← Back to Skills Marketplace
2823
Downloads
2
Stars
9
Active Installs
3
Versions
Install in OpenClaw
/install skill-from-memory
Description
Convert memory, conversation history, or completed tasks into publishable OpenClaw skills. Use when (1) A task or workflow should be reusable, (2) Extracting...
Usage Guidance
This skill will read your local conversation history and memory files, extract text and code blocks, generate a skill package, and — if you pass GitHub/ClawHub targets — attempt to push that package to remote repositories. Before using: (1) Inspect the extracted output directory (extracted-*) and review code_blocks.txt / extraction-summary.md for any secrets or private data. (2) Run create steps without publish (omit --github/--clawhub or use --skip-github / --skip-clawhub) to verify contents. (3) If you must publish, push to a private repo first and double-check files; don't publish directly to public repos. (4) Ensure you understand that any API keys, tokens, or PII present in conversations could be included in the package and uploaded. (5) Consider grepping session/memory files for common secret patterns before extraction, and prefer manual review of generated SKILL.md and scripts prior to running publish.sh.
Capability Analysis
Type: OpenClaw Skill
Name: skill-from-memory
Version: 0.1.2
The skill is classified as suspicious due to multiple critical shell injection vulnerabilities and a mechanism for propagating unvalidated executable code. Specifically, `scripts/create-skill.sh` uses user-controlled variables like `$DESCRIPTION` and `$SKILL_NAME` directly within heredocs (e.g., for `SKILL.md` and `README.md`), allowing for arbitrary command execution if these variables contain crafted input (e.g., `EOF` followed by shell commands). Additionally, `scripts/extract-from-history.sh` and `scripts/extract-from-memory.sh` extract raw code blocks from conversation history or memory files, which are then copied and made executable by `scripts/create-skill.sh` into the new skill's `scripts/extracted-code.sh` without sanitization, posing a significant supply chain risk for malicious code propagation. Other scripts like `scripts/create-and-publish.sh`, `scripts/extract-from-history.sh`, and `scripts/publish.sh` also exhibit shell injection risks through unquoted variables (`$SKILL_NAME`, `$PATTERN`, `$GITHUB_REPO`) when used in command arguments or path constructions.
Capability Assessment
Purpose & Capability
The skill claims to extract from conversation history/memory and create/publish skills; the included scripts do exactly that (extract, create skill files, optionally push to GitHub and ClawHub). Access to session and memory files, and to git/clawhub tooling, is coherent with the stated purpose.
Instruction Scope
Scripts directly read arbitrary session.jsonl and memory.md files (examples reference ~/.openclaw/agents/main/sessions/latest.jsonl). They extract conversation text and code blocks and copy them into generated skill packages. If the extracted content contains secrets or private data, the publish step will push that content to remote services. The instructions allow full automatic create-and-publish in one command, which increases the risk of unintentionally exposing sensitive data.
Install Mechanism
No install spec or remote downloads are present; the skill is instruction+scripts only. It requires common CLI tools (git, jq, clawhub) which are reasonable for the stated functionality.
Credentials
The skill declares no environment variables, which is consistent, but publishing requires GitHub credentials/SSH keys and ClawHub auth in practice. Those are not requested explicitly by the skill metadata — users must supply them externally. This is expected for publishing, but the scripts will capture and stage any extracted content (including any credentials present in conversations) and push them if a repo/slug is provided.
Persistence & Privilege
always:false and no system-wide persistence requested. The scripts may initialize a git repo and add a remote inside the created skill directory, but they do not modify other skills or agent system configuration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-from-memory - After installation, invoke the skill by name or use
/skill-from-memory - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.2
No changes detected for version 0.1.2 (no file changes).
- Content and documentation remain the same as previous version.
- No new features, bug fixes, or updates introduced.
v0.1.1
No changes since the previous version.
- No file changes detected in this release.
- Documentation and functionality remain unchanged.
v0.1.0
- Initial release of skill-from-memory: turn conversation history or memory files into reusable, publishable OpenClaw skills.
- Automates extraction, design, creation, and publishing of skills from past solutions, tasks, or workflows.
- Includes scripts to extract from chat or memory, structure skill resources, and push to GitHub/ClawHub.
- Provides best practices, workflow example, versioning guidance, and troubleshooting tips in SKILL.md.
Metadata
Frequently Asked Questions
What is Skill From Memory?
Convert memory, conversation history, or completed tasks into publishable OpenClaw skills. Use when (1) A task or workflow should be reusable, (2) Extracting... It is an AI Agent Skill for Claude Code / OpenClaw, with 2823 downloads so far.
How do I install Skill From Memory?
Run "/install skill-from-memory" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill From Memory free?
Yes, Skill From Memory is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Skill From Memory support?
Skill From Memory is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill From Memory?
It is built and maintained by zfanmy (@zfanmy); the current version is v0.1.2.
More Skills