📦 Conversation Recovery — 会话恢复
v1.0.0跨 OpenClaw 会话捕获并恢复对话状态，中断、多会话或需还原上下文时自动续接。
0· 150·0 当前·0 累计
by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
What to check before installing:
- Node/npm requirement: SKILL.md requires running 'npm install' and 'npm run build' but the registry metadata lists no required binaries — ensure you have Node.js and npm and be comfortable running them.
- Review package.json/package-lock.json for dependencies before running npm install to spot any unexpected packages.
- Storage location: by default the skill writes JSON files to ~/.openclaw/conversation-recovery (sessions/ and snapshots/). If you prefer isolatio...详细分析 ▾
ℹ 用途与能力
The name/description align with the implementation: session/snapshot models, capture/recover APIs, local JSON storage, and analysis/compression helpers. However the registry metadata lists no required binaries or env vars while SKILL.md expects npm/node (npm install, build) and the code reads process.env.CONVERSATION_RECOVERY_STORAGE and process.env.HOME. The skill should declare Node/npm as required binaries and document the optional CONVERSATION_RECOVERY_STORAGE env var in the registry metadata.
✓ 指令范围
SKILL.md and the exported API focus on capturing/recovering conversation state and managing snapshots; the implementation reads/writes JSON files under a dedicated directory (~/.openclaw/conversation-recovery by default). There are no instructions or code paths that reach outside these responsibilities (no network endpoints, no scanning of unrelated system files). The analyzer notes LLM-based extraction would be a production-time call but currently contains a simulated implementation — no active external LLM calls were found in the shipped code.
ℹ 安装机制
There is no packaged install spec in the registry, but SKILL.md requires running npm install and npm run build; package.json and package-lock.json are included. Installing will pull dependencies from the npm registry and write node_modules to disk. This is a standard Node.js build workflow but the registry should advertise node/npm requirements; review package.json dependencies before running npm install to confirm no unexpected packages.
⚠ 凭证需求
The skill requests no credentials (good) but reads/writes files under the user's home directory (default location ~/.openclaw/conversation-recovery) and uses the CONVERSATION_RECOVERY_STORAGE env var to override storage. The registry's required env list is empty despite the SKILL.md and code referencing that environment variable. File write/delete operations (createSnapshot, deleteSnapshot, deleteSession) are present — these are appropriate for the feature but are destructive. The lack of declared env/config requirements in the registry is an inconsistency that reduces transparency.
✓ 持久化与权限
The skill does not request 'always: true' or other elevated platform privileges. It can be invoked autonomously per platform defaults (disable-model-invocation is false), which is normal for skills. Its persistence is limited to storing JSON files in a per-user directory; it does not modify other skills' configurations or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/20
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install conversation-recovery
镜像加速npx clawhub@latest install conversation-recovery --registry https://cn.longxiaskill.com