Ourmem

Shared memory that never forgets. Cloud hosted or self-deployed. Collective intelligence for AI agents with Space-based sharing across agents and teams. Use...

What to consider before installing: - Metadata omission: The skill's registry entry claims no required credentials, but its docs and verify.sh require an API key (OMEM_API_KEY) and API URL. Treat the skill as one that needs a secret — the metadata should have declared this. Ask the publisher to correct the metadata. - Never share API keys: The docs' recommended sharing mechanism (passing another user's API key as target_user) is insecure: an API key is equivalent to full access to that tenant/space. Do not share API keys between users; prefer explicit, audited access controls or invitation flows. If asked to enter someone else's API key, decline. - Verify source & packages before running install steps: the docs reference npm packages and GHCR images (@ourmem/*, ghcr.io/ourmem). Confirm the publisher's identity, check the npm/ghcr package owners, inspect package content and Docker image layers, and prefer pinned releases (not 'latest') and checksums. - Be cautious when writing credentials to config files: the setup commands modify ~/.claude/settings.json, openclaw.json, opencode.json, and other client configs. Ensure those files are backed up and that you understand where you are storing secrets on disk (use least-privileged keys, not long-lived org-wide keys). - If self-hosting, isolate the service: run on a dedicated VM/container, review Docker images and binaries from the GitHub releases page, and avoid enabling cloud embedding/storage (Bedrock / S3 / OSS) unless you understand which cloud credentials are needed. - Audit code before trusting the hosted endpoint: there is no homepage or canonical source listed in the registry metadata. Request the public repo / homepage, inspect the repo and server code (or use self-hosted builds you built yourself) and confirm privacy/security policies before sending production or sensitive data to api.ourmem.ai. - Practical mitigations: use per-plugin/test API keys you can rotate, restrict the keys' scope if the service supports it, do not put secrets into shared or world-readable config files, and run the provided verify.sh only after ensuring the OMEM_API_KEY/URL point to a trusted server.

Type: OpenClaw Skill Name: ourmem Version: 1.1.1 The 'ourmem' skill bundle provides persistent memory by exfiltrating conversation data and extracted facts to an external service (api.ourmem.ai). It instructs the AI agent to perform high-risk operations, including executing shell commands to modify sensitive configuration files (e.g., ~/.claude/settings.json, openclaw.json) and installing external plugins via npx/npm. While these actions align with the stated purpose of cross-session memory and the bundle includes self-hosting options, the requirement for broad file system access, automated environment modification, and the transmission of user data to a third-party API represents a significant security risk and attack surface.