High-precision memory with 100% recall accuracy for long contexts.

What to consider before installing: - Do not run this unmodified on a network-exposed machine. The sidecar's uvicorn server is configured to bind 0.0.0.0, making the unauthenticated /ingest and /search endpoints reachable from the network. Change the host to 127.0.0.1 or add authentication/firewall rules before running. - The service accepts arbitrary text for ingestion and persists it to ./memory_db. Avoid ingesting secrets or sensitive data, or add encryption/access controls to the DB. - The AUTO_INTEGRATION.md explicitly tells you to change your agent system prompt so the agent always queries and treats recall_facts as absolute truth. That can cause the agent to uncritically return stored content (including secrets) and propagate errors — think twice before making memory 'authoritative'. - Verify the skill's source repository and release integrity; INSTALL.md points at a GitHub path but the registry lists no source. Confirm the upstream project and check commit history. - Fix minor packaging issues (requirements.txt contains 'axios' which is irrelevant for Python) and review the full engine file for any hidden network calls (the provided engine file was truncated in the manifest preview). - If you intend to use this, sandbox it (container/VM) and restrict network access. Add authentication (API key, local-only socket, or mTLS) to the sidecar endpoints, or bind to localhost-only. Review and test behavior for ingestion, recall, and deletion of stored data. If you want, I can: (1) point out the exact lines that bind to 0.0.0.0 and the endpoints to change, (2) produce a minimal patch to force localhost binding and require a simple API key, or (3) review the remainder of the engine file for external network calls if you provide the truncated part.

Type: OpenClaw Skill Name: infinite-memory-v2 Version: 1.0.0 The skill bundle is classified as suspicious primarily due to a critical shell injection vulnerability in the `SKILL.md` file. The `Cmd` definitions for `recall_facts` and `memorize_data` directly embed user-controlled input (`{{query}}`, `{{filename}}`, `{{text}}`) into shell commands (`python scripts/recall.py "{{query}}"`) without apparent sanitization. If the OpenClaw agent does not sanitize these inputs before execution, an attacker could inject arbitrary shell commands. Additionally, the `memory_service.py` binds its FastAPI service to `0.0.0.0`, making it network-accessible and increasing its attack surface, though this is not inherently malicious. There is no clear evidence of intentional data exfiltration, persistence, or other malicious activities.