Memory Core

OpenClaw 长期记忆核心：基于 LanceDB 的向量化长期记忆存储与检索，内置意图/场景隔离以防记忆污染。

This skill appears to do what it says: store and retrieve memories locally with optional cloud embeddings. Before installing, decide whether you are comfortable having memory text sent to a cloud embedding provider (default: siliconflow). If you prefer local-only operation, configure embedding_provider to 'ollama' (point to a local Ollama) or 'local_mock'. Inspect ~/.openclaw/openclaw.json because the skill will try to read it to auto-load an embedding API key and to infer agent models; if that file contains secrets you don't want accessed, remove or separate them. Confirm you are willing to install the declared Python packages and that storing the LanceDB file under the skill directory (or a configured path) is acceptable. If you need stronger guarantees, run the skill in an isolated environment or restrict outbound network access so embeddings cannot be sent to the cloud.

Type: OpenClaw Skill Name: memory-core Version: 0.1.3 The 'memory-core' skill provides vector-based long-term memory using LanceDB. It is classified as suspicious because it contains logic in scripts/config.py and scripts/memory_manager.py that programmatically reads the sensitive global OpenClaw configuration file (~/.openclaw/openclaw.json) to extract API keys and agent model metadata. While this behavior is plausibly intended for seamless integration within the OpenClaw ecosystem, the automated access to a filesystem location containing credentials constitutes a high-privilege behavior. The skill uses these keys to facilitate legitimate embedding requests to providers like SiliconFlow (api.siliconflow.cn) or OpenAI, and no evidence of intentional data exfiltration or malicious persistence was observed.