidance
This package implements a local meta-learning optimizer and local file indexer plus an Observer that calls third-party LLM APIs. Before installing: (1) be aware the Observer will send conversation text to external LLM endpoints — only provide API keys you trust and scope them appropriately; (2) the registry metadata does not declare the required env vars (OPENAI_API_KEY / ANTHROPIC_API_KEY or passing apiKey), so the platform may not prompt you to supply them — you must supply a key in config or env; (3) the indexer reads Markdown files from whatever workspace path you give it, so point it only at directories you intend it to index; (4) if you need Gemini support, confirm how you will supply the Google key (the SKILL.md omits a named env var); (5) consider testing in a sandboxed environment first and review the upstream GitHub repo (author/email present) for additional context. These are coherence/visibility issues rather than evidence of malicious behavior, but they matter for secure operation.
Capability Analysis
Type: OpenClaw Skill
Name: openclaw-memory-2
Version: 2.0.1
The skill is classified as suspicious due to its file system access capabilities in `src/indexer.ts` (`readFileSync`, `readdirSync`). While intended for indexing 'workspace Markdown files', if the `workspace` parameter is not properly sanitized or constrained by the OpenClaw agent runtime, a malicious prompt could instruct the agent to index and potentially read arbitrary files outside the intended scope (e.g., `/etc`, `~`). Additionally, `src/observer.ts` makes network calls to external LLM APIs (OpenAI, Anthropic, Gemini) and reads API keys from environment variables, which is a high-risk capability, though it is explicitly stated and necessary for the skill's core function and targets legitimate endpoints. There is no evidence of intentional data exfiltration to unauthorized parties, backdoors, or prompt injection attempts within the `SKILL.md` itself.
Capability Assessment
Purpose & Capability
The code implements ALMA (local), Indexer (local file indexing), and Observer (remote LLM calls) which matches the skill name/description. However the registry metadata lists no required env vars/credentials while the SKILL.md and the observer code clearly require an LLM API key (OpenAI/Anthropic/Google GEMINI key passed as apiKey). This metadata mismatch is unexpected and should be corrected by the publisher.
Instruction Scope
Runtime instructions and SKILL.md confine network calls to LLM provider APIs (OpenAI, Anthropic, Gemini) and file reads to workspace Markdown files. The Observer sends conversation text to third‑party LLM endpoints (expected behavior). The SKILL.md documents limitations (in-memory DB, simplified ranking) which align with the code.
Install Mechanism
There is no install spec in the registry (instruction-only), and the README suggests installing/publishing via npm or cloning the GitHub repo. No unusual download URLs, extract steps, or native binaries are present; package.json lists no runtime dependencies. Low install risk from this package itself.
Credentials
Observer requires an LLM API key (the code checks process.env.OPENAI_API_KEY or process.env.ANTHROPIC_API_KEY or accepts apiKey in config). The registry metadata nevertheless lists no required env vars, so the skill will operate only if keys are provided but a user or system might not be warned. Also SKILL.md mentions Gemini but does not name a specific environment variable for the Google API key — the code expects the caller to pass apiKey or embed it in the URL. Requiring an LLM key is proportional to the Observer feature, but the metadata omission is a coherence/visibility problem and could lead to inadvertent exposure of keys if misconfigured.
Persistence & Privilege
The skill is not force-included (always: false), does not request system-level privileges, and does not modify other skills or global configuration. It reads files from the workspace only when the indexer is invoked with a workspace path supplied by the caller.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install openclaw-memory-2 - After installation, invoke the skill by name or use
/openclaw-memory-2 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.1
- Major refactor introducing the OpenClaw Memory System v2.
- Three-component architecture: ALMA (meta-learning, offline), Observer (fact extraction via LLM API), Indexer (offline full-text search).
- Observer now supports multiple LLM APIs (OpenAI, Anthropic, Gemini) with configurable API key.
- ALMA and Indexer operate fully offline, with ALMA evolving memory system designs.
- Dashboard removed for a simpler, code-focused experience.
- Indexer uses an in-memory search mock instead of SQLite FTS5.
Metadata
Frequently Asked Questions
What is Openclaw Memories?
Agent memory with ALMA meta-learning, LLM fact extraction, and full-text search. Observer calls remote LLM APIs (OpenAI/Anthropic/Gemini). ALMA and Indexer w... It is an AI Agent Skill for Claude Code / OpenClaw, with 482 downloads so far.
How do I install Openclaw Memories?
Run "/install openclaw-memory-2" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Openclaw Memories free?
Yes, Openclaw Memories is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Openclaw Memories support?
Openclaw Memories is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Openclaw Memories?
It is built and maintained by Artale (@arosstale); the current version is v2.0.1.
More Skills