5-layer persistent memory and coherence architecture for OpenClaw agents. Solves AI amnesia and within-session drift. Built and validated over 353 sessions o...

Things to consider before installing or letting the agent 'auto-install': - Metadata vs reality: The registry lists no required env vars or binaries, but the SKILL.md and docs require an LLM API key (or specific NVIDIA Developer key), a Gemini API key, npm tooling, and will copy/run Python scripts — treat the registry omission as a red flag and expect to provide secrets. - Secrets exposure: You will be asked for at least one LLM API key and (per the docs) a Gemini API key. Only provide keys you control, and consider creating scoped/limited keys or ephemeral credentials where possible. Do not reuse high-privilege or long-lived master keys. - Review code first: The package contains scripts that read session JSONL logs and write to BOOT_CONTEXT.md and other Vault files; review SENTINEL templates, coherence_monitor.py, and reconcile_memory.py before running them. Prefer manual execution in a sandbox/VM first. - Avoid automatic 'paste-to-agent' installs: The 'Path 2 — Let your agent handle it' flow would let an agent modify your filesystem and install software. If you lack strong trusts or auditing, use the manual Path 1 and follow SETUP_HUMAN.md step-by-step instead. - Backup your Vault and configs: Before running any install, back up your Vault (CORE_MEMORY.md, SOUL.md, workspace/*) and openclaw config. If SENTINEL or reconcile runs write unexpected content, you can recover. - Limit network access where feasible: The design is 'local-first' but uses external reconciliation (Gemini). If you want strictly local operation, audit and disable reconcile steps that call external APIs. - Prefer least privilege: For Telegram/OpenClaw gateway tokens create dedicated tokens with narrow scopes and restrict network exposure. Monitor created files (reanchor_pending.json, BOOT_CONTEXT.md) for unexpected content. - What would reduce my concern: registry metadata that accurately lists required env vars and binaries, a published homepage or verified source, an install spec (package or signed release) instead of manual copy steps, and explicit notes about what network calls the nightly reconcile makes (endpoints, data sent).

Type: OpenClaw Skill Name: adam-framework Version: 1.0.1 The Adam Framework is a complex memory persistence system that requires and configures extremely high-privilege access to the host environment. Key indicators include the configuration of the 'desktop-commander' MCP server (engine/mcporter.template.json), which grants the AI agent full terminal and filesystem access, and the 'SENTINEL' watchdog scripts (engine/SENTINEL.template.sh) that manage local processes and system-level persistence via scheduled tasks or cron jobs. Additionally, the bundle includes a script (tools/update_live_stats.py) that performs automated 'git push' operations, posing a risk of accidental credential or data exposure. While these capabilities are aligned with the stated goal of creating a 'persistent memory architecture,' the combination of broad system access and instructions for the AI to perform its own high-privilege setup (SETUP_AI.md) creates a significant security risk without clear evidence of intentional malice.