Scan Report
18 /100
unified-memory
🧠 Unified Memory System - AI Agent memory management with hybrid BM25+vector search, multi-tenant team spaces, and distributed rate limiting
A legitimate AI memory management system with no malicious behavior detected. Minor documentation concerns include curl|bash patterns in README (standard installation methods) and base64 encoding flagged as IOC but used for legitimate local privacy and vector storage.
Safe to install
Approve for deployment. The skill functions as documented - a memory management system for AI agents. No credential harvesting, data exfiltration, or remote execution with malicious intent observed.
Findings 4 items
| Severity | Finding | Location |
|---|---|---|
| Low | Curl|bash installation patterns in documentation | README.md:277:277 |
| Low | Base64 encoding used for legitimate purposes | src/quality/privacy.js:60:60 |
| Low | Undeclared environment variable usage | config.js:10:10 |
| Info | spawn() not declared in SKILL.md | src/index.js:765:765 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ/WRITE | READ/WRITE | ✓ Aligned | SKILL.md:26-27 declares ~/.openclaw/workspace/memory/ |
| Environment | PARTIAL | READ | ✓ Aligned | SKILL.md declares OLLAMA_HOST, OLLAMA_EMBED_MODEL, STORAGE_MODE; code also reads… |
| Shell | NONE | WRITE | ✓ Aligned | index.js:765 uses spawn('node', ...) for web servers; not declared in SKILL.md |
| Network | READ | READ | ✓ Aligned | Only Ollama API calls and GitHub URLs in docs |
4 Critical 226 findings
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://raw.githubusercontent.com/mouxangithub/unified-memory/main/install.sh | bash README.md:277 Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://ollama.com/install.sh | sh README_QUICK_START.md:153 Critical Encoded Execution Base64 编码执行(代码混淆)
Buffer.from(encrypted, 'base64' src/quality/privacy.js:60 Critical Encoded Execution Base64 编码执行(代码混淆)
Buffer.from(b64, 'base64' src/vector_lancedb.js:74 Medium External URL 外部 URL
https://ollama.com/install.sh README_QUICK_START.md:153 Medium External URL 外部 URL
https://nodejs.org/ install.sh:19 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz package-lock.json:28 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/android-arm/-/android-arm-0.21.5.tgz package-lock.json:45 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/android-arm64/-/android-arm64-0.21.5.tgz package-lock.json:62 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/android-x64/-/android-x64-0.21.5.tgz package-lock.json:79 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/darwin-arm64/-/darwin-arm64-0.21.5.tgz package-lock.json:96 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/darwin-x64/-/darwin-x64-0.21.5.tgz package-lock.json:113 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/freebsd-arm64/-/freebsd-arm64-0.21.5.tgz package-lock.json:130 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/freebsd-x64/-/freebsd-x64-0.21.5.tgz package-lock.json:147 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-arm/-/linux-arm-0.21.5.tgz package-lock.json:164 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-arm64/-/linux-arm64-0.21.5.tgz package-lock.json:181 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-ia32/-/linux-ia32-0.21.5.tgz package-lock.json:198 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-loong64/-/linux-loong64-0.21.5.tgz package-lock.json:215 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-mips64el/-/linux-mips64el-0.21.5.tgz package-lock.json:232 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-ppc64/-/linux-ppc64-0.21.5.tgz package-lock.json:249 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-riscv64/-/linux-riscv64-0.21.5.tgz package-lock.json:266 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-s390x/-/linux-s390x-0.21.5.tgz package-lock.json:283 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/linux-x64/-/linux-x64-0.21.5.tgz package-lock.json:300 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz package-lock.json:317 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz package-lock.json:334 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz package-lock.json:351 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/win32-arm64/-/win32-arm64-0.21.5.tgz package-lock.json:368 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/win32-ia32/-/win32-ia32-0.21.5.tgz package-lock.json:385 Medium External URL 外部 URL
