SQ Memory

Enables OpenClaw agents to store, recall, update, list, and forget persistent hierarchical memories across sessions via the SQ protocol.

What to consider before installing: - Verify configuration keys: the code and skill.json expect 'api_key' (secret) and 'endpoint' and 'namespace'. SKILL.md sometimes shows 'username'/'password' — confirm which credential your deployment requires before pasting secrets. - Do NOT store sensitive personal data in memory until you confirm transport security: the implementation encodes stored text into GET query parameters (index.js uses query string &s=...). Query-string writes can be logged by reverse proxies, web servers, or intermediaries. Prefer using an HTTPS endpoint and, if possible, modify the skill to POST data in the request body (or ask the maintainer to fix it) before storing sensitive info. - Prefer self-hosting for sensitive data: the project advertises a hosted service (mirrorborn.us). If you must store private user data, run your own SQ instance and point the skill at a localhost/HTTPS-protected endpoint. - Review and test on non-sensitive data: run the included test.js against a local SQ instance first to observe network traffic and behavior. - Inspect and/or patch the code: trivial changes would improve safety (use POST for updates, avoid including large text in URLs, normalize config key names). If you are not comfortable editing, ask the maintainer to address the GET/query-string issue and the documentation inconsistencies. - Be cautious about paste-into-system-prompt guidance: examples that suggest altering an agent's system prompt can increase the privilege of user-provided content — don't paste untrusted docs into privileged system prompts. If you want, I can point out the exact lines to change to stop sending text in URLs and to normalize config keys.

Type: OpenClaw Skill Name: sq-memory Version: 1.0.1 The OpenClaw SQ Memory skill provides persistent storage for agents by interacting with an external SQ service. The core logic in `index.js` correctly uses `encodeURIComponent` for all user-controlled inputs (coordinates, text, namespace) before constructing API requests, effectively preventing URL injection and other command injection vulnerabilities. The skill uses only built-in Node.js `http` and `https` modules, minimizing supply chain risk. Documentation and example files are clear, align with the stated purpose, and contain no evidence of prompt injection attempts against the agent or other malicious instructions. The network access and data storage capabilities are inherent to the skill's function and are implemented securely.