Openclaw Memories

Agent memory with ALMA meta-learning, LLM fact extraction, and full-text search. Observer calls remote LLM APIs (OpenAI/Anthropic/Gemini). ALMA and Indexer w...

This package implements a local meta-learning optimizer and local file indexer plus an Observer that calls third-party LLM APIs. Before installing: (1) be aware the Observer will send conversation text to external LLM endpoints — only provide API keys you trust and scope them appropriately; (2) the registry metadata does not declare the required env vars (OPENAI_API_KEY / ANTHROPIC_API_KEY or passing apiKey), so the platform may not prompt you to supply them — you must supply a key in config or env; (3) the indexer reads Markdown files from whatever workspace path you give it, so point it only at directories you intend it to index; (4) if you need Gemini support, confirm how you will supply the Google key (the SKILL.md omits a named env var); (5) consider testing in a sandboxed environment first and review the upstream GitHub repo (author/email present) for additional context. These are coherence/visibility issues rather than evidence of malicious behavior, but they matter for secure operation.

Type: OpenClaw Skill Name: openclaw-memory-2 Version: 2.0.1 The skill is classified as suspicious due to its file system access capabilities in `src/indexer.ts` (`readFileSync`, `readdirSync`). While intended for indexing 'workspace Markdown files', if the `workspace` parameter is not properly sanitized or constrained by the OpenClaw agent runtime, a malicious prompt could instruct the agent to index and potentially read arbitrary files outside the intended scope (e.g., `/etc`, `~`). Additionally, `src/observer.ts` makes network calls to external LLM APIs (OpenAI, Anthropic, Gemini) and reads API keys from environment variables, which is a high-risk capability, though it is explicitly stated and necessary for the skill's core function and targets legitimate endpoints. There is no evidence of intentional data exfiltration to unauthorized parties, backdoors, or prompt injection attempts within the `SKILL.md` itself.