https://registry.npmmirror.com/@esbuild/win32-x64/-/win32-x64-0.21.5.tgz package-lock.json:402 Medium External URL 外部 URL
https://registry.npmmirror.com/@hono/node-server/-/node-server-1.19.11.tgz package-lock.json:419 Medium External URL 外部 URL
https://registry.npmmirror.com/@jest/schemas/-/schemas-29.6.3.tgz package-lock.json:431 Medium External URL 外部 URL
https://registry.npmmirror.com/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz package-lock.json:444 Medium External URL 外部 URL
https://registry.npmmirror.com/@modelcontextprotocol/sdk/-/sdk-1.28.0.tgz package-lock.json:451 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.0.tgz package-lock.json:491 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.0.tgz package-lock.json:505 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.0.tgz package-lock.json:519 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.0.tgz package-lock.json:533 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.0.tgz package-lock.json:547 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.0.tgz package-lock.json:561 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.0.tgz package-lock.json:575 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.0.tgz package-lock.json:589 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.0.tgz package-lock.json:603 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.0.tgz package-lock.json:617 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.0.tgz package-lock.json:631 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.0.tgz package-lock.json:645 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.0.tgz package-lock.json:659 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.0.tgz package-lock.json:673 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.0.tgz package-lock.json:687 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.0.tgz package-lock.json:701 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.0.tgz package-lock.json:715 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.0.tgz package-lock.json:729 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.0.tgz package-lock.json:743 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.0.tgz package-lock.json:757 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.0.tgz package-lock.json:771 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.0.tgz package-lock.json:785 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.0.tgz package-lock.json:799 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.0.tgz package-lock.json:813 Medium External URL 外部 URL
https://registry.npmmirror.com/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.0.tgz package-lock.json:827 Medium External URL 外部 URL
https://registry.npmmirror.com/@sinclair/typebox/-/typebox-0.27.10.tgz package-lock.json:841 Medium External URL 外部 URL
https://registry.npmmirror.com/@types/estree/-/estree-1.0.8.tgz package-lock.json:848 Medium External URL 外部 URL
https://registry.npmmirror.com/@vitest/expect/-/expect-1.6.1.tgz package-lock.json:855 Medium External URL 外部 URL
https://opencollective.com/vitest package-lock.json:865 Medium External URL 外部 URL
https://registry.npmmirror.com/@vitest/runner/-/runner-1.6.1.tgz package-lock.json:870 Medium Wallet Address 加密货币钱包地址
3nSnYXkVkf3mXFfE7vVyPmi3Sazhb package-lock.json:871 Medium External URL 外部 URL
https://registry.npmmirror.com/@vitest/snapshot/-/snapshot-1.6.1.tgz package-lock.json:885 Medium External URL 外部 URL
https://registry.npmmirror.com/@vitest/spy/-/spy-1.6.1.tgz package-lock.json:900 Medium External URL 外部 URL
https://registry.npmmirror.com/@vitest/utils/-/utils-1.6.1.tgz package-lock.json:913 Medium External URL 外部 URL
https://registry.npmmirror.com/accepts/-/accepts-2.0.0.tgz package-lock.json:929 Medium External URL 外部 URL
https://registry.npmmirror.com/acorn/-/acorn-8.16.0.tgz package-lock.json:942 Medium External URL 外部 URL
https://registry.npmmirror.com/acorn-walk/-/acorn-walk-8.3.5.tgz package-lock.json:955 Medium External URL 外部 URL
https://registry.npmmirror.com/ajv/-/ajv-8.18.0.tgz package-lock.json:968 Medium External URL 外部 URL
https://registry.npmmirror.com/ajv-formats/-/ajv-formats-3.0.1.tgz package-lock.json:984 Medium External URL 外部 URL
https://registry.npmmirror.com/ansi-styles/-/ansi-styles-5.2.0.tgz package-lock.json:1001 Medium External URL 外部 URL
https://registry.npmmirror.com/assertion-error/-/assertion-error-1.1.0.tgz package-lock.json:1014 Medium External URL 外部 URL
https://registry.npmmirror.com/body-parser/-/body-parser-2.2.2.tgz package-lock.json:1024 Medium External URL 外部 URL
