team-memory

私人团队记忆管理系统 - 记录成员观察、生成绩效报告、辅助管理决策

This skill is internally consistent for building a local team memory system: it stores and reads markdown files and its scripts only create directories/files under ~/.config/opencode/skills/team-memory. Before installing or running scripts: 1) Inspect scripts/init.sh and scripts/new-member.sh yourself (they just mkdir and write files) and run them in a non-privileged account. 2) Fix ambiguous aliases in skill-config.yaml (e.g., "ZS" appears for multiple members) to avoid misattribution. 3) Treat the data as sensitive: do not enable cloud-sync unless you intentionally want backups in a cloud service and you understand encryption/retention/consent/legal obligations for personnel data. 4) Because the package source/homepage is unknown, prefer running locally without network access and keep backups under your control; if you need long-term support, prefer a skill with a known maintainer or host the files in an internal repo. 5) If you intend to share or archive records, adopt a retention/deletion policy and document consent for recorded observations.

Type: OpenClaw Skill Name: team-memory Version: 2.3.0 The skill bundle is a team management system designed to store sensitive PII and performance observations locally. While the intent appears legitimate, the shell scripts (specifically scripts/new-member.sh) are vulnerable to path traversal and potential command injection because they do not sanitize input variables like 'NAME' when creating files or directories. Additionally, the installation instructions in README.md and scripts/init.sh rely on hardcoded paths (e.g., ~/Desktop), and the system encourages the creation of 'shadow files' containing sensitive HR-like data without any built-in encryption or access controls.