← 返回 Skills 市场
Soul Memory
作者
kingofqin2026
· GitHub ↗
· v3.5.13
· MIT-0
823
总下载
0
收藏
3
当前安装
10
版本数
在 OpenClaw 中安装
/install soul-memory
功能描述
Intelligent memory management system v3.5.13 - 修復 heartbeat-trigger.py 改用上次 heartbeat 到現在的增量窗口抓取 important context，避免固定 3 小時窗口遺漏與重掃。
安全使用建议
This package mostly does what it claims (an OpenClaw memory plugin) but includes an install script, cron/heartbeat automation, and a bundled web UI — all of which increase risk compared with an instruction-only manifest. Before installing:
- Inspect install.sh, uninstall.sh, and heartbeat-trigger.py for commands that modify system config, create cron jobs, run as root, or contact external endpoints. Do NOT run install.sh as root until you've reviewed it.
- Search the code for network-bind/listen calls (e.g., FastAPI server in web/app.py) and for any HTTP/remote endpoints or telemetry; if a web server is enabled, lock it down or bind to localhost.
- Check for hardcoded paths (the docs reference /root/.openclaw/*) and adjust to your user home; avoid running the plugin as root.
- Backup ~/.openclaw/openclaw.json and your workspace before editing; review the plugin/openclaw.plugin.json and any steps that modify OpenClaw config.
- Consider running the install and initial tests in an isolated environment or VM first. If you want, I can list the specific files and lines to inspect (install.sh, heartbeat-trigger.py, web/app.py, plugin/index.ts, plugin/openclaw.plugin.json).
功能分析
Type: OpenClaw Skill
Name: soul-memory
Version: 3.5.13
The Soul Memory System is a sophisticated long-term memory framework that uses a 'Heartbeat' mechanism to periodically scan session logs and inject context into AI prompts. While the functionality aligns with its stated purpose, the TypeScript plugin (plugin/index.ts) contains a potential shell injection vulnerability; it executes a Python CLI command using a query string that is only minimally escaped via a regex replace. Furthermore, the FastAPI web interface (web/app.py) lacks authentication, potentially exposing sensitive conversation history if the service is accessible over a network. The use of cron jobs and instructions in HEARTBEAT.md to execute local scripts are intended features for automated memory maintenance but represent a significant privilege level for a skill bundle.
能力标签
能力评估
Purpose & Capability
Name/description, files, and SKILL.md consistently describe an OpenClaw long-term memory plugin (search/index/cache/heartbeat/plugin hook/web UI). Requested resources show no cloud credentials or unrelated binaries, which is appropriate. Minor inconsistency: SKILL metadata says 'instruction-only' (no install spec), yet the bundle contains many executable files (install.sh, uninstall.sh, web server, cron scripts) — that increases the footprint beyond a simple instruction-only skill.
Instruction Scope
Runtime instructions tell users to run bash install.sh, edit ~/.openclaw/openclaw.json, and restart the gateway. Documentation and HEARTBEAT.md reference execution of heartbeat-trigger and other Python scripts (some paths hardcoded to /root/.openclaw/workspace/...), and instructions read and write files under ~/.openclaw/workspace (e.g., memory/YYYY-MM-DD.md, cache/index.json). Those behaviors are plausible for a memory plugin, but they grant the skill read/write access to the user's OpenClaw workspace and schedule recurring jobs — this broad file/cron access is worth manual inspection. SKILL.md also indicates the plugin will automatically inject context before responses (prependContext), which means it runs during normal agent operation and can influence every response.
Install Mechanism
There is no formal install spec in the registry, but the repository includes a large install.sh (28KB) and web/start.sh/uninstall.sh. The SKILL.md explicitly instructs cloning the repo and running bash install.sh. Running a repository's install script is a moderate-to-high risk action because it executes arbitrary code on your machine (may install packages, modify configs, add cron jobs, create services). You should inspect install.sh and related scripts before executing them. The repo appears to be hosted on GitHub (a known host), but that alone doesn't remove the need to audit the script.