https://opencollective.com/express package-lock.json:1043 Medium External URL 外部 URL
https://registry.npmmirror.com/bytes/-/bytes-3.1.2.tgz package-lock.json:1048 Medium External URL 外部 URL
https://registry.npmmirror.com/cac/-/cac-6.7.14.tgz package-lock.json:1057 Medium External URL 外部 URL
https://registry.npmmirror.com/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz package-lock.json:1067 Medium External URL 外部 URL
https://registry.npmmirror.com/call-bound/-/call-bound-1.0.4.tgz package-lock.json:1080 Medium External URL 外部 URL
https://registry.npmmirror.com/chai/-/chai-4.5.0.tgz package-lock.json:1096 Medium External URL 外部 URL
https://registry.npmmirror.com/check-error/-/check-error-1.0.3.tgz package-lock.json:1115 Medium External URL 外部 URL
https://registry.npmmirror.com/confbox/-/confbox-0.1.8.tgz package-lock.json:1128 Medium External URL 外部 URL
https://registry.npmmirror.com/content-disposition/-/content-disposition-1.0.1.tgz package-lock.json:1135 Medium External URL 外部 URL
https://registry.npmmirror.com/content-type/-/content-type-1.0.5.tgz package-lock.json:1148 Medium External URL 外部 URL
https://registry.npmmirror.com/cookie/-/cookie-0.7.2.tgz package-lock.json:1157 Medium External URL 外部 URL
https://registry.npmmirror.com/cookie-signature/-/cookie-signature-1.2.2.tgz package-lock.json:1166 Medium External URL 外部 URL
https://registry.npmmirror.com/cors/-/cors-2.8.6.tgz package-lock.json:1175 Medium External URL 外部 URL
https://registry.npmmirror.com/cross-spawn/-/cross-spawn-7.0.6.tgz package-lock.json:1192 Medium External URL 外部 URL
https://registry.npmmirror.com/debug/-/debug-4.4.3.tgz package-lock.json:1206 Medium External URL 外部 URL
https://registry.npmmirror.com/deep-eql/-/deep-eql-4.1.4.tgz package-lock.json:1223 Medium External URL 外部 URL
https://registry.npmmirror.com/depd/-/depd-2.0.0.tgz package-lock.json:1236 Medium External URL 外部 URL
https://registry.npmmirror.com/diff-sequences/-/diff-sequences-29.6.3.tgz package-lock.json:1245 Medium External URL 外部 URL
https://registry.npmmirror.com/dunder-proto/-/dunder-proto-1.0.1.tgz package-lock.json:1255 Medium External URL 外部 URL
https://registry.npmmirror.com/ee-first/-/ee-first-1.1.1.tgz package-lock.json:1269 Medium External URL 外部 URL
https://registry.npmmirror.com/encodeurl/-/encodeurl-2.0.0.tgz package-lock.json:1275 Medium External URL 外部 URL
https://registry.npmmirror.com/es-define-property/-/es-define-property-1.0.1.tgz package-lock.json:1284 Medium External URL 外部 URL
https://registry.npmmirror.com/es-errors/-/es-errors-1.3.0.tgz package-lock.json:1293 Medium External URL 外部 URL
https://registry.npmmirror.com/es-object-atoms/-/es-object-atoms-1.1.1.tgz package-lock.json:1302 Medium External URL 外部 URL
https://registry.npmmirror.com/esbuild/-/esbuild-0.21.5.tgz package-lock.json:1314 Medium External URL 外部 URL
https://registry.npmmirror.com/escape-html/-/escape-html-1.0.3.tgz package-lock.json:1353 Medium External URL 外部 URL
https://registry.npmmirror.com/estree-walker/-/estree-walker-3.0.3.tgz package-lock.json:1359 Medium External URL 外部 URL
https://registry.npmmirror.com/etag/-/etag-1.8.1.tgz package-lock.json:1369 Medium External URL 外部 URL
https://registry.npmmirror.com/eventsource/-/eventsource-3.0.7.tgz package-lock.json:1378 Medium External URL 外部 URL
https://registry.npmmirror.com/eventsource-parser/-/eventsource-parser-3.0.6.tgz package-lock.json:1390 Medium External URL 外部 URL
https://registry.npmmirror.com/execa/-/execa-8.0.1.tgz package-lock.json:1399 Medium External URL 外部 URL
https://registry.npmmirror.com/express/-/express-5.2.1.tgz package-lock.json:1423 Medium External URL 外部 URL
https://registry.npmmirror.com/express-rate-limit/-/express-rate-limit-8.3.1.tgz package-lock.json:1466 Medium External URL 外部 URL
https://registry.npmmirror.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz package-lock.json:1484 Medium External URL 外部 URL
https://registry.npmmirror.com/fast-uri/-/fast-uri-3.1.0.tgz package-lock.json:1490 Medium External URL 外部 URL
https://opencollective.com/fastify package-lock.json:1499 Medium External URL 外部 URL
https://registry.npmmirror.com/finalhandler/-/finalhandler-2.1.1.tgz package-lock.json:1506 Medium External URL 外部 URL
https://registry.npmmirror.com/forwarded/-/forwarded-0.2.0.tgz package-lock.json:1527 Medium External URL 外部 URL
https://registry.npmmirror.com/fresh/-/fresh-2.0.0.tgz package-lock.json:1536 Medium External URL 外部 URL
