MemVault

Production-ready long-term memory server for AI agents with Ebbinghaus decay and strength-weighted retrieval. Use when you need persistent memory across agen...

This package is functionally consistent with a self‑hosted long‑term memory server, but take caution before running the installer. Review scripts/install.sh and avoid blindly running curl | sh from the network; consider installing Ollama manually or configuring MEMVAULT_LLM_BASE_URL to a known local endpoint. Update the default DB password (postgres/postgres) and confirm where MEMVAULT_LLM_BASE_URL points — if you set it to a cloud LLM (OpenAI/Groq), your stored memories will be transmitted to that provider. If you must test, run inside an isolated environment (VM/container) and inspect docker-compose and Dockerfile builds so you can audit downloaded models and packages. If you want lower risk, you can skip the auto‑installer and manually start the docker-compose build after reviewing files.

Type: OpenClaw Skill Name: memvault Version: 1.0.3 The skill is classified as suspicious due to multiple vulnerabilities. The `scripts/install.sh` uses `curl -fsSL https://ollama.com/install.sh | sh` for Ollama installation, which is a supply chain risk as it executes unreviewed remote code. More critically, `scripts/memvault.sh` is vulnerable to shell injection, as the `user_id` parameter in `decay` and `stats` commands is directly interpolated into `curl` URLs without proper shell escaping, potentially allowing arbitrary command execution. Additionally, `memvault_server.py` has a potential LLM prompt injection vulnerability in its translation function, where LLM-generated summaries could theoretically manipulate a local LLM.