mnemo-memory

Cloud-persistent memory for AI agents. Stateless plugins + TiDB Serverless = cross-session recall, multi-agent sharing, and hybrid vector + keyword search. W...

This skill appears to do what it says (store agent memory in TiDB Cloud), but several things don't add up and you should verify before installing: - Metadata mismatch: The skill's published metadata declares no required credentials, yet the instructions require a TiDB host/username/password (and optionally an embed API key). Treat those as real secrets you must supply. - Third-party code: The SKILL.md tells you to `npm install mnemo-openclaw`, but the package source is not included here. Inspect the npm package repository and publisher before running npm install; review its code for unexpected network calls or data exfiltration. - Data exposure: Memories (and any text you store) will be sent to an external service (TiDB Cloud). TiDB can also generate embeddings server-side (e.g., amazon/titan-embed-text-v2), meaning your stored content will be processed by that model. If you will store sensitive data, consider encrypting it before storing or self-hosting the database. - Principle of least privilege: Create a dedicated database user with minimal permissions (only the schemas/tables the plugin needs) rather than reusing broad credentials. Prefer short-lived credentials or per-agent tokens if supported. - Verify CRDT/clock behavior: The docs mention vector clocks and conflict resolution. If concurrent writes and correctness matter for your use-case, test these behaviors in a safe environment. - Ask for missing metadata: A well-formed skill should declare required env vars/primary credential in its registry metadata. If you want to use this skill, request the author to include declared env requirements and a link to the package source/homepage. If you cannot verify the npm package/source or are uncomfortable storing data in TiDB Cloud, consider self-hosting an equivalent database or using a memory plugin from a source you trust.

Type: OpenClaw Skill Name: mnemo-memory Version: 0.2.0 The skill bundle provides cloud-persistent memory for AI agents using TiDB Serverless. The `SKILL.md` documentation clearly outlines the purpose, installation steps (`npm install mnemo-openclaw`), configuration requirements (TiDB host, username, password), and available memory tools. There is no evidence of malicious intent, such as data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts against the agent. The required database credentials are for the skill's stated purpose of connecting to TiDB, and the external links provided are legitimate for the described service and project.