https://registry.npmmirror.com/fsevents/-/fsevents-2.3.3.tgz package-lock.json:1545 Medium External URL 外部 URL
https://registry.npmmirror.com/function-bind/-/function-bind-1.1.2.tgz package-lock.json:1560 Medium External URL 外部 URL
https://registry.npmmirror.com/get-func-name/-/get-func-name-2.0.2.tgz package-lock.json:1569 Medium External URL 外部 URL
https://registry.npmmirror.com/get-intrinsic/-/get-intrinsic-1.3.0.tgz package-lock.json:1579 Medium External URL 外部 URL
https://registry.npmmirror.com/get-proto/-/get-proto-1.0.1.tgz package-lock.json:1603 Medium External URL 外部 URL
https://registry.npmmirror.com/get-stream/-/get-stream-8.0.1.tgz package-lock.json:1616 Medium External URL 外部 URL
https://registry.npmmirror.com/gopd/-/gopd-1.2.0.tgz package-lock.json:1629 Medium External URL 外部 URL
https://registry.npmmirror.com/has-symbols/-/has-symbols-1.1.0.tgz package-lock.json:1641 Medium External URL 外部 URL
https://registry.npmmirror.com/hasown/-/hasown-2.0.2.tgz package-lock.json:1653 Medium External URL 外部 URL
https://registry.npmmirror.com/hono/-/hono-4.12.9.tgz package-lock.json:1665 Medium External URL 外部 URL
https://registry.npmmirror.com/http-errors/-/http-errors-2.0.1.tgz package-lock.json:1674 Medium External URL 外部 URL
https://registry.npmmirror.com/human-signals/-/human-signals-5.0.0.tgz package-lock.json:1694 Medium External URL 外部 URL
https://registry.npmmirror.com/iconv-lite/-/iconv-lite-0.7.2.tgz package-lock.json:1704 Medium External URL 外部 URL
https://registry.npmmirror.com/inherits/-/inherits-2.0.4.tgz package-lock.json:1720 Medium External URL 外部 URL
https://registry.npmmirror.com/ip-address/-/ip-address-10.1.0.tgz package-lock.json:1726 Medium External URL 外部 URL
https://registry.npmmirror.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz package-lock.json:1735 Medium External URL 外部 URL
https://registry.npmmirror.com/is-promise/-/is-promise-4.0.0.tgz package-lock.json:1744 Medium External URL 外部 URL
https://registry.npmmirror.com/is-stream/-/is-stream-3.0.0.tgz package-lock.json:1750 Medium External URL 外部 URL
https://registry.npmmirror.com/isexe/-/isexe-2.0.0.tgz package-lock.json:1763 Medium External URL 外部 URL
https://registry.npmmirror.com/jose/-/jose-6.2.2.tgz package-lock.json:1769 Medium External URL 外部 URL
https://registry.npmmirror.com/js-tokens/-/js-tokens-9.0.1.tgz package-lock.json:1778 Medium External URL 外部 URL
https://registry.npmmirror.com/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz package-lock.json:1785 Medium External URL 外部 URL
https://registry.npmmirror.com/json-schema-typed/-/json-schema-typed-8.0.2.tgz package-lock.json:1791 Medium External URL 外部 URL
https://registry.npmmirror.com/local-pkg/-/local-pkg-0.5.1.tgz package-lock.json:1797 Medium External URL 外部 URL
https://registry.npmmirror.com/loupe/-/loupe-2.3.7.tgz package-lock.json:1814 Medium External URL 外部 URL
https://registry.npmmirror.com/magic-string/-/magic-string-0.30.21.tgz package-lock.json:1824 Medium External URL 外部 URL
https://registry.npmmirror.com/math-intrinsics/-/math-intrinsics-1.1.0.tgz package-lock.json:1834 Medium External URL 外部 URL
https://registry.npmmirror.com/media-typer/-/media-typer-1.1.0.tgz package-lock.json:1843 Medium External URL 外部 URL
https://registry.npmmirror.com/merge-descriptors/-/merge-descriptors-2.0.0.tgz package-lock.json:1852 Medium External URL 外部 URL
https://registry.npmmirror.com/merge-stream/-/merge-stream-2.0.0.tgz package-lock.json:1864 Medium External URL 外部 URL
https://registry.npmmirror.com/mime-db/-/mime-db-1.54.0.tgz package-lock.json:1871 Medium External URL 外部 URL
https://registry.npmmirror.com/mime-types/-/mime-types-3.0.2.tgz package-lock.json:1880 Medium External URL 外部 URL
https://registry.npmmirror.com/mimic-fn/-/mimic-fn-4.0.0.tgz package-lock.json:1896 Medium External URL 外部 URL
https://registry.npmmirror.com/mlly/-/mlly-1.8.2.tgz package-lock.json:1909 Medium External URL 外部 URL
https://registry.npmmirror.com/pathe/-/pathe-2.0.3.tgz package-lock.json:1922 Medium External URL 外部 URL
https://registry.npmmirror.com/ms/-/ms-2.1.3.tgz package-lock.json:1929 Medium External URL 外部 URL
https://registry.npmmirror.com/nanoid/-/nanoid-3.3.11.tgz package-lock.json:1935 Medium Wallet Address 加密货币钱包地址
347pnakNevPmiHhNmZ2HbFA76w package-lock.json:1936 Medium External URL 外部 URL
https://registry.npmmirror.com/negotiator/-/negotiator-1.0.0.tgz package-lock.json:1954 Medium External URL 外部 URL
https://registry.npmmirror.com/npm-run-path/-/npm-run-path-5.3.0.tgz package-lock.json:1963 Medium External URL 外部 URL
