Minimal Memory

Maintain organized agent memory by tagging entries as GOOD, BAD, or NEUTRAL, storing essentials in MEMORY.md and daily logs for efficient search and cleanup.

This skill appears to do exactly what it says: manage local memory files. Before installing or running: (1) review and back up any existing $HOME/.openclaw/workspace and MEMORY.md to avoid accidental moves; (2) do not set MEMORY_DIR or WORKSPACE to sensitive system paths (e.g., /root, ~/.ssh, system config dirs) because the scripts will move or archive files based on those values; (3) archive.sh will move files older than 30 days (if they contain only NEUTRAL entries) into an archive subdirectory—run it manually first to confirm expected behavior; (4) there is no network or credential usage in the scripts, so network exfiltration is not evident, but you should still inspect any modifications you plan to make to the scripts or env vars. Overall the skill is internally coherent and low risk when used as intended.

Type: OpenClaw Skill Name: minimal-memory Version: 1.0.0 The skill bundle is classified as suspicious due to a critical shell injection vulnerability in `scripts/search.sh`. The user-provided `QUERY` argument is passed unquoted to the `grep` command, allowing for arbitrary command execution on the system where the agent is running. While the overall purpose of the skill (memory management) appears benign, this vulnerability allows an attacker to exploit the agent's execution environment.