← Back to Skills Marketplace
Soul Memory
by
kingofqin2026
· GitHub ↗
· v3.5.13
· MIT-0
823
Downloads
0
Stars
3
Active Installs
10
Versions
Install in OpenClaw
/install soul-memory
Description
Intelligent memory management system v3.5.13 - 修復 heartbeat-trigger.py 改用上次 heartbeat 到現在的增量窗口抓取 important context，避免固定 3 小時窗口遺漏與重掃。
Usage Guidance
This package mostly does what it claims (an OpenClaw memory plugin) but includes an install script, cron/heartbeat automation, and a bundled web UI — all of which increase risk compared with an instruction-only manifest. Before installing:
- Inspect install.sh, uninstall.sh, and heartbeat-trigger.py for commands that modify system config, create cron jobs, run as root, or contact external endpoints. Do NOT run install.sh as root until you've reviewed it.
- Search the code for network-bind/listen calls (e.g., FastAPI server in web/app.py) and for any HTTP/remote endpoints or telemetry; if a web server is enabled, lock it down or bind to localhost.
- Check for hardcoded paths (the docs reference /root/.openclaw/*) and adjust to your user home; avoid running the plugin as root.
- Backup ~/.openclaw/openclaw.json and your workspace before editing; review the plugin/openclaw.plugin.json and any steps that modify OpenClaw config.
- Consider running the install and initial tests in an isolated environment or VM first. If you want, I can list the specific files and lines to inspect (install.sh, heartbeat-trigger.py, web/app.py, plugin/index.ts, plugin/openclaw.plugin.json).
Capability Analysis
Type: OpenClaw Skill
Name: soul-memory
Version: 3.5.13
The Soul Memory System is a sophisticated long-term memory framework that uses a 'Heartbeat' mechanism to periodically scan session logs and inject context into AI prompts. While the functionality aligns with its stated purpose, the TypeScript plugin (plugin/index.ts) contains a potential shell injection vulnerability; it executes a Python CLI command using a query string that is only minimally escaped via a regex replace. Furthermore, the FastAPI web interface (web/app.py) lacks authentication, potentially exposing sensitive conversation history if the service is accessible over a network. The use of cron jobs and instructions in HEARTBEAT.md to execute local scripts are intended features for automated memory maintenance but represent a significant privilege level for a skill bundle.
Capability Tags
Capability Assessment
Purpose & Capability
Name/description, files, and SKILL.md consistently describe an OpenClaw long-term memory plugin (search/index/cache/heartbeat/plugin hook/web UI). Requested resources show no cloud credentials or unrelated binaries, which is appropriate. Minor inconsistency: SKILL metadata says 'instruction-only' (no install spec), yet the bundle contains many executable files (install.sh, uninstall.sh, web server, cron scripts) — that increases the footprint beyond a simple instruction-only skill.
Instruction Scope
Runtime instructions tell users to run bash install.sh, edit ~/.openclaw/openclaw.json, and restart the gateway. Documentation and HEARTBEAT.md reference execution of heartbeat-trigger and other Python scripts (some paths hardcoded to /root/.openclaw/workspace/...), and instructions read and write files under ~/.openclaw/workspace (e.g., memory/YYYY-MM-DD.md, cache/index.json). Those behaviors are plausible for a memory plugin, but they grant the skill read/write access to the user's OpenClaw workspace and schedule recurring jobs — this broad file/cron access is worth manual inspection. SKILL.md also indicates the plugin will automatically inject context before responses (prependContext), which means it runs during normal agent operation and can influence every response.
Install Mechanism
There is no formal install spec in the registry, but the repository includes a large install.sh (28KB) and web/start.sh/uninstall.sh. The SKILL.md explicitly instructs cloning the repo and running bash install.sh. Running a repository's install script is a moderate-to-high risk action because it executes arbitrary code on your machine (may install packages, modify configs, add cron jobs, create services). You should inspect install.sh and related scripts before executing them. The repo appears to be hosted on GitHub (a known host), but that alone doesn't remove the need to audit the script.
