by 安全扫描
OpenClaw
可疑
high confidenceThe skill's declared purpose (Supabase-backed MCP memory server) mostly matches its files, but it asks for a highly privileged Supabase service key, references external services (Claude, Solana, social/tokens) without declaring required credentials, and instructs installing an unreferenced npm package — these mismatches warrant caution.
评估建议
This skill is not obviously malicious but has several red flags. Before installing: (1) Do not provide your SUPABASE_SERVICE_KEY unless you trust the code — that key grants full DB access; prefer a scoped DB role. (2) Ask the author for full source for the missing modules (../core/*, ../config) and for a repository/homepage. (3) Clarify where Claude and Solana credentials are expected and what on-chain actions (and fees) will occur; do not use a real wallet/private key in testing. (4) Inspect th...详细分析 ▾
⚠ 用途与能力
Name/description describe a Supabase + pgvector memory MCP — requiring node and SUPABASE_URL + SUPABASE_SERVICE_KEY is expected. However the code and SKILL.md also reference actions that require additional credentials (Claude API calls, on-chain Solana commits, handling token/tweet events) but no corresponding environment variables are declared. The skill therefore asks for high-privilege DB access while omitting other credentials it clearly needs.
⚠ 指令范围
SKILL.md instructs installing 'clude-bot' and setting SUPABASE_URL/SUPABASE_SERVICE_KEY, and documents features that will call Claude and commit hashed memories to Solana. The instructions do not disclose that conversational content will be persisted, potentially sent to an LLM (Claude), and committed (hashed) on-chain (which can be irreversible and cost SOL). The runtime code returns full memory content in tool outputs, so sensitive user data could be stored and transmitted; the SKILL.md does not warn or require consent or list additional env keys.
ℹ 安装机制
There is no automated install spec (lower automated risk). But SKILL.md tells users to run 'npm install clude-bot' — an external package name with no homepage/source in the registry metadata. Installing that package would execute remote code from npm (moderate risk). Also included server.ts imports many local modules (../core/*, ../config) that are not present in the bundle, suggesting incomplete packaging or hidden dependencies that would need to be fetched.
⚠ 凭证需求
The skill requires SUPABASE_SERVICE_KEY: a powerful service_role key that grants full DB access (read/write and bypasses RLS). For a server process this can be justified, but it is high privilege and should be minimized or scoped. The skill also clearly needs other secrets (LLM API key, Solana signer or RPC credentials) that are not declared — omission of these sensitive envs is a mismatch and increases risk because hidden secrets usage could be required or added later.
ℹ 持久化与权限
The skill does not request 'always: true' and does not appear to change other skills or global agent settings. However it stores persistent user/agent memories in a database and may autonomously commit hashes on-chain and call external LLMs. Autonomous invocation combined with a Supabase service key increases the blast radius if misused — consider restricting runtime privileges and authorizations.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/23
Initial release — 4-tier cognitive memory system with recall, store, stats, mood, and ask tools
● 无害
安装命令 点击复制
官方npx clawhub@latest install clude-memory-mcp
镜像加速npx clawhub@latest install clude-memory-mcp --registry https://cn.clawhub-mirror.com
技能文档
MCP server exposing a 4-tier cognitive memory architecture inspired by Stanford's Generative Agents (Park et al. 2023).
Tools
recall_memories
Search the memory system. Returns scored memories ranked by relevance, importance, recency, and vector similarity.query— text to search against memory summariestags— filter by tagsrelated_user— filter by user/agent IDmemory_types— filter by type:episodic,semantic,procedural,self_modellimit— max results (1-20, default 5)min_importance— minimum importance threshold (0-1)
store_memory
Store a new memory. Memories persist across conversations, decay over time if not accessed, and get committed to Solana.type—episodic(events),semantic(knowledge),procedural(behaviors),self_model(identity)content— full memory contentsummary— short summary for recall matchingtags— tags for filteringimportance— importance score 0-1source— origin identifier (e.g.mcp:my-agent)
get_memory_stats
Get statistics: counts by type, average importance/decay, dream session history, top tags.get_market_mood
Get current market mood and price state (no LLM call).ask_clude
Ask Clude a question and get an in-character response. Calls Claude API.Setup
npm install clude-bot
Requires a Supabase project with the schema from supabase-schema.sql. Set SUPABASE_URL and SUPABASE_SERVICE_KEY environment variables.
Architecture
- 4-tier memory: episodic (7%/day decay), semantic (2%/day), procedural (3%/day), self_model (1%/day)
- Hybrid retrieval: pgvector cosine similarity + keyword matching + tag scoring
- Dream cycles: consolidation, reflection, emergence — every 6 hours
- On-chain commitment: SHA-256 hashed memories committed to Solana via memo transactions
- Granular decomposition: per-fragment embeddings for precise sub-memory retrieval
License
MIT
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制