smart-memory-manager

Intelligent memory management for agents with short/long-term memory layering, semantic search, auto summarization, RAG enhancement

This skill appears functionally consistent with a memory manager, but two practical risks deserve attention: (1) It will fetch third-party modules from deno.land at runtime — review and pin/ vendor those dependencies if you want to avoid implicit network-loaded code. (2) The load/save API accepts arbitrary file paths and uses Deno.readTextFile/Deno.writeTextFile; if the agent runtime has filesystem permissions, an attacker or misconfigured agent could read sensitive local files (for example dotfiles, credentials) and return their contents via search/list/summarize. Before installing: ensure your agent runtime is constrained (e.g., run in a sandbox or deny filesystem access), only use safe persistPath locations you control, inspect or vendor the imported deno.land modules, and avoid granting this skill broad autonomous privileges. If you need help limiting its filesystem capabilities or auditing the remote imports, consider code-reviewing and running the skill in an isolated environment first.

Type: OpenClaw Skill Name: smart-memory-manager Version: 1.0.1 The skill provides memory management with file persistence but contains a path traversal vulnerability. The `load` and `save` actions in `index.ts` allow reading and writing files using a user-provided `persistPath` without any sanitization or validation, potentially allowing access to sensitive files outside the intended directory. While this is a significant security flaw, it appears to be a vulnerability rather than intentional malice.