← 返回 Skills 市场

AOI Triple Memory (Lite)

Name: AOI Triple Memory (Lite)
Author: edmonddantesj

作者 edmonddantesj · GitHub ↗ · v0.1.2

cross-platform ⚠ suspicious

891

总下载

当前安装

版本数

在 OpenClaw 中安装

/install aoi-triple-memory-lite

功能描述

AOI Triple Memory (Lite) — file search + decision notes templates (no plugins).

使用说明 (SKILL.md)

AOI Triple Memory (Lite)

S-DNA: AOI-2026-0215-SDNA-MEM01

What this is

A public-safe, plugin-free memory stack:

Provenance / originality

AOI implementation is original code (no third-party code copied).
Conceptually inspired by common “multi-layer memory” ideas (file notes + search + structured decisions).

File-based memory: MEMORY.md + memory/YYYY-MM-DD.md
Decision notes: structured context/ notes with tags
Fast search: ripgrep-based search across workspace

What this is NOT

No external embeddings DB
No automatic capture plugins
No syncing to other machines

Commands

Search workspace

aoi-memory search --q "Tempo Hackathon" --n 20

Create a decision note (template)

aoi-memory new-note --title "Royalty rail decision" --tag royalty,base,usdc

Governance snippet (public)

We publish AOI skills for free and keep improving them. Every release must pass our Security Gate and include an auditable changelog. We do not ship updates that weaken security or licensing clarity. Repeated violations trigger progressive restrictions (warnings → publish pause → archive).

Support

Issues / bugs / requests: https://github.com/edmonddantesj/aoi-skills/issues
Please include the skill slug: aoi-triple-memory-lite

License

MIT

安全使用建议

This skill is largely what it claims to be (search + note templates), but check a few things before installing/using: 1) The code relies on the 'rg' (ripgrep) binary for searches, but the registry metadata says no binaries are required — ensure 'rg' is installed or searches will fail. 2) The search command reads all files under your workspace and prints matching lines/paths; do not run it in a directory containing secrets or sensitive configs unless you understand the output will include those matched lines. 3) The skill writes new notes into ./context in whatever workspace root is used (WORKSPACE env or current directory) — verify that location is acceptable. 4) No network access or credentials are requested, and there are no remote installs, so risk is limited to local file I/O; if you trust the code (you can review skill.js), it's probably safe to use in non-sensitive projects. If you want higher assurance, ask the author to update metadata to declare the 'rg' requirement or modify code to fallback to a pure-Node search if 'rg' is unavailable.

功能分析

Type: OpenClaw Skill Name: aoi-triple-memory-lite Version: 0.1.2 The `skill.js` file contains a command option injection vulnerability in its `search` function. The user-provided query (`--q`) is passed directly to the `rg` (ripgrep) command via `node:child_process.spawnSync` without adequate sanitization. While `spawnSync` with an array of arguments generally prevents shell injection, a malicious query could still inject `rg`-specific options (e.g., `--files`, `--max-depth`, or potentially `--exec`) to alter the command's behavior or, in a worst-case scenario, lead to arbitrary command execution. There is no evidence of intentional malicious behavior like data exfiltration or backdoors, but this vulnerability poses a significant risk.

能力评估

⚠ Purpose & Capability

Name/description, SKILL.md, and code all align on two features: workspace search and creating decision-note templates. However, the code calls the external 'rg' (ripgrep) binary for search while the registry metadata / requirements claim no required binaries. That is an internal inconsistency (the skill effectively requires 'rg').

ℹ Instruction Scope

SKILL.md and the binary behavior match: search runs ripgrep across the workspace and new-note writes a markdown file into ./context. The instructions do not reach outside the workspace or network. Note: search will read all files under the workspace and output matching lines — running this in a repo with secrets could expose sensitive content in the command output.

✓ Install Mechanism

No install spec or remote downloads are present. The package is instruction-only with a local executable (skill.js) and no external dependencies — low install risk.

ℹ Credentials

The skill does not request credentials or environment variables, only optionally uses WORKSPACE (or cwd) as the root. This is proportionate, but because it reads files under the workspace and prints matches, users should be aware it can surface sensitive file contents if run in a sensitive directory.

✓ Persistence & Privilege

The skill is not always-enabled and does not modify other skills or system-wide settings. It writes files only under the workspace 'context/' directory (expected for a note-taking tool).

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install aoi-triple-memory-lite
安装完成后，直接呼叫该 Skill 的名称或使用 /aoi-triple-memory-lite 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.2

Docs: add GitHub Issues support link (aoi-skills).

v0.1.1

Docs: add provenance/originality statement (no third-party code copied).

v0.1.0

Initial plugin-free memory stack: rg search + decision note template. MIT.

元数据

Slug aoi-triple-memory-lite

版本 0.1.2

许可证 —

累计安装 0

当前安装数 0

历史版本数 3

常见问题