Openclaw Skill Session Memory

Automatically saves conversations daily with sensitive data redacted and supports fast keyword search across recent sessions.

This skill appears to do what it claims: locally save session logs and provide search with regex-based redaction. Before installing: (1) review and test the redaction rules — some patterns (very generic long-string rule) may over-redact or miss secrets; (2) be aware conversation logs are written unencrypted to ~/.openclaw/.../memory/conversations — ensure filesystem permissions and backups meet your privacy needs; (3) the package has minor implementation issues (e.g., skill.py references timedelta without importing it in one function) — test in a safe environment first and consider fixing those bugs; (4) if you need stronger protection, consider encrypting the memory directory or restricting access to the session files. If you want, I can point out the exact lines to change for the timedelta/import bug and suggest safer redaction regex adjustments.

Type: OpenClaw Skill Name: openclaw-skill-session-memory Version: 0.1.0 The OpenClaw AgentSkills skill bundle 'session-memory' is classified as benign. The Python scripts (`record.py`, `search.py`, `skill.py`) perform their stated function of recording and searching conversation history within the OpenClaw workspace (`~/.openclaw/workspace/memory/conversations` and `~/.openclaw/agents/main/sessions`). A key security feature is the extensive data redaction of sensitive information (e.g., API keys, emails, phone numbers) before storage and during search. There is no evidence of data exfiltration, unauthorized network activity, arbitrary file access, persistence mechanisms, or obfuscation. While the `SKILL.md` and `README` files provide command-line examples that could theoretically be exploited via shell injection if the OpenClaw agent's execution environment poorly sanitizes user input, this is a vulnerability in the agent's interaction layer, not an inherent flaw or malicious intent within the skill's code or documentation itself. The Python scripts safely process their `sys.argv` inputs for string comparisons.