Memory Maintenance 2.0.0

高性能记忆维护与任务执行器，实现深度分层记忆管理、异步并行优化及理性资源调度与错误处理。

This skill appears to do what its name says, but it is explicitly designed to read, extract and persist content from local memory files — including examples that target 'API 密钥' (API keys). Before installing: 1) Review the full src/execute_task.py to confirm where MEMORY_DIR/MEMORY_PATH are defined and ensure they point to safe locations; 2) Do not allow it access to directories containing secrets (credentials, ~/.aws, .env, private config) unless you intend them to be managed; 3) Consider running it in a sandboxed environment first (non-production account) and test what it reads/records; 4) Disable autonomous invocation or restrict who can invoke it until you trust it; 5) Ask the author for source/homepage and a security rationale for persisting API keys; 6) If you must store secrets, prefer platform-provided secret stores rather than plaintext memory files. If you want, I can list specific lines in the code to inspect or suggest safeguards (e.g., deny-list patterns, encryption-at-rest, and audit logging).

Type: OpenClaw Skill Name: memory-maintenance-2-0-0 Version: 2.0.0 The skill bundle is classified as suspicious due to explicit instructions in SKILL.md directing the AI agent to harvest and store sensitive information, specifically 'API keys' and 'User preferences', into a permanent plaintext markdown file (MEMORY.md). While framed as 'memory maintenance', this behavior facilitates credential harvesting and creates a significant security vulnerability. Additionally, the bundle includes complex session management logic in src/execute_task.py (e.g., process killing, session monitoring) and low-level IO optimizations (mmap, binary reads) that are disproportionate for a simple logging utility. The use of a 'little sister' persona (妹妹) in the documentation and code comments may be intended to build undue trust or mask the intrusive nature of the data collection.