Neverforget

Automates Sovereign Local Vector Memory and Gemma-300M Embeddings. Manage local vector embeddings, model configuration, and memory health monitoring without...

Before installing, carefully consider the following: (1) This skill intends to index large parts of your home directory (~) and will change global OpenClaw memory settings and restart the gateway — review and backup ~/.openclaw/openclaw.json first. (2) Confirm the exclusion rules cover all places you consider sensitive; exclusions like **/.ssh/**, **/.aws/** and **/.env** are present but may be incomplete for your environment. (3) The skill will append a HEARTBEAT.md into your workspace and may follow symlinks (different files give contradictory guidance) — do not create symlinks to sensitive external stores if you want them excluded. (4) The install path uses pnpm and downloads a model from Hugging Face (and references an hf-mirror); verify network endpoints and mirror trust before allowing downloads. (5) Prefer running this skill first in an isolated account, container, or VM to observe behavior and disk usage (model downloads can be large). (6) When prompted to run the auto-install script, review the commands line-by-line and decline if you do not accept global config changes or broad indexing. If you want to proceed safely: restrict the filesystem permissions in package.json to only the specific project paths you need, remove symlink recommendations, and test indexing on a small sample directory first.

Type: OpenClaw Skill Name: neverforget Version: 1.0.4 The skill requests broad filesystem access (`~/`) for its stated purpose of 'full-environment indexing', which is a high-risk capability. However, it explicitly implements strong security measures to prevent data exfiltration by excluding sensitive directories like `~/.ssh`, `~/.aws`, `~/.env`, browser data, and GPG keys from being indexed, as seen in both `SKILL.md` and `package.json`. The install script and agent instructions in `SKILL.md` and `HEARTBEAT.md` are aligned with local memory management and reinforce these security exclusions. While the broad `~/` permission is concerning, the clear and intentional hardening against secrets exposure prevents classification as 'malicious'. The network access is limited to legitimate package and model download sites (pnpm.io, huggingface.co).