https://registry.npmmirror.com/path-key/-/path-key-4.0.0.tgz package-lock.json:1979 Medium External URL 外部 URL
https://registry.npmmirror.com/object-assign/-/object-assign-4.1.1.tgz package-lock.json:1992 Medium External URL 外部 URL
https://registry.npmmirror.com/object-inspect/-/object-inspect-1.13.4.tgz package-lock.json:2001 Medium External URL 外部 URL
https://registry.npmmirror.com/on-finished/-/on-finished-2.4.1.tgz package-lock.json:2013 Medium External URL 外部 URL
https://registry.npmmirror.com/once/-/once-1.4.0.tgz package-lock.json:2025 Medium External URL 外部 URL
https://registry.npmmirror.com/onetime/-/onetime-6.0.0.tgz package-lock.json:2034 Medium External URL 外部 URL
https://registry.npmmirror.com/p-limit/-/p-limit-5.0.0.tgz package-lock.json:2050 Medium External URL 外部 URL
https://registry.npmmirror.com/parseurl/-/parseurl-1.3.3.tgz package-lock.json:2066 Medium External URL 外部 URL
https://registry.npmmirror.com/path-key/-/path-key-3.1.1.tgz package-lock.json:2075 Medium External URL 外部 URL
https://registry.npmmirror.com/path-to-regexp/-/path-to-regexp-8.4.0.tgz package-lock.json:2084 Medium External URL 外部 URL
https://registry.npmmirror.com/pathe/-/pathe-1.1.2.tgz package-lock.json:2094 Medium External URL 外部 URL
https://registry.npmmirror.com/pathval/-/pathval-1.1.1.tgz package-lock.json:2101 Medium External URL 外部 URL
https://registry.npmmirror.com/picocolors/-/picocolors-1.1.1.tgz package-lock.json:2111 Medium External URL 外部 URL
https://registry.npmmirror.com/pkce-challenge/-/pkce-challenge-5.0.1.tgz package-lock.json:2118 Medium External URL 外部 URL
https://registry.npmmirror.com/pkg-types/-/pkg-types-1.3.1.tgz package-lock.json:2127 Medium External URL 外部 URL
https://registry.npmmirror.com/postcss/-/postcss-8.5.8.tgz package-lock.json:2146 Medium External URL 外部 URL
https://opencollective.com/postcss/ package-lock.json:2152 Medium External URL 外部 URL
https://tidelift.com/funding/github/npm/postcss package-lock.json:2156 Medium External URL 外部 URL
https://registry.npmmirror.com/pretty-format/-/pretty-format-29.7.0.tgz package-lock.json:2175 Medium External URL 外部 URL
https://registry.npmmirror.com/proxy-addr/-/proxy-addr-2.0.7.tgz package-lock.json:2190 Medium External URL 外部 URL
https://registry.npmmirror.com/qs/-/qs-6.15.0.tgz package-lock.json:2203 Medium External URL 外部 URL
https://registry.npmmirror.com/range-parser/-/range-parser-1.2.1.tgz package-lock.json:2218 Medium External URL 外部 URL
https://registry.npmmirror.com/raw-body/-/raw-body-3.0.2.tgz package-lock.json:2227 Medium External URL 外部 URL
https://registry.npmmirror.com/react-is/-/react-is-18.3.1.tgz package-lock.json:2242 Medium External URL 外部 URL
https://registry.npmmirror.com/require-from-string/-/require-from-string-2.0.2.tgz package-lock.json:2249 Medium External URL 外部 URL
https://registry.npmmirror.com/rollup/-/rollup-4.60.0.tgz package-lock.json:2258 Medium External URL 外部 URL
https://registry.npmmirror.com/router/-/router-2.2.0.tgz package-lock.json:2303 Medium External URL 外部 URL
https://registry.npmmirror.com/safer-buffer/-/safer-buffer-2.1.2.tgz package-lock.json:2319 Medium External URL 外部 URL
https://registry.npmmirror.com/send/-/send-1.2.1.tgz package-lock.json:2325 Medium External URL 外部 URL
https://registry.npmmirror.com/serve-static/-/serve-static-2.2.1.tgz package-lock.json:2351 Medium External URL 外部 URL
https://registry.npmmirror.com/setprototypeof/-/setprototypeof-1.2.0.tgz package-lock.json:2370 Medium External URL 外部 URL
https://registry.npmmirror.com/shebang-command/-/shebang-command-2.0.0.tgz package-lock.json:2376 Medium External URL 外部 URL
https://registry.npmmirror.com/shebang-regex/-/shebang-regex-3.0.0.tgz package-lock.json:2388 Medium External URL 外部 URL
https://registry.npmmirror.com/side-channel/-/side-channel-1.1.0.tgz package-lock.json:2397 Medium External URL 外部 URL
https://registry.npmmirror.com/side-channel-list/-/side-channel-list-1.0.0.tgz package-lock.json:2416 Medium External URL 外部 URL
https://registry.npmmirror.com/side-channel-map/-/side-channel-map-1.0.1.tgz package-lock.json:2432 Medium External URL 外部 URL
https://registry.npmmirror.com/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz package-lock.json:2450 Medium External URL 外部 URL
https://registry.npmmirror.com/siginfo/-/siginfo-2.0.0.tgz package-lock.json:2469 Medium External URL 外部 URL
https://registry.npmmirror.com/signal-exit/-/signal-exit-4.1.0.tgz package-lock.json:2476 Medium External URL 外部 URL
