OpenClaw Memory Upgrade

Complete guide to upgrading OpenClaw's memory system for persistent, searchable context across sessions. Implements 6 upgrades including enhanced memory flus...

Before installing or applying these instructions: - Review and back up openclaw.json and any AGENTS.md files before making edits; the SKILL.md proposes global config changes. - Remove or edit the 'TECHNICAL DETAILS' category in the memoryFlush prompt so the agent does NOT capture API keys, passwords, private keys, tokens, or other secrets into persistent memory files. Storing secrets in daily logs or MEMORY.md is unsafe. - If you must use a plugin (Mem0), identify the exact npm package name and inspect its source code (or use a vetted package) before running npm install. The skill provides no install spec or trusted URL. - Run changes in a sandbox or dev environment first to observe file I/O and behaviour, and search created memory files for unintended sensitive data. - Limit autonomous invocation until you trust the configuration: consider disabling auto-run of memoryFlush or require explicit user approval for writes. - If you want to proceed, create policies or scripts that redact secrets (API keys, tokens, credentials, private endpoints) from things the agent writes to memory, and consider encrypting persistent memory storage. If you want, I can: (a) produce a redacted memoryFlush prompt that excludes secret capture, (b) generate a safe checklist for reviewing openclaw.json changes, or (c) help draft an explicit install and verification plan for the Mem0 plugin.

Type: OpenClaw Skill Name: openclaw-memory-upgrade Version: 1.0.0 The skill is classified as suspicious because SKILL.md contains explicit instructions for the agent to extract and store sensitive information, including 'API keys' and 'configs', into plain-text markdown files. This creates a significant security vulnerability by centralizing secrets in an unencrypted format. Additionally, the bundle encourages the installation of third-party plugins like @mem0/openclaw-mem0 and references a 'security audit' regarding another plugin (Cognee), which could be a tactic to establish false trust while promoting high-risk data handling practices.