← 返回 Skills 市场
TruContext OpenClaw
作者
AlphaCollectiveLLC
· GitHub ↗
· v0.1.9
· MIT-0
134
总下载
0
收藏
0
当前安装
5
版本数
在 OpenClaw 中安装
/install trucontext-openclaw
功能描述
TruContext persistent memory for OpenClaw agents. Use when you need to remember something significant across sessions, recall prior context, query the knowle...
安全使用建议
This skill is a straightforward wrapper around the TruContext CLI and behaves as described. Before installing: (1) ensure you trust trucontext.ai — any text you 'ingest' will be sent to the TruContext service; avoid sending secrets or credentials. (2) The skill reads ~/.trucontext/openclaw-state.json and relies on the TruContext CLI's auth file; authenticate separately with `npx trucontext login`. (3) Installation uses npm; review the npm package if you want to confirm there are no hidden behaviors. (4) The included python -c usage is a brittle way to parse the state file (may break on unusual paths) but not an obvious exfiltration vector. If you need more assurance, review the npm package source on the referenced GitHub repo and confirm the CLI binary it calls is the official TruContext CLI.
功能分析
Type: OpenClaw Skill
Name: trucontext-openclaw
Version: 0.1.9
The skill contains a critical command injection vulnerability in `scripts/trucontext-openclaw.sh`. The `resolve_config` function unsafely interpolates the current working directory (`$cwd`) into a Python command string executed via `python3 -c`, which allows for arbitrary code execution if an agent is active in a directory with a specially crafted name (e.g., containing single quotes and Python code). While the skill's stated purpose of providing persistent memory via the `trucontext.ai` service appears legitimate, this implementation flaw poses a significant security risk.
能力评估
Purpose & Capability
Name/description match behavior: the skill is a wrapper around the TruContext CLI and requires the trucontext CLI and python3 to resolve state. Required binaries and the npm install are appropriate for a TruContext OpenClaw integration.
Instruction Scope
SKILL.md and the shell script limit actions to reading ~/.trucontext/openclaw-state.json, calling the trucontext CLI, and invoking tc-memory verbs. The skill instructs the agent to call recall at session start (expected for memory agents). It does not read unrelated system files or exfiltrate data to unexpected endpoints, but any ingested text will be sent to the TruContext service (intended behavior).
Install Mechanism
Install is an npm package (trucontext-openclaw) which is proportionate for shipping a small CLI wrapper. No downloads from unknown URLs or archive extraction are present in the provided files.
Credentials
The skill does not request environment variables or unrelated credentials. It reads the TruContext state and relies on the TruContext CLI's credentials file (~/.trucontext/credentials.json), which is appropriate for a CLI-based integration. Users should avoid ingesting secrets into memory.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide agent settings. It runs as a normal user-level wrapper and depends on the installed CLI and state file.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install trucontext-openclaw - 安装完成后，直接呼叫该 Skill 的名称或使用
/trucontext-openclaw触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.9
Fix cron rm response check, handle paginated cron list JSON
v0.1.8
Add homepage and source repo links
v0.1.7
Declare state file and TC auth usage in SKILL.md for ClawHub transparency
v0.1.6
Auth expiry detection, python3 requirement, spawnSync for shell safety
v0.1.4
Initial ClawHub publish. Persistent knowledge graph memory for all OpenClaw agents.
元数据
常见问题
TruContext OpenClaw 是什么？
TruContext persistent memory for OpenClaw agents. Use when you need to remember something significant across sessions, recall prior context, query the knowle... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 134 次。
如何安装 TruContext OpenClaw？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install trucontext-openclaw」即可一键安装，无需额外配置。
TruContext OpenClaw 是免费的吗？
是的，TruContext OpenClaw 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
TruContext OpenClaw 支持哪些平台？
TruContext OpenClaw 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 TruContext OpenClaw？
由 AlphaCollectiveLLC（@alphacollectivellc）开发并维护，当前版本 v0.1.9。
推荐 Skills