People Memories

Capture short personal notes about people you mention, store them in a lightweight DB, and recall those details whenever you ask about them later. Use when you want to remember preferences, reminders, or the context around a person without digging through past chats.

This skill largely does what its name says (local storage and recall of short notes about people), but there are some red flags you should check before installing: - Verify the full Python script for any network activity (look for 'requests', 'urllib', 'socket', 'telegram', 'bot', 'http', or similar). The SKILL.md mentions sending reminders via Telegram but the registry shows no required TELEGRAM_TOKEN — if the script tries to send messages it may read env vars or require credentials you must provide. - The package implicitly needs python3 and python-dateutil (the script imports dateutil). The skill metadata does not declare these; ensure your environment has them and consider running the script in an isolated environment (container or VM) first. - The extension auto-listens to voice-chat transcripts and will silently save captured phrases that match the 'remember <Person> <note>' pattern. If you have sensitive or private conversations, consider whether you want an always-on capture hook enabled, or disable the extension until you audit the code. - Check where the data is stored (~/.clawdbot/people-memory.json) and restrict file permissions if needed; exports can write to arbitrary out paths. - If you plan to enable reminder delivery, require the skill to explicitly document which env vars it will read and avoid providing credentials until you confirm the implementation. Prefer configuring a dedicated bot account/token with minimal permissions. Given these inconsistencies (undeclared runtime deps and a claimed network delivery path without declared credentials), treat this skill with caution — review the full Python file for network calls and tests in a sandbox before enabling auto-capture or providing any service credentials.

Type: OpenClaw Skill Name: people-memories Version: 0.1.0 The skill's functionality is clearly aligned with its stated purpose of managing personal notes about people. It uses `node:child_process.execFile` in `extensions/people-memories/index.js` to execute a Python script (`scripts/people_memory.py`), which is a common pattern for integrating multi-language components. The Python script uses `argparse` to safely handle command-line arguments, mitigating command injection risks. File operations are confined to a dedicated database file (`~/.clawdbot/people-memory.json`) and user-specified export paths (e.g., `~/Desktop/alex.md` as shown in `SKILL.md`). There is no evidence of data exfiltration, persistence mechanisms, malicious prompt injection, or obfuscation. The mention of a 'helper cron job' and Telegram delivery in `SKILL.md` describes external integrations, not functionality implemented by the skill itself.