Full-stack evolutionary local memory system with dual backends, hybrid RAG retrieval, semantic deduplication, auto-classification, GPU acceleration, and 100%...

This package implements a local ChromaDB plugin but contains several inconsistencies you should consider before installing: - Offline claim vs network capability: The code supports connecting to a remote ChromaDB (host/port + api_key). If you configure those, your data could be sent to a remote server. The skill's README/description should clearly state this possibility — it currently emphasizes '100% offline', which is misleading. - Model downloads: sentence-transformers (BGE-M3 default) typically downloads large model weights from external model hubs unless you pre-download them. Expect network activity on first use unless you provision models offline. - Installer behaviour: install.sh runs pip3 (system-wide by default), copies files into ~/.openclaw, and writes a config. It does not pip-install all dependencies listed in SKILL.md (lancedb, jieba are missing), and it tries to copy a docs/ directory that may not exist. Run the installer in a controlled environment (virtualenv or container), inspect install.sh, and fix the dependency list before running it. - Migration script access: migrate_lancedb.py inserts ~/.openclaw on sys.path and imports internal OpenClaw modules (core.vector_store.lancedb_store). That will access your existing local OpenClaw internals and data. Back up your OpenClaw data and review the migration script carefully before running it. Recommendations: - Review the code yourself (especially chromadb_plugin.py and install.sh) or have someone you trust do so. - Run the installer in a disposable VM or container, or at least in a Python virtualenv, and inspect network activity on first run. - If you need guaranteed offline operation, confirm how models are provisioned and change default model settings to point to locally-hosted artifacts before use. - Consider pinning package versions and adding missing dependencies (jieba, lancedb) explicitly to the install step, or install packages manually. Given these mismatches (misleading offline claim, missing dependency installs, and potential for remote connectivity if configured), I rate this skill as 'suspicious' rather than 'benign'. If you can validate and correct the items above, the code otherwise appears to implement the stated functionality.

Type: OpenClaw Skill Name: evomemory-core Version: 1.0.0 The EvoMemory Core skill bundle is a legitimate implementation of a ChromaDB-based memory system for OpenClaw agents. The installation script (install.sh) performs standard setup tasks such as installing dependencies via pip and configuring local directories (~/.openclaw/extensions/chromadb). The core logic in chromadb_plugin.py and the migration script (migrate_lancedb.py) follow expected patterns for vector database management without any evidence of malicious intent, data exfiltration, or prompt injection.