摇摇记忆系统

支持多层次记忆管理和标签分类，实现跨会话检索、持久化存储、定期整理及与IMA知识库双向同步。

This skill implements local memory files plus an IMA sync script that will upload workspace documents to https://ima.qq.com/ using an IMA client_id and api_key. However, the registry metadata did not declare those required credentials. Before installing: 1) Treat the IMA sync as a potential data-exfiltration path — don't enable syncing if your workspace may contain sensitive data. 2) Inspect or create config.json and set knowledge_sync.enabled to false unless you intend to sync; verify the notes_mapping IDs. 3) If you will use sync, supply credentials only if you trust the IMA endpoint and understand what files will be uploaded. 4) Run the skill in a sandbox or with non-sensitive example files first. 5) Preferably ask the publisher for provenance (homepage, source repo) or request that required env vars be declared in the registry metadata.

Type: OpenClaw Skill Name: yaoyaoya-memory Version: 1.0.0 The skill implements a memory persistence and synchronization system that manages sensitive information, including user profiles, project decisions, and daily logs. It is classified as suspicious because it includes hardcoded, specific third-party Note IDs (e.g., '7445750904545580') in both `scripts/sync_ima.py` and `SKILL.md`. If these IDs are globally unique within the IMA platform, a user who configures their own API keys but fails to update the mapping would inadvertently transmit their private data to the author's documents. While the network activity to `ima.qq.com` is the stated purpose of the skill, the use of specific default destination IDs for sensitive data constitutes a significant privacy and data leakage risk.