← Back to Skills Marketplace
TruContext OpenClaw
by
AlphaCollectiveLLC
· GitHub ↗
· v0.1.9
· MIT-0
134
Downloads
0
Stars
0
Active Installs
5
Versions
Install in OpenClaw
/install trucontext-openclaw
Description
TruContext persistent memory for OpenClaw agents. Use when you need to remember something significant across sessions, recall prior context, query the knowle...
Usage Guidance
This skill is a straightforward wrapper around the TruContext CLI and behaves as described. Before installing: (1) ensure you trust trucontext.ai — any text you 'ingest' will be sent to the TruContext service; avoid sending secrets or credentials. (2) The skill reads ~/.trucontext/openclaw-state.json and relies on the TruContext CLI's auth file; authenticate separately with `npx trucontext login`. (3) Installation uses npm; review the npm package if you want to confirm there are no hidden behaviors. (4) The included python -c usage is a brittle way to parse the state file (may break on unusual paths) but not an obvious exfiltration vector. If you need more assurance, review the npm package source on the referenced GitHub repo and confirm the CLI binary it calls is the official TruContext CLI.
Capability Analysis
Type: OpenClaw Skill
Name: trucontext-openclaw
Version: 0.1.9
The skill contains a critical command injection vulnerability in `scripts/trucontext-openclaw.sh`. The `resolve_config` function unsafely interpolates the current working directory (`$cwd`) into a Python command string executed via `python3 -c`, which allows for arbitrary code execution if an agent is active in a directory with a specially crafted name (e.g., containing single quotes and Python code). While the skill's stated purpose of providing persistent memory via the `trucontext.ai` service appears legitimate, this implementation flaw poses a significant security risk.
Capability Assessment
Purpose & Capability
Name/description match behavior: the skill is a wrapper around the TruContext CLI and requires the trucontext CLI and python3 to resolve state. Required binaries and the npm install are appropriate for a TruContext OpenClaw integration.
Instruction Scope
SKILL.md and the shell script limit actions to reading ~/.trucontext/openclaw-state.json, calling the trucontext CLI, and invoking tc-memory verbs. The skill instructs the agent to call recall at session start (expected for memory agents). It does not read unrelated system files or exfiltrate data to unexpected endpoints, but any ingested text will be sent to the TruContext service (intended behavior).
Install Mechanism
Install is an npm package (trucontext-openclaw) which is proportionate for shipping a small CLI wrapper. No downloads from unknown URLs or archive extraction are present in the provided files.
Credentials
The skill does not request environment variables or unrelated credentials. It reads the TruContext state and relies on the TruContext CLI's credentials file (~/.trucontext/credentials.json), which is appropriate for a CLI-based integration. Users should avoid ingesting secrets into memory.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide agent settings. It runs as a normal user-level wrapper and depends on the installed CLI and state file.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install trucontext-openclaw - After installation, invoke the skill by name or use
/trucontext-openclaw - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.9
Fix cron rm response check, handle paginated cron list JSON
v0.1.8
Add homepage and source repo links
v0.1.7
Declare state file and TC auth usage in SKILL.md for ClawHub transparency
v0.1.6
Auth expiry detection, python3 requirement, spawnSync for shell safety
v0.1.4
Initial ClawHub publish. Persistent knowledge graph memory for all OpenClaw agents.
Metadata
Frequently Asked Questions
What is TruContext OpenClaw?
TruContext persistent memory for OpenClaw agents. Use when you need to remember something significant across sessions, recall prior context, query the knowle... It is an AI Agent Skill for Claude Code / OpenClaw, with 134 downloads so far.
How do I install TruContext OpenClaw?
Run "/install trucontext-openclaw" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is TruContext OpenClaw free?
Yes, TruContext OpenClaw is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does TruContext OpenClaw support?
TruContext OpenClaw is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created TruContext OpenClaw?
It is built and maintained by AlphaCollectiveLLC (@alphacollectivellc); the current version is v0.1.9.
More Skills