Memory Plus Sync

实现飞书、微信、Telegram 等多渠道消息采集与同步，统一存储到官方 SQLite，支持实时监控、告警及自动恢复。

This skill appears to implement the advertised multi-channel sync and monitoring features, but exercise caution before installing: - Metadata omission: Although the registry claims 'no required env vars / zero-config', the code reads cloud-model API keys (KIMI/QWEN/GLM/DEEPSEEK) and ~/.openclaw/openclaw.json; if you have sensitive API keys in that file or environment, the skill can use them to call external services. Expect external network calls if validator/scorer/reviewer features are enabled. - Network exposure: mcp_server.py exposes HTTP endpoints (documentation shows binding to 0.0.0.0). If you run the server, bind it to localhost or protect it with a firewall/authentication if you don't want external access. - Local file access: The skill will read and write files under ~/.openclaw, ~/.hermes, and ~/.shared-memory and may create logs, backups, and cron jobs (install.sh/setup_env.sh exist). Back up your MEMORY.md and SQLite DB before first run. - Inspect install scripts: Do not run install.sh or setup_env.sh without reviewing their contents. If you plan to install, run in an isolated environment (VM or container) first and inspect what they modify (crontab, file permissions, created services). - Credential hygiene: If you do not want the skill to call remote models, make sure no model API keys are present in env or openclaw.json, or disable validator/arbiter features in config. Consider running with network disabled for initial testing. - Recommended steps: 1) Review install.sh and setup_env.sh; 2) Search code for any outbound endpoints (OpenAI/OpenAI-compatible base URLs are used) and decide whether to provide API keys; 3) Run the skill in a sandboxed user account or container; 4) Limit server binding to localhost and add authentication if exposing it; 5) Backup ~/.openclaw and ~/.hermes before first sync. Given these discrepancies (undeclared env usage, network-exposed server, install scripts), the package is coherent with its advertised function but carries non-trivial operational risk — treat it as 'suspicious' until you verify and sandbox it.

Type: OpenClaw Skill Name: memory-plus-sync Version: 2.0.0 This skill bundle implements a comprehensive memory synchronization and management system for OpenClaw, featuring MCP server integration, multi-agent validation (Validator/Scorer/Reviewer), and cross-channel message collection from platforms like Feishu and Telegram. The code interacts with various LLM APIs (Kimi, Qwen, DeepSeek) and manages local SQLite and vector databases for memory storage and deduplication. While it performs sensitive actions such as reading API keys from `~/.openclaw/openclaw.json`, accessing local chat histories, and establishing persistence via cron jobs, these behaviors are well-documented and strictly aligned with the stated purpose of providing an advanced memory sync utility. No evidence of malicious intent, unauthorized data exfiltration, or obfuscation was found.