https://registry.npmmirror.com/source-map-js/-/source-map-js-1.2.1.tgz package-lock.json:2489 Medium External URL 外部 URL
https://registry.npmmirror.com/stackback/-/stackback-0.0.2.tgz package-lock.json:2499 Medium External URL 外部 URL
https://registry.npmmirror.com/statuses/-/statuses-2.0.2.tgz package-lock.json:2506 Medium External URL 外部 URL
https://registry.npmmirror.com/std-env/-/std-env-3.10.0.tgz package-lock.json:2515 Medium External URL 外部 URL
https://registry.npmmirror.com/strip-final-newline/-/strip-final-newline-3.0.0.tgz package-lock.json:2522 Medium External URL 外部 URL
https://registry.npmmirror.com/strip-literal/-/strip-literal-2.1.1.tgz package-lock.json:2535 Medium External URL 外部 URL
https://registry.npmmirror.com/tinybench/-/tinybench-2.9.0.tgz package-lock.json:2548 Medium External URL 外部 URL
https://registry.npmmirror.com/tinypool/-/tinypool-0.8.4.tgz package-lock.json:2555 Medium External URL 外部 URL
https://registry.npmmirror.com/tinyspy/-/tinyspy-2.2.1.tgz package-lock.json:2565 Medium External URL 外部 URL
https://registry.npmmirror.com/toidentifier/-/toidentifier-1.0.1.tgz package-lock.json:2575 Medium External URL 外部 URL
https://registry.npmmirror.com/type-detect/-/type-detect-4.1.0.tgz package-lock.json:2584 Medium External URL 外部 URL
https://registry.npmmirror.com/type-is/-/type-is-2.0.1.tgz package-lock.json:2594 Medium External URL 外部 URL
https://registry.npmmirror.com/ufo/-/ufo-1.6.3.tgz package-lock.json:2608 Medium External URL 外部 URL
https://registry.npmmirror.com/unpipe/-/unpipe-1.0.0.tgz package-lock.json:2615 Medium External URL 外部 URL
https://registry.npmmirror.com/vary/-/vary-1.1.2.tgz package-lock.json:2624 Medium External URL 外部 URL
https://registry.npmmirror.com/vite/-/vite-5.4.21.tgz package-lock.json:2633 Medium External URL 外部 URL
https://registry.npmmirror.com/vite-node/-/vite-node-1.6.1.tgz package-lock.json:2693 Medium External URL 外部 URL
https://registry.npmmirror.com/vitest/-/vitest-1.6.1.tgz package-lock.json:2716 Medium External URL 外部 URL
https://registry.npmmirror.com/which/-/which-2.0.2.tgz package-lock.json:2782 Medium External URL 外部 URL
https://registry.npmmirror.com/why-is-node-running/-/why-is-node-running-2.3.0.tgz package-lock.json:2797 Medium External URL 外部 URL
https://registry.npmmirror.com/wrappy/-/wrappy-1.0.2.tgz package-lock.json:2814 Medium External URL 外部 URL
https://registry.npmmirror.com/yocto-queue/-/yocto-queue-1.2.2.tgz package-lock.json:2820 Medium External URL 外部 URL
https://registry.npmmirror.com/zod/-/zod-4.3.6.tgz package-lock.json:2833 Medium External URL 外部 URL
https://registry.npmmirror.com/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz package-lock.json:2842 Medium External URL 外部 URL
http://192.168.2.155:11434 src/cache_semantic.js:49 Medium External URL 外部 URL
https://api.jina.ai/v1 src/config.js:37 Medium External URL 外部 URL
https://api.siliconflow.cn/v1 src/config.js:43 Medium External URL 外部 URL
https://api.supermemory.ai src/config.js:164 Medium External URL 外部 URL
https://api.example.com src/integrations/cloud_backup.js:20 Medium External URL 外部 URL
https://api.minimax.chat src/tools/qa.js:11 Info Email 邮箱地址
[email protected] src/agents/agent.js:236 Info Email 邮箱地址
[email protected] src/agents/roles.js:528 Info Email 邮箱地址
[email protected] src/tools/git_notes.js:67 File Tree
271 files · 2.4 MB · 80849 lines JavaScript 240f · 69046L
Markdown 22f · 7003L
JSON 6f · 3161L
HTML 2f · 1512L
Shell 1f · 127L
├─
▾
docs
│ ├─
▾
en
│ │ ├─
HOOK_INTEGRATION.md
Markdown
│ │ ├─
INTEGRATION_COMPARISON.md
Markdown
│ │ ├─
MCP_INTEGRATION.md
Markdown
│ │ └─
README.md
Markdown
│ ├─
▾
zh
│ │ ├─
HOOK_INTEGRATION.md
Markdown
│ │ ├─
INTEGRATION_COMPARISON.md
Markdown
│ │ ├─
MCP_INTEGRATION.md
Markdown
│ │ └─
README.md
Markdown
│ ├─
ARCHITECTURE.md
Markdown
│ ├─
AUTO_HOOK_BUILD.md
Markdown
│ ├─
CHANGELOG.md
Markdown
│ ├─
competitive-analysis.md
Markdown
│ ├─
index.md
Markdown
│ ├─
README.md
Markdown
│ ├─
v3.8.0-release-notes.md
Markdown
│ └─
v4.0-ARCHITECTURE.md
Markdown
├─
▾
scripts
│ └─
build-hook.js
JavaScript
├─
▾
src
│ ├─
▾
agents
│ │ ├─
active_learner.js
JavaScript
│ │ ├─
agent_collab_system.js
JavaScript
│ │ ├─
agent_memory.js
JavaScript
│ │ ├─
agent_profile.js
JavaScript
│ │ ├─
agent.js
JavaScript
│ │ ├─
bridge.js
JavaScript
│ │ ├─
memory_agent.js
JavaScript
│ │ ├─
optimize.js
JavaScript
│ │ ├─
rerank_full.js
JavaScript
│ │ ├─
roles.js
JavaScript
│ │ ├─
sqlite.js
JavaScript
│ │ ├─
usage_stats.js
JavaScript
│ │ └─
