Memos

Create, read, update, and delete memos on a Memos instance (usememos/memos). Handles requests like "save this as a memo", "list my recent memos", "update mem...

This skill appears to do what it says (manage memos) but there are a few things to check before installing: - The SKILL.md requires a MEMOS_API_URL and MEMOS_TOKEN but the registry metadata doesn't declare any required env vars or a primary credential. Treat the access token as sensitive: only provide a token you control and understand its permissions. - The MCP entry uses 'npx openclaw-memos-mcp', which will pull code from npm at runtime. Verify the openclaw-memos-mcp package (author, version, and repository) before running it, and prefer pinned versions if possible. - There is no homepage or source listed for this skill. If you rely on this skill, ask the publisher for the upstream source (repo or package) and for a package version to audit. - Limit network exposure: ensure MEMOS_API_URL points to your intended Memos instance, and avoid using a token with broader privileges than necessary. If the publisher can update the registry metadata to declare MEMOS_TOKEN as the primaryEnv and list the required env vars (MEMOS_API_URL, MEMOS_TOKEN) and provide a source/homepage, the risk and ambiguity would be reduced.

Type: OpenClaw Skill Name: usememos Version: 0.1.9 The skill bundle is benign. It provides standard CRUD operations for a Memos instance, relying on an external `openclaw-memos-mcp` server. The `SKILL.md` file clearly outlines its purpose, configuration requirements (including sensitive API tokens via environment variables), and includes guardrails for safe operation (e.g., default private visibility, user confirmation for deletions). There is no evidence of prompt injection against the agent, data exfiltration, malicious execution, persistence mechanisms, or other harmful intent within the provided files.