starmemo

智能记忆系统 v2.0 - 结构化记忆 + 知识库 + 启发式召回 + AI优化

Key things to consider before installing: - Autosave behavior: by default the skill's on_user_input will save every user message to disk (memory_data/daily). This may differ from the README/SKILL.md's description of selective/heuristic saving. If you expect selective saving, review/modify the on_user_input logic or configuration before enabling it in production. - Network calls and API keys: the skill will call LLM endpoints if you enable AI optimization and provide an API key. API keys can be persisted to a local .skill_config file; do not enable persist_key if you don't want keys written to disk. Also confirm that setting 'web' or 'allow_web_fetch' actually prevents network access in your deployment — the code does not consistently check this flag. - Runtime pip install: the modules auto-install the 'requests' package via pip at import time (subprocess). If you run in constrained or audited environments, prefer pre-installing dependencies or inspect that behavior. - Storage inconsistency: the repository contains two different storage paths (memory_data/ used by top-level starmemo.py and memory/ used by v2/storage). That can lead to scattered data across directories — search your filesystem after testing to find where data is stored. - Recommended mitigations: run the skill in an isolated or dev environment first; set enable_ai=false and persist_key=false before hooking into production; inspect and (if needed) edit on_user_input to enforce selective saving triggers; review .skill_config after first run; and avoid sending sensitive secrets to the skill until you confirm its behavior. - If you want more assurance: ask the author for clarification about the autosave policy, the intended use of allow_web_fetch, and why two storage paths are used; or request a small patch that respects a single 'save' policy and that makes network access explicit and gated.

Type: OpenClaw Skill Name: starmemo Version: 2.0.0 The starmemo skill bundle is a structured memory and knowledge management system for OpenClaw agents. It uses local Markdown files for storage and integrates with several legitimate Chinese LLM providers (e.g., Volcengine, Alibaba, DeepSeek) for text summarization and knowledge extraction. While it includes an auto-installation routine for the 'requests' library using subprocess and performs web searches via 'r.jina.ai', these behaviors are transparently documented and align with the stated purpose of the skill. No evidence of data exfiltration, malicious prompt injection, or unauthorized persistence was found.