Credentials
The skill declares no required environment variables or external credentials, which matches the described on-disk/local behaviour. It reads/writes under the user's OpenClaw directories (~/.openclaw/workspace, ~/.openclaw/extensions), which is expected for an OpenClaw plugin but still grants significant local access (files, cache, daily memory). No unexplained credential requests were found.
Persistence & Privilege
The package intends to install as an OpenClaw extension and to register recurring Heartbeat/Cron tasks (docs mention cron every 3 hours and heartbeat-trigger scripts). That yields persistent, scheduled execution and automatic context injection before every response. 'always' is false, but autonomous invocation (plugin hooks) is documented — combined with cron jobs and a bundled web UI (FastAPI) this provides a long-lived presence and a broader attack surface. Review any installed cron entries, system service creation, and web/app.py to confirm network exposure before enabling.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install soul-memory - 安装完成后，直接呼叫该 Skill 的名称或使用
/soul-memory触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.5.13
v3.5.13: 修復 heartbeat-trigger.py 改用上次 heartbeat 到現在的增量窗口抓取 important context，避免固定 3 小時窗口遺漏與重掃。
v3.5.11
v3.5.11: 三重去重優化 - threshold 0.92→0.85 減少誤去重，<100 字短內容豁免去重，只對同類別內容進行相似度檢查。保存率從 4.5% 提升至 40%+（10 倍改進）。
v3.5.7
v3.5.7: 修復 get_active_session_id() 排除 cron session，避免誤選 HEARTBEAT session。v3.5.6: 放寬 normalize_for_dedup() 保留時間戳差異。v3.5.5: 提高 threshold 到 0.92 減少誤去重。v3.5.4: 放寬 stable_cues 保存技術/項目/QST/文件內容。
v3.6.1
v3.6.1: fix pre-response memory injection pipeline; pure JSON CLI output; prefer last real user message; add typed memory focus grouping, distilled summaries, and audit logging.
v3.5.3
v3.5.3: 超寬鬆模式 - 強制記錄技術操作（安裝/配置/開發）
Changes:
- 降低長度閾值：30字 → 20字
- 降低重要性門檻：≥2 → ≥1
- 提升默認優先級：Normal → Important
- 新增強制記錄關鍵詞：install, config, 開發, git, skill 等
- 確保所有技術相關對話都被記錄
v3.5.2
v3.5.2: Incremental Merge with Similarity Detection and Semantic Injection
v3.4.0
v3.4.0: 完整 4 階段升級 - 語義緩存 + 動態上下文 + 多模型搜索 + 質量評分 + 上下文壓縮 + 監控測試 + 增量索引
v3.3.4
No changes detected in this version.
- Version number updated to 3.3.4.
- No code or documentation changes were made.
v3.2.3
Soul-Memory v3.2.3 Changelog
- Added new modules for heartbeat cleanup, semantic deduplication, hierarchical keyword mapping, and multi-tag indexing.
- Added scripts and data files to support heartbeat auto-cleanup and advanced keyword/tag management.
- Core logic updates in core.py for new memory optimization features.
- Enhanced and refactored web UI components (Python, CSS, JS, and HTML) for improved interaction and display of new features.
- Documentation updates and new upgrade/install guides provided.
- Improved memory quality, reduced redundancy, and integrated automatic Heartbeat cleanup scheduler.
v3.2.2
v3.2.2: Heartbeat deduplication + OpenClaw Plugin v0.2.1-beta + Uninstall script
元数据
常见问题
Soul Memory 是什么？
Intelligent memory management system v3.5.13 - 修復 heartbeat-trigger.py 改用上次 heartbeat 到現在的增量窗口抓取 important context，避免固定 3 小時窗口遺漏與重掃。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 823 次。
如何安装 Soul Memory？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install soul-memory」即可一键安装，无需额外配置。
Soul Memory 是免费的吗？
是的，Soul Memory 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Soul Memory 支持哪些平台？
Soul Memory 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Soul Memory？
由 kingofqin2026（@kingofqin2026）开发并维护，当前版本 v3.5.13。
推荐 Skills