Code PluginExecutes codesource-linked

Spark Memory

Intelligence layer that compounds. Records decisions, reflects overnight, detects patterns, captures sessions automatically — your agent gets smarter every day.

Community code plugin. Review compatibility and verification before install.

@zellin/spark-memory · runtime id spark-memory

Install

openclaw plugins install clawhub:@zellin/spark-memory

Latest Release

Version 0.2.1

Download zip

Compatibility

{
  "builtWithOpenClawVersion": "0.2.1",
  "pluginApiRange": ">=1.0.0"
}

Capabilities

{
  "bundledSkills": [],
  "capabilityTags": [
    "executes-code",
    "kind:memory"
  ],
  "channels": [],
  "commandNames": [],
  "configSchema": true,
  "configUiHints": false,
  "executesCode": true,
  "hooks": [],
  "httpRouteCount": 0,
  "materializesDependencies": false,
  "pluginKind": "memory",
  "providers": [],
  "runtimeId": "spark-memory",
  "serviceNames": [],
  "setupEntry": false,
  "toolNames": []
}

Security Scan

VirusTotal

Pending

View report →

OpenClaw

Suspicious

medium confidence

✓

Purpose & Capability

Name/description (persistent, cloud-backed memory) match the code and SKILL.md: the plugin talks to a Spark API, records/recalls episodes, runs nightly reflection, and is org-scoped. The required credentials (API key + org ID) are expected for a cloud memory service.

Instruction Scope

Runtime instructions and included code will automatically capture and send conversation content to the external Spark API (default https://zellin.ai/api). Capture triggers intentionally match PII patterns such as emails and phone numbers; while some redaction is implemented (passwords, PINs, SSNs, card numbers), email addresses and phone numbers are not redacted. The plugin also formats memories for injection back into prompts (<relevant-memories>) and explicitly shares memories across an organization — both have significant privacy implications. The SKILL.md does not sufficiently warn about automatic capture or cross-user sharing.

✓

Install Mechanism

No install script or external downloads are used; this is an instruction-and-code plugin included in the package. That reduces supply-chain risk (nothing fetched from arbitrary URLs during install).

ℹ

Credentials

Only an API key and org ID are required, which is proportionate for a cloud memory service. However, those credentials grant access to read/write org-scoped memories on the external service — a powerful capability. The plugin also offers a configurable apiUrl (advanced setting), which could be pointed at an alternative endpoint.

ℹ

Persistence & Privilege

The skill is not always-on and is user-invocable; autonomous invocation is allowed (platform default). Combined with automatic capture and an external API, autonomous runs increase the blast radius for data exfiltration, but the skill does not declare any elevated system privileges or attempt to modify other skills.

What to consider before installing

This plugin will send conversation content (including emails and phone-like strings) to an external service (default: zellin.ai) and store memories shared across an organization. Before installing: (1) Confirm the Spark service privacy policy and data retention rules and who in your org can access the org ID and API key; (2) Consider creating a limited-scope org/account or test tenant rather than using production data; (3) Disable autoCapture/autoRecall in the plugin config if you don't want automatic recording/injection; (4) Ask the vendor how PII is protected—email/phone capture is not redacted by the code and could be stored as plain text; (5) If necessary, set apiUrl to a private/trusted endpoint only after verifying its safety; (6) Limit who can install this plugin and rotate/revoke the API key if misuse is suspected. If you need, request the full, untruncated source for review (the submitted index.ts was truncated) and ask the author to explicitly redact emails/phones and surface explicit user-consent prompts for cross-user sharing.

index.ts:703

File read combined with network send (possible exfiltration).

About static analysis

These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Verification

{
  "hasProvenance": false,
  "scanStatus": "pending",
  "scope": "artifact-only",
  "sourceCommit": "fc382f0",
  "sourceRepo": "zellinun/spark-memory-plugin",
  "sourceTag": "main",
  "summary": "Validated package structure and linked the release to source metadata.",
  "tier": "source-linked"
}

🧠 Spark Memory — Persistent Intelligence for OpenClaw Agents

Your agent forgets everything when the session ends. Spark fixes that.

Spark gives your OpenClaw agent a memory that compounds. Not flat storage — a brain that reflects, learns patterns, and gets smarter every day.

What Makes Spark Different

Feature	memory-core	memory-lancedb	Spark
Store memories	✅ (files)	✅ (vectors)	✅ (vectors)
Semantic search	❌	✅	✅
Importance scoring	❌	Static 0.7	Dynamic (1-10)
Nightly reflection	❌	❌	✅ Synthesizes patterns
Recency × Relevance scoring	❌	❌	✅ Stanford formula
Cross-session learning	❌	✅	✅ + reflection
Episode types	❌	Basic categories	7 types
Multi-user support	❌	❌	✅ Org-scoped
Survives device loss	❌	❌	✅ Cloud-backed
Selective capture	❌	Trigger-based	✅ Intelligence-based

Install

openclaw plugins install @zellin/spark-memory

Then configure in your OpenClaw settings:

{
  plugins: {
    slots: { memory: "spark-memory" },
    entries: {
      "spark-memory": {
        config: {
          apiKey: "your-spark-api-key",
          orgId: "your-org-id"
        }
      }
    }
  }
}

Setup

Set these environment variables (or add to your OpenClaw config):

export SPARK_API_KEY="your-api-key"    # Get one at https://zellin.ai
export SPARK_ORG_ID="your-org-id"       # Created when you sign up

How It Works

Session starts → Spark recalls relevant memories from previous sessions
During conversation → Spark records important facts, preferences, decisions
Session ends → Spark saves a conversation summary
Every night → Spark reflects on accumulated memories, synthesizes patterns, detects recurring behaviors
Next session → Your agent is smarter than yesterday

Day 1: knows nothing. Day 30: knows your preferences, your clients, your patterns. Day 365: knows more about your operations than you remember yourself.

Architecture

Based on Stanford's "Generative Agents" paper with extensions:

Memory Stream (episodes) → Reflection (synthesis) → Patterns (recurring behaviors)
Retrieval scored by Recency × Importance × Relevance
Org-scoped: multiple users feed one shared memory
Cloud-backed: memories survive device changes

Free Tier

100 episodes/month
Basic recall
Nightly reflection included
Sign up at zellin.ai

License

MIT