version_control.js
JavaScript
│ ├─
▾
api
│ │ ├─
api.js
JavaScript
│ │ ├─
mcp_server.js
JavaScript
│ │ ├─
rest_server.js
JavaScript
│ │ ├─
routes.js
JavaScript
│ │ ├─
server.js
JavaScript
│ │ └─
simple_server.js
JavaScript
│ ├─
▾
backup
│ │ ├─
backup.js
JavaScript
│ │ └─
sync.js
JavaScript
│ ├─
▾
benchmark
│ │ ├─
benchmark.js
JavaScript
│ │ ├─
perf.js
JavaScript
│ │ ├─
pool.js
JavaScript
│ │ └─
real_benchmark.js
JavaScript
│ ├─
▾
chunking
│ │ ├─
chunk_tools.js
JavaScript
│ │ └─
chunker.js
JavaScript
│ ├─
▾
cli
│ │ ├─
debug_commands.js
JavaScript
│ │ ├─
dedup_commands.js
JavaScript
│ │ ├─
index.js
JavaScript
│ │ ├─
search.js
JavaScript
│ │ ├─
sync_commands.js
JavaScript
│ │ └─
working_memory.js
JavaScript
│ ├─
▾
collab
│ │ ├─
agent_collab.js
JavaScript
│ │ ├─
analytics.js
JavaScript
│ │ ├─
cloud_deployment.js
JavaScript
│ │ ├─
cloud.js
JavaScript
│ │ ├─
collab_bus.js
JavaScript
│ │ ├─
collab_suggest.js
JavaScript
│ │ ├─
collab.js
JavaScript
│ │ ├─
distributed_sync.js
JavaScript
│ │ ├─
multi_agent_share.js
JavaScript
│ │ ├─
multi_tenant.js
JavaScript
│ │ ├─
peer_registry.js
JavaScript
│ │ ├─
push.js
JavaScript
│ │ ├─
realtime_sync.js
JavaScript
│ │ └─
sync.js
JavaScript
│ ├─
▾
consolidate
│ │ ├─
reconsolidation.js
JavaScript
│ │ └─
refresh_tools.js
JavaScript
│ ├─
▾
decay
│ │ ├─
weibull_decay.js
JavaScript
│ │ └─
weibull_tools.js
JavaScript
│ ├─
▾
episode
│ │ ├─
episode_store.js
JavaScript
│ │ └─
episode_tools.js
JavaScript
│ ├─
▾
graph
│ │ ├─
entity.js
JavaScript
│ │ ├─
graph_store.js
JavaScript
│ │ ├─
graph.js
JavaScript
│ │ ├─
knowledge_card.js
JavaScript
│ │ ├─
knowledge_merger.js
JavaScript
│ │ ├─
migrate.js
JavaScript
│ │ └─
relation.js
JavaScript
│ ├─
▾
integrations
│ │ ├─
cloud_backup.js
JavaScript
│ │ ├─
cloud_tools.js
JavaScript
│ │ ├─
git_manager.js
JavaScript
│ │ └─
git_tools.js
JavaScript
│ ├─
▾
multimodal
│ │ ├─
crossmodal.js
JavaScript
│ │ └─
multimodal.js
JavaScript
│ ├─
▾
observability
│ │ ├─
http_server.js
JavaScript
│ │ └─
observability_tools.js
JavaScript
│ ├─
▾
plugin
│ │ ├─
index.js
JavaScript
│ │ └─
tools.js
JavaScript
│ ├─
▾
procedural
│ │ ├─
procedural_store.js
JavaScript
│ │ └─
procedural_tools.js
JavaScript
│ ├─
▾
quality
│ │ ├─
analytics.js
JavaScript
│ │ ├─
audit.js
JavaScript
│ │ ├─
confidence.js
JavaScript
│ │ ├─
noise_filter.js
JavaScript
│ │ ├─
optimization.js
JavaScript
│ │ ├─
privacy.js
JavaScript
│ │ ├─
quality.js
JavaScript
│ │ ├─
smart_compress.js
JavaScript
│ │ ├─
smart_forgetter.js
JavaScript
│ │ └─
weibull_decay.js
JavaScript
│ ├─
▾
rerank
│ │ ├─
cross_encoder.js
JavaScript
│ │ └─
rerank_tools.js
JavaScript
│ ├─
▾
rule
│ │ ├─
rule_store.js
JavaScript
│ │ └─
rule_tools.js
JavaScript
│ ├─
▾
search
│ │ ├─
qmd_backend.js
JavaScript
│ │ └─
qmd_tools.js
JavaScript
│ ├─
▾
setup
│ │ └─
wizard.js
JavaScript
│ ├─
▾
system
│ │ ├─
all_in_one.js
JavaScript
│ │ ├─
code_generator.js
JavaScript
│ │ ├─
compress_eval.js
JavaScript
│ │ ├─
fallback_handler.js
JavaScript
│ │ ├─
integration.js
JavaScript
│ │ ├─
llm_provider.js
JavaScript
│ │ ├─
local_llm.js
JavaScript
│ │ ├─
multimodal_fusion.js
JavaScript
│ │ ├─
openclaw_integration.js
JavaScript
│ │ ├─
plugin_system.js
JavaScript
│ │ ├─
preheat.js
JavaScript
│ │ ├─
sandbox.js
JavaScript
│ │ ├─
task_queue.js
JavaScript
│ │ └─
workflow_engine.js
JavaScript
│ ├─
▾
tools
│ │ ├─
auto_extractor.js
JavaScript
│ │ ├─
autostore.js
JavaScript
│ │ ├─
concurrent_search.js
JavaScript
│ │ ├─
debug_tools.js
JavaScript
│ │ ├─
decay.js
JavaScript
│ │ ├─
dedup_report.js
JavaScript
│ │ ├─
dedup.js
JavaScript
│ │ ├─
entity_tools.js
JavaScript
│ │ ├─
episode_tools.js
JavaScript
│ │ ├─
export.js
JavaScript
│ │ ├─
feedback_learner.js
JavaScript
│ │ ├─
git_notes.js
JavaScript
│ │ ├─
graph_search.js
JavaScript
│ │ ├─
health.js
JavaScript
│ │ ├─
identity_tools.js
JavaScript
│ │ ├─
inference.js
JavaScript
│ │ ├─
insights.js
JavaScript
│ │ ├─
memory_compose.js
JavaScript
│ │ ├─
predict.js
JavaScript
│ │ ├─
preference_tools.js
JavaScript
│ │ ├─
proactive_tools.js
JavaScript
│ │ ├─
qa.js
JavaScript
│ │ ├─
qmd_search.js
JavaScript
│ │ ├─
recommend.js
JavaScript
│ │ ├─
rerank.js
JavaScript
│ │ ├─
summary.js
JavaScript
│ │ ├─
templates.js
JavaScript
│ │ ├─
version_tools.js
JavaScript
│ │ └─
working_memory_tools.js
JavaScript
│ ├─
▾
utils
│ │ ├─
counter.js
JavaScript
│ │ ├─
logger.js
JavaScript
│ │ ├─
text.js
JavaScript
│ │ └─
token_estimator.js
⚠
JavaScript
│ ├─
▾
v4
│ │ ├─
http_server.js
JavaScript
│ │ ├─
storage-gateway.js
JavaScript
│ │ └─
storage-schema.js
JavaScript
│ ├─
▾
visualize
