Smart Memory System

基于检索增强技术，实现语义搜索、记忆优化与对话增强，显著降低 token 消耗并提升检索准确率。

This package looks like an unfinished or poorly packaged skill rather than outright malicious code, but there are multiple red flags you should address before installing: (1) Missing implementations — many scripts referenced in index.js/package.json are not present, so commands will fail. (2) Inconsistent model settings — vector dimensionality differs between files (1024 vs 384); verify the correct model and dims before indexing. (3) Undeclared credentials — SKILL.md asks for an Edgefn API key but the skill metadata does not declare required env vars; do not provide credentials until you confirm where they will be used and stored. (4) Missing install hooks — package.json references install/uninstall scripts that don't exist. Recommended actions: inspect the upstream repository (request a canonical source URL), ask the author to provide the missing scripts and clarify credential usage, run the init and other operations in a sandbox or non-privileged account first, and avoid supplying API keys or broad permissions until the code is complete and reviewed. If you cannot validate the repository and author, treat this as untrusted and do not install on production systems.

Type: OpenClaw Skill Name: smart-memory-system Version: 0.1.0 The skill implements a RAG-based memory system that requires significant file system access, including the ability to batch-process arbitrary user directories (e.g., ~/documents/) as seen in SKILL.md. While these capabilities are plausibly needed for the stated purpose, they represent a high-risk attack surface for data exfiltration if the agent is manipulated. Furthermore, several core logic files (retriever.js, vectorizer.js, and integrator.js) are missing from the bundle, making it impossible to verify if the system properly sanitizes paths or restricts memory processing to safe locations.