by 安全扫描
OpenClaw
安全
high confidence插件代码、文档和安装程序与 ChromaDB 向量存储集成一致，文件和运行指令与声明目的相符，无无明凭证或系统级权限要求。
评估建议
["该包据称是 ChromaDB 集成和 LanceDB 迁移工具。安装前：","1. 审查 install.sh（运行 pip3 install 并复制文件到 ~/.openclaw），考虑在虚拟环境或容器中运行以避免修改系统 Python。","2. 在运行迁移脚本前备份现有 LanceDB 数据。","3. 如果计划使用云端 ChromaDB 端点，只在必要时提供 API 密钥并验证端点 URL。","4. 注意轻微不匹配（SKILL.md 显示 EvoChroma 2.0.0，而注册表列出 v1.0.1，源/主页不是知名供应商）—— 如果来源重要，请要求发布者提供规范源或签名发布。","5. 先在隔离环境中运行 test_chromadb.py 以确认行为。未发现无明凭证或隐藏网络端点，但仍应对第三方 Python 包和安装程序保持标准谨慎。"]...详细分析 ▾
✓ 用途与能力
Name/description (ChromaDB integration, migration from LanceDB, GPU acceleration) match the included Python code, migration script, tests, and installer. Optional cloud parameters (host/port/api_key) in code and docs are appropriate for supporting an on-prem vs cloud ChromaDB deployment.
✓ 指令范围
SKILL.md and scripts instruct only to install Python deps, copy plugin files to ~/.openclaw, update config.yaml, and run migration/tests. The migration script intentionally reads from a provided LanceDB path and the user's OpenClaw installation path (~/.openclaw); these actions are coherent with the migration purpose but will touch user OpenClaw files and should be run with care.
ℹ 安装机制
No registry install spec was declared, but an executable install.sh is included and recommended by SKILL.md. install.sh runs pip3 install chromadb sentence-transformers pyyaml (normal for this plugin) and copies files into ~/.openclaw/extensions/chromadb and creates a config under ~/.openclaw/config. Using pip from the network is reasonable here but carries the usual supply-chain/network risk; running the installer in a virtualenv/container reduces exposure.
✓ 凭证需求
The plugin declares no required environment variables in metadata and none are required at runtime; docs mention optional CHROMADB_* env vars and the code accepts an optional api_key for cloud-hosted ChromaDB. Requesting an API key only when connecting to a cloud endpoint is proportionate.
ℹ 持久化与权限
always:false and no elevated flags. The installer persists files under the user's home (~/.openclaw) and performs global pip installs (pip3), which is normal for a plugin but does modify the user's Python environment and OpenClaw extension directory. This is expected for an extension but worth noting to users who prefer isolated installs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestvv1.0.12026/3/29
["1. 开源协议调整为 MIT-0，允许所有人自由使用、修改、分发，无需标注来源","2. 新增原创声明，禁止任何主体将本项目核心代码声称是自己原创","3. 优化配置文件模板，补充缺失的混合搜索参数配置"]
● 无害
安装命令 点击复制
官方npx clawhub@latest install chromadb-plugin
镜像加速npx clawhub@latest install chromadb-plugin --registry https://cn.clawhub-mirror.com
技能文档
技能元数据
- 名称：EvoChroma - 进化记忆存储
- 版本：2.0.0
- 作者：进化记忆团队
- 英文描述：ChromaDB 向量数据库插件重大升级，进化版本本地记忆存储，GPU 原生加速，100% 向下兼容现有接口。
- 中文描述：同英文描述
- 分类：vector-store, memory, database, rag
- 标签：chromadb, vector-database, rag, memory-system, openclaw, evolutionary, evo
- 兼容性：OpenClaw >= 2026.3.22
- 许可：MIT
- 主页：https://clawhub.ai/lulan3954-a11y/chromadb-plugin
功能 (英文与中文已在原始内容中提供，略)
使用方法 (英文与中文已在原始内容中提供，略)
命令 (英文与中文已在原始内容中提供，略)
依赖 (英文与中文已在原始内容中提供，略)
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制