📦 Memory Auto Sync — 每日对话自动存档
v1.0.0零依赖自动把每日用户与助手对话记录保存为 Markdown 文件，兼容 OpenClaw，方便回溯与审计。
0· 162·1 当前·1 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly matches its purpose (auto-saving conversations) but contains unexplained behavior and inconsistencies — notably a hardcoded filesystem path and undocumented writing to a vector DB — that warrant caution before installing.
评估建议
This skill implements the stated goal (auto-saving conversations) but has multiple red flags you should resolve before installing: 1) It writes conversations into the platform memory/vector store (api.memory.store) though SKILL.md does not mention this — confirm where that data is stored, retention, and who can access it. 2) The filesystem path is hardcoded to /home/tao/... — on your machine this will likely be incorrect or could write into another user's directory; request or patch the author t...详细分析 ▾
⚠ 用途与能力
SKILL.md claims the plugin only performs simple file writes ("只做纯文件写入"), but the code also writes every message into the platform memory/vector store via api.memory.store (LanceDB). Additionally the code uses a hardcoded MEMORY_DIR = "/home/tao/.openclaw/workspace/memory" instead of a user-relative or configurable path, which is unexpected for a general-purpose "zero-dependency" skill.
⚠ 指令范围
Runtime instructions (SKILL.md) describe real-time Markdown writes only and do not mention storing data to a vector DB. The code, however, registers listeners and dual-writes both to disk and to the platform memory API, which transmits conversation text into a vector store. SKILL.md also promises compatibility and zero complexity but the code hardcodes sender labels ("爸爸" and "张褐") and a fixed absolute path, granting it broader and non-user-configurable access than documented.
✓ 安装机制
No install spec; this is an instruction-only plugin with included TypeScript extension. No remote downloads or package installs are requested. The code will be loaded by OpenClaw as an extension — expected for this type of skill.
⚠ 凭证需求
The skill declares no required env vars or credentials, but it unilaterally writes conversation content into the platform memory/vector store (api.memory.store) and to a hardcoded filesystem path under /home/tao. Not requesting configuration for the storage path or confirmation of the vector store behavior is disproportionate and surprising. There is also a package.json version mismatch (registry says 1.0.0, package.json 2.0.0) and no source/homepage contact information.
✓ 持久化与权限
The plugin does not request always:true and registers ordinary event listeners via the plugin API. It does not modify other skills or global system settings. Autonomous invocation is allowed by default (normal).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/17
Initial release of memory-auto-sync: - Automatically syncs all user-assistant conversations to daily Markdown files in real time. - Uses only Node.js native APIs—no third-party dependencies required. - Minimal logic: file write only, ensuring stability and zero errors. - Fully compatible with all OpenClaw versions, preventing API compatibility issues. - Maintains identical file formats with previous manual memory files for seamless integration.
● 无害
安装命令
点击复制官方npx clawhub@latest install memory-auto-sync
镜像加速npx clawhub@latest install memory-auto-sync --registry https://cn.longxiaskill.com