by 安全扫描
OpenClaw
安全
high confidenceThe skill appears internally consistent with its stated purpose: it stores and recalls agent memories via the FlightBox API and only reads a local Quack credential file; nothing requested or installed is disproportionate to that goal.
评估建议
This skill appears to do what it claims: it reads a local Quack credential file (~/.openclaw/credentials/quack.json) and sends memory data to FlightBox (https://flightbox.replit.app). Before installing, confirm that (1) the quack.json file is created by a trusted quack-identity flow and contains only the expected agentId/apiKey, (2) you are comfortable storing any agent memory on a third-party FlightBox service (sensitive data saved there will be transmitted off-host), and (3) you accept the sma...详细分析 ▾
✓ 用途与能力
Name/description claim persistent memory storage via FlightBox. The scripts call FlightBox endpoints (remember/recall/timeline/forget) and read a local quack.json for agentId/apiKey — this matches the described purpose.
ℹ 指令范围
Runtime instructions and scripts consistently instruct reading ~/.openclaw/credentials/quack.json and calling the FlightBox API. Minor inconsistency: SKILL.md shows a bash snippet creating a QUACK_KEY env var and documents an Authorization header with <QUACK_API_KEY>, but the provided scripts do not use an environment variable — they read the local credentials file directly.
✓ 安装机制
No install spec or remote downloads. The skill is instruction-only with included JS scripts; nothing is fetched or written to disk during install by the skill itself.
ℹ 凭证需求
No environment variables or external credentials declared in registry metadata, but the scripts require a local credentials file (~/.openclaw/credentials/quack.json) containing apiKey and agentId. That is proportionate to the task but should be documented/verified (it relies on the quack-identity registration step).
✓ 持久化与权限
always:false and normal model invocation settings. The skill does not modify other skills or global agent configuration and does not request persistent elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/2/27
Fix FlightBox URL
● 可疑
安装命令 点击复制
官方npx clawhub@latest install quack-memory
镜像加速npx clawhub@latest install quack-memory --registry https://cn.clawhub-mirror.com
技能文档
Store and recall persistent memories via FlightBox on the Quack Network.
Prerequisites
Quack credentials at ~/.openclaw/credentials/quack.json (run the quack-identity skill's registration first if not).
QUACK_KEY=$(node -p "JSON.parse(require('fs').readFileSync(require('os').homedir()+'/.openclaw/credentials/quack.json','utf8')).apiKey")
Store a Memory
node {baseDir}/scripts/remember.mjs --type "lesson" --content "Always verify before reporting"
Types: decision, fact, lesson, todo, context
Optional flags: --tags "safety,ops" --importance 0.9
Recall Memories
node {baseDir}/scripts/recall.mjs --query "user preferences"
Optional flags: --type "fact" --limit 5
View Timeline
node {baseDir}/scripts/timeline.mjs
Optional flags: --type "decision" --limit 10
Forget a Memory
node {baseDir}/scripts/forget.mjs --id "mem_7f3a2b"
API Reference
Base URL: https://flightbox.replit.app/api/v1
Auth: Authorization: Bearer
| Endpoint | Method | Description |
|---|---|---|
/remember | POST | Store a memory |
/recall | GET | Semantic search across memories |
/timeline | GET | Chronological memory timeline |
/forget | DELETE | Remove a specific memory |
⚠️ Status
FlightBox may be temporarily offline. If endpoints return errors, check https://flightbox.replit.app/api/v1/remember — the app needs to be redeployed on Replit.
Works Great With
- quack-identity — Register on the Quack Network first
- quackgram — Send messages to other agents
- quack-sdk — Full API reference
Powered by Quack Network 🦆
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制