│ │ ├─
graph_visualizer.js
JavaScript
│ │ ├─
heatmap.js
JavaScript
│ │ └─
visualize.js
JavaScript
│ ├─
▾
webui
│ │ ├─
dashboard.js
JavaScript
│ │ ├─
unified_server.js
JavaScript
│ │ └─
webui.js
JavaScript
│ ├─
adaptive.js
JavaScript
│ ├─
bm25.js
JavaScript
│ ├─
budget.js
JavaScript
│ ├─
cache_semantic.js
JavaScript
│ ├─
cloud_backup_api.js
JavaScript
│ ├─
cognitive_scheduler.js
JavaScript
│ ├─
config.js
JavaScript
│ ├─
dashboard.html
HTML
│ ├─
decay.js
JavaScript
│ ├─
dedup_merger.js
JavaScript
│ ├─
dedup.js
JavaScript
│ ├─
digest_generator.js
JavaScript
│ ├─
embed_cache.js
JavaScript
│ ├─
embed_providers.js
JavaScript
│ ├─
embedding_providers.js
JavaScript
│ ├─
episode_capture.js
JavaScript
│ ├─
episode_manager.js
JavaScript
│ ├─
episode_store.js
JavaScript
│ ├─
episode_summarizer.js
JavaScript
│ ├─
evidence_recall.js
JavaScript
│ ├─
evidence.js
JavaScript
│ ├─
extract.js
JavaScript
│ ├─
fusion.js
JavaScript
│ ├─
git_notes.js
JavaScript
│ ├─
importance_scorer.js
JavaScript
│ ├─
index.js
JavaScript
│ ├─
intent.js
JavaScript
│ ├─
lane_manager_enhanced.js
JavaScript
│ ├─
lanes_manager.js
JavaScript
│ ├─
lesson.js
JavaScript
│ ├─
lessons.js
JavaScript
│ ├─
logger.js
JavaScript
│ ├─
manager.js
JavaScript
│ ├─
memory_attribution.js
JavaScript
│ ├─
memory_diff.js
JavaScript
│ ├─
memory_replay.js
JavaScript
│ ├─
memory.js
JavaScript
│ ├─
metrics.js
JavaScript
│ ├─
mmr.js
JavaScript
│ ├─
multimodal.js
JavaScript
│ ├─
noise.js
JavaScript
│ ├─
organize.js
JavaScript
│ ├─
preference_extractor.js
JavaScript
│ ├─
preference_injector.js
JavaScript
│ ├─
preference_memory_bridge.js
JavaScript
│ ├─
preference_slots_schema.js
JavaScript
│ ├─
preference_slots.js
JavaScript
│ ├─
proactive_manager.js
JavaScript
│ ├─
proactive_scheduler.js
JavaScript
│ ├─
qmd_integration.js
JavaScript
│ ├─
quality.js
JavaScript
│ ├─
rate_limit.js
JavaScript
│ ├─
recall_trigger.js
JavaScript
│ ├─
reflection.js
JavaScript
│ ├─
reminder.js
JavaScript
│ ├─
rerank.js
JavaScript
│ ├─
retrieval_tracer.js
JavaScript
│ ├─
revision_manager_enhanced.js
JavaScript
│ ├─
revision_manager.js
JavaScript
│ ├─
rollback_manager.js
JavaScript
│ ├─
scope.js
JavaScript
│ ├─
search.js
JavaScript
│ ├─
semantic_dedup.js
JavaScript
│ ├─
session_state.js
JavaScript
│ ├─
storage_lock.js
JavaScript
│ ├─
storage_sqlite.js
JavaScript
│ ├─
storage.js
JavaScript
│ ├─
sync_incremental.js
JavaScript
│ ├─
sync_watcher.js
JavaScript
│ ├─
task_hierarchy.js
JavaScript
│ ├─
test_tier.js
JavaScript
│ ├─
tier_tools.js
JavaScript
│ ├─
tier.js
JavaScript
│ ├─
token_budget_enhanced.js
⚠
JavaScript
│ ├─
trace_analyzer.js
JavaScript
│ ├─
tracer.js
JavaScript
│ ├─
transcript_first.js
JavaScript
│ ├─
transcript_manager.js
JavaScript
│ ├─
types.js
JavaScript
│ ├─
unified_memory.js
JavaScript
│ ├─
usage_tracker.js
JavaScript
│ ├─
utils.js
JavaScript
│ ├─
vector_lancedb.js
JavaScript
│ ├─
vector.js
JavaScript
│ ├─
version_store.js
JavaScript
│ ├─
wal.js
JavaScript
│ ├─
working_memory_injector.js
JavaScript
│ ├─
working_memory_manager.js
JavaScript
│ └─
working_memory.js
JavaScript
├─
▾
webui
│ └─
dashboard.html
HTML
├─
_meta.json
JSON
├─
CHANGELOG.md
Markdown
├─
extract-schemas.cjs
JavaScript
├─
install.sh
Shell
├─
MIGRATION_STATUS.json
JSON
├─
package-lock.json
JSON
├─
package.json
JSON
├─
README_CN.md
Markdown
├─
README_QUICK_START.md
Markdown
├─
README.md
Markdown
├─
README.zh-CN.md
Markdown
├─
run-tests.cjs
JavaScript
├─
skill.json
JSON
├─
SKILL.md
Markdown
├─
start-dashboard.js
JavaScript
├─
test_integration_v270.js
JavaScript
├─
test_report.json
JSON
├─
test-all.cjs
JavaScript
└─
vitest.config.js
JavaScript
Dependencies 4 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
@modelcontextprotocol/sdk | ^1.0.0 | npm | No | MCP protocol implementation |
vitest | ^1.6.0 | npm (dev) | No | Testing framework |
@lancedb/lancedb | provided-by-host | peerDependency | No | Optional vector database |
@xenova/transformers | provided-by-host | peerDependency | No | Optional ML transformers |
Security Positives
✓ No credential harvesting - no access to ~/.ssh/, ~/.aws/, .env, or similar sensitive paths
✓ No data exfiltration - all network requests are to declared Ollama API endpoints
✓ No reverse shell, C2, or malicious code patterns detected
✓ Proper filesystem scoping - only accesses declared ~/.openclaw/workspace/memory/ directory
✓ Local encryption implementation for privacy (XOR cipher with random key generation)
✓ MIT licensed with public GitHub repository
✓ Comprehensive MCP tool documentation in SKILL.md