Credentials
The skill declares no required environment variables or external credentials, which matches the described on-disk/local behaviour. It reads/writes under the user's OpenClaw directories (~/.openclaw/workspace, ~/.openclaw/extensions), which is expected for an OpenClaw plugin but still grants significant local access (files, cache, daily memory). No unexplained credential requests were found.
Persistence & Privilege
The package intends to install as an OpenClaw extension and to register recurring Heartbeat/Cron tasks (docs mention cron every 3 hours and heartbeat-trigger scripts). That yields persistent, scheduled execution and automatic context injection before every response. 'always' is false, but autonomous invocation (plugin hooks) is documented — combined with cron jobs and a bundled web UI (FastAPI) this provides a long-lived presence and a broader attack surface. Review any installed cron entries, system service creation, and web/app.py to confirm network exposure before enabling.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install soul-memory - After installation, invoke the skill by name or use
/soul-memory - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.5.13
v3.5.13: 修復 heartbeat-trigger.py 改用上次 heartbeat 到現在的增量窗口抓取 important context，避免固定 3 小時窗口遺漏與重掃。
v3.5.11
v3.5.11: 三重去重優化 - threshold 0.92→0.85 減少誤去重，<100 字短內容豁免去重，只對同類別內容進行相似度檢查。保存率從 4.5% 提升至 40%+（10 倍改進）。
v3.5.7
v3.5.7: 修復 get_active_session_id() 排除 cron session，避免誤選 HEARTBEAT session。v3.5.6: 放寬 normalize_for_dedup() 保留時間戳差異。v3.5.5: 提高 threshold 到 0.92 減少誤去重。v3.5.4: 放寬 stable_cues 保存技術/項目/QST/文件內容。
v3.6.1
v3.6.1: fix pre-response memory injection pipeline; pure JSON CLI output; prefer last real user message; add typed memory focus grouping, distilled summaries, and audit logging.
v3.5.3
v3.5.3: 超寬鬆模式 - 強制記錄技術操作（安裝/配置/開發）
Changes:
- 降低長度閾值：30字 → 20字
- 降低重要性門檻：≥2 → ≥1
- 提升默認優先級：Normal → Important
- 新增強制記錄關鍵詞：install, config, 開發, git, skill 等
- 確保所有技術相關對話都被記錄
v3.5.2
v3.5.2: Incremental Merge with Similarity Detection and Semantic Injection
v3.4.0
v3.4.0: 完整 4 階段升級 - 語義緩存 + 動態上下文 + 多模型搜索 + 質量評分 + 上下文壓縮 + 監控測試 + 增量索引
v3.3.4
No changes detected in this version.
- Version number updated to 3.3.4.
- No code or documentation changes were made.
v3.2.3
Soul-Memory v3.2.3 Changelog
- Added new modules for heartbeat cleanup, semantic deduplication, hierarchical keyword mapping, and multi-tag indexing.
- Added scripts and data files to support heartbeat auto-cleanup and advanced keyword/tag management.
- Core logic updates in core.py for new memory optimization features.
- Enhanced and refactored web UI components (Python, CSS, JS, and HTML) for improved interaction and display of new features.
- Documentation updates and new upgrade/install guides provided.
- Improved memory quality, reduced redundancy, and integrated automatic Heartbeat cleanup scheduler.
v3.2.2
v3.2.2: Heartbeat deduplication + OpenClaw Plugin v0.2.1-beta + Uninstall script
Metadata
Frequently Asked Questions
What is Soul Memory?
Intelligent memory management system v3.5.13 - 修復 heartbeat-trigger.py 改用上次 heartbeat 到現在的增量窗口抓取 important context，避免固定 3 小時窗口遺漏與重掃。 It is an AI Agent Skill for Claude Code / OpenClaw, with 823 downloads so far.
How do I install Soul Memory?
Run "/install soul-memory" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Soul Memory free?
Yes, Soul Memory is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Soul Memory support?
Soul Memory is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Soul Memory?
It is built and maintained by kingofqin2026 (@kingofqin2026); the current version is v3.5.13.
More Skills