by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and instructions match a memory integration purpose, but the package and runtime requirements are not declared (missing required env var and no install spec), which is an incoherence you should resolve before trusting it.
评估建议
This skill appears to implement the memory functionality it claims, but there are important inconsistencies to resolve before installing: (1) It requires an OpenAI API key (OPENAI_API_KEY) even though the registry metadata declares no required env vars — supply and protect that key if you proceed. (2) The package includes Node scripts and package.json but provides no install instructions; you should run npm install (or otherwise ensure mem0ai and transitive deps are available) in a controlled en...详细分析 ▾
⚠ 用途与能力
The skill's name, description, and code consistently implement a local memory layer (uses mem0ai, local vector store, OpenAI embedder/LLM). However registry metadata claims no required environment variables while SKILL.md and scripts expect OPENAI_API_KEY. That metadata omission is an incoherence that affects whether the skill can run and what secrets it needs.
✓ 指令范围
SKILL.md and the scripts limit activity to semantic search, add/list/delete operations, and local storage under ~/.mem0. The code does not attempt to read arbitrary system files or contact unexpected endpoints (it uses the mem0ai client which, per config, will call OpenAI). It documents what to store and not store. This is within the stated memory-purpose scope.
⚠ 安装机制
There is no install spec even though package.json, package-lock.json, and Node scripts are included. That means the skill either expects the environment to already have Node deps (mem0ai) installed or will fail. The package-lock references many transitive packages (normal for npm), but absence of an install instruction is a usability/security gap that could cause unexpected behavior.
⚠ 凭证需求
The skill actually reads process.env.OPENAI_API_KEY (and optionally JSON_OUTPUT) but the registry lists no required env vars. Requesting an OpenAI API key is proportionate to the stated purpose, but the omission from declared requirements is misleading. Also USER_ID is hardcoded to 'abhay' in config, which could cause cross-user data mixing unless overridden.
ℹ 持久化与权限
The skill persists data locally under ~/.mem0 and creates an SQLite history.db — that's expected for a memory store and does not modify other skills or system-wide settings. always is false. Note the fixed history path and default USER_ID which may lead to persistent data on disk and potential accidental sharing between contexts.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/2
Initial release of mem0: adaptive memory for Clawdbot - Adds Mem0, an intelligent memory layer that learns and recalls user preferences, patterns, and conversational context. - Supports semantic search and automatic memory extraction for dynamic, adaptive responses. - Provides commands for searching, adding, listing, and deleting memories via scripts. - Complements structured MEMORY.md with learned, behavioral context. - Delivers improved performance: higher accuracy, faster retrieval, and reduced token usage. - Includes detailed storage guidelines and programmatic access options.
● 可疑
安装命令
点击复制官方npx clawhub@latest install mem0-1-0-0
镜像加速npx clawhub@latest install mem0-1-0-0 --registry https://cn.longxiaskill.com