安全扫描
OpenClaw
可疑
high confidenceThe skill's behavior matches a memory manager, but it can read/write arbitrary filesystem paths and imports remote code at runtime — both of which enable data-exfiltration and supply-chain risks that the user should consider before installing.
评估建议
This skill appears functionally consistent with a memory manager, but two practical risks deserve attention: (1) It will fetch third-party modules from deno.land at runtime — review and pin/ vendor those dependencies if you want to avoid implicit network-loaded code. (2) The load/save API accepts arbitrary file paths and uses Deno.readTextFile/Deno.writeTextFile; if the agent runtime has filesystem permissions, an attacker or misconfigured agent could read sensitive local files (for example dotf...详细分析 ▾
✓ 用途与能力
Name/description and the code align: it implements short/long/important memory layers, search, summarization, and save/load persistence. File I/O and simple semantic/keyword search are reasonable capabilities for a memory manager.
⚠ 指令范围
SKILL.md and the API expose load/save with an unrestricted persistPath parameter. The implementation uses Deno.readTextFile to load any path and returns memory contents via list/search/summarize — this enables reading arbitrary files and returning their contents, which is outside a narrow 'memory manager' scope unless the user explicitly chooses safe paths.
ℹ 安装机制
There is no install spec, but the code imports third-party modules directly from deno.land (zod and std/encoding). That means runtime will fetch remote code from the network; this is normal for Deno but is a supply-chain risk compared with vendored or packaged dependencies.
⚠ 凭证需求
The skill requests no env vars, which is proportional, but it performs arbitrary filesystem read/write (Deno.readTextFile / Deno.writeTextFile) with user-supplied paths. If the agent runs with filesystem permissions, the skill can read sensitive local files and then expose them in outputs — a high-risk capability relative to typical memory persistence needs unless paths are restricted.
ℹ 持久化与权限
The skill is not always-enabled and does not modify other skills. However, because it can persist to arbitrary disk paths and load arbitrary files, installing it in an environment with broad file-system permissions grants it effective persistent access to local data. Consider limiting runtime permissions or paths.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/10
- Removed the skill.yaml file from the project. - Consolidated metadata fields from skill.yaml into SKILL.md. - Added a description field to SKILL.md. - No changes to functionality or the core documentation content.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install smart-memory-manager
镜像加速npx clawhub@latest install smart-memory-manager --registry https://cn.clawhub-mirror.com
技能文档
核心亮点
- 📚 分层记忆体系:短期/长期/重要记忆三层架构,自动清理过期记忆,解决上下文溢出问题
- 🔍 多模式检索:支持关键词/语义/混合三种检索模式,快速召回相关记忆,提升RAG准确率
- 📝 自动摘要能力:一键生成记忆摘要,支持长会话上下文压缩,token占用减少70%
- 💾 持久化支持:支持内存/磁盘持久化,重启后记忆不丢失
🎯 适用场景
- 长会话Agent、聊天机器人
- RAG应用的记忆层
- 需要长期记忆的任务型Agent
- 客服、助理类Agent的上下文管理
📝 参数说明
| 参数 | 类型 | 必填 | 说明 |
|---|---|---|---|
| action | string | 是 | 操作类型:add/search/summarize/clear/list/load/save |
| content | string | 否 | add操作必填,记忆内容 |
| type | string | 否 | add操作可选,记忆类型:short-term/long-term/important,默认short-term |
| query | string | 否 | search操作必填,搜索关键词 |
| limit | number | 否 | search/list操作可选,返回结果数量,默认5/20 |
| typeFilter | string | 否 | 所有操作可选,过滤记忆类型,默认all |
| persist | boolean | 否 | add操作可选,是否持久化存储,默认false |
| persistPath | string | 否 | load/save操作可选,持久化文件路径,默认./memory-store.json |
💡 开箱即用示例
添加记忆
// 添加长期记忆
await skills.smartMemoryManager({
action: "add",
content: "用户喜欢喝咖啡,不加糖,每周三下午喝奶茶",
type: "long-term",
persist: true
});
搜索记忆
const result = await skills.smartMemoryManager({
action: "search",
query: "用户喜好",
limit: 3,
searchMode: "hybrid" // 关键词+语义混合检索
});
生成会话摘要
const summary = await skills.smartMemoryManager({
action: "summarize",
typeFilter: "short-term",
maxTokens: 500
});
持久化与加载
// 保存所有记忆到磁盘
await skills.smartMemoryManager({
action: "save",
persistPath: "./my-memory.json"
});// 从磁盘加载记忆
await skills.smartMemoryManager({
action: "load",
persistPath: "./my-memory.json"
});
🔧 技术实现说明
- 内置记忆自动清理机制,短期记忆最多保留100条,避免内存溢出
- 模块化设计,可轻松对接向量数据库实现语义检索
- 全链路类型安全,参数自动校验
- 轻量无外部依赖,开箱即用,也支持自定义扩展
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制