← 返回 Skills 市场

Agent Memory Store

Name: Agent Memory Store
Author: kgnvsk

作者 Oleksii Kaganovsky · GitHub ↗ · v1.2.0

cross-platform ⚠ suspicious

3121

总下载

当前安装

版本数

在 OpenClaw 中安装

/install agent-memory-store

功能描述

Shared semantic memory store for AI agents. Store, search, and retrieve memories across agents with TTL decay. SQLite persistence — survives restarts.

使用说明 (SKILL.md)

Agent Memory Store

Cross-agent semantic memory with TTL decay. SQLite-backed — data survives restarts.

Start

python3 scripts/memory_store.py
# Runs on port 8768, DB: /root/.openclaw/workspace/data/agent_memory.db

Quick Start

# Store a memory
curl -X POST http://localhost:8768/memories \
  -H "Content-Type: application/json" \
  -d '{"owner":"my-agent","content":"user prefers SOL payments","ttl_seconds":86400,"public":false}'

# Search memories
curl "http://localhost:8768/memories?q=payment+preferences&agent=my-agent"

# List all (with agent filter)
curl "http://localhost:8768/memories?agent=my-agent&limit=20"

Endpoints

Method	Path	Description
GET	/health	status + memory count
POST	/memories	store memory `{owner, content, tags?, ttl_seconds?, public?}`
GET	/memories?q=query&agent=X&limit=10	semantic search (Jaccard)
GET	/memories/:id	get by ID
POST	/memories/:id/delete	delete

Changelog

v1.1.0

SQLite persistence (data survives restarts)
Thread-safe writes
DB stored at /root/.openclaw/workspace/data/agent_memory.db

v1.0.0

Initial release: in-memory store, TTL, cross-agent sharing, Jaccard search

Install

clawhub install agent-memory-store

安全使用建议

What to consider before installing: - The skill will run an HTTP server on port 8768 bound to 0.0.0.0 with no authentication. Anyone who can reach that port can read, add, or delete memories. Restrict network access (firewall, host-only binding) or add auth if you plan to run it. - The code will create and write a SQLite DB at /root/.openclaw/workspace/data/agent_memory.db. That file will persist between restarts; treat it as containing potentially sensitive data and secure backups/permissions accordingly. - If you set OPENAI_API_KEY (not declared in metadata), the service will call OpenAI's embeddings API and send memory text to api.openai.com (privacy, cost, and data-exfil risks). Only provide the key if you understand these implications. - Recommended mitigations: run in an isolated environment, bind the server to localhost or use a reverse proxy with authentication, inspect or modify the code to add authentication/rate-limiting, and avoid storing PII or secrets as memories. If you need embedding disabled, start the service without OPENAI_API_KEY to use the fallback Jaccard search. - Summary judgement: functionally coherent with its stated purpose, but the undeclared use of an external API key and the unauthenticated, network-exposed server are security-relevant mismatches — review and harden before use.

功能分析

Type: OpenClaw Skill Name: agent-memory-store Version: 1.2.0 The OpenClaw skill 'agent-memory-store' provides a local HTTP API for semantic memory storage, using SQLite for persistence and optionally OpenAI for embeddings. The code uses parameterized SQL queries, handles API keys securely via environment variables, and makes a legitimate external call to `api.openai.com` for its core functionality. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md` or the Python code. The `homepage` URL in `SKILL.md` is metadata and not interacted with by the skill's logic.

能力评估

ℹ Purpose & Capability

The code implements a cross-agent memory store with TTL and SQLite persistence, matching the name/description. However the implementation optionally calls OpenAI embeddings (text-embedding-3-small) via the OPENAI_API_KEY environment variable while the skill metadata declared no required env vars — this is an inconsistency that affects privacy/costs but not the core purpose.

⚠ Instruction Scope

SKILL.md instructs running python3 scripts/memory_store.py which launches an HTTP service and provides curl examples. The server listens on 0.0.0.0:8768 and exposes endpoints to create, search, list, and delete memories with no authentication or access controls. That means any process that can reach that socket can read/write stored memories (including potentially sensitive content). The SKILL.md does not warn about authentication, network exposure, or data sensitivity.

✓ Install Mechanism

No install spec (instruction-only) and a single Python script are provided. There is no external download or package install; risk from installation mechanism is low. Running the script will create directories and the SQLite DB file in the agent workspace.

⚠ Credentials

The skill metadata lists no required environment variables, but the code reads OPENAI_API_KEY to enable embedding lookups and makes outbound calls to api.openai.com. This is a mismatch: the OPENAI_API_KEY is optional in code but absent from the declared requirements. If provided, the key will be used (incurring network calls, costs, and potential exposure of memory content to OpenAI).

ℹ Persistence & Privilege

The skill is not marked always:true and doesn't request elevated platform privileges. It creates and writes a DB at /root/.openclaw/workspace/data/agent_memory.db (within the agent workspace) which persists across restarts. The server binds to 0.0.0.0 (network-exposed) which increases blast radius even though it does not change other skills' configs.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install agent-memory-store
安装完成后，直接呼叫该 Skill 的名称或使用 /agent-memory-store 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.2.0

OpenAI text-embedding-3-small semantic search. Falls back to Jaccard if no API key. DB migration for existing installs.

v1.1.0

SQLite persistence — data survives restarts. Thread-safe writes.

元数据

Slug agent-memory-store

版本 1.2.0

许可证 —

累计安装 21

当前安装数 21

历史版本数 2

常见问题