Code PluginExecutes codesource-linked

Cortex Memory

Long-term memory system for OpenClaw AI Agent

Community code plugin. Review compatibility and verification before install.

openclaw-cortex-memory · runtime id openclaw-cortex-memory

Install

openclaw plugins install clawhub:openclaw-cortex-memory

Latest Release

Version 0.1.0-Alpha.8

Download zip

Compatibility

{
  "builtWithOpenClawVersion": "0.1.0-Alpha.8",
  "pluginApiRange": ">=2026.3.22"
}

Capabilities

{
  "bundledSkills": [],
  "capabilityTags": [
    "executes-code",
    "tools"
  ],
  "channels": [],
  "commandNames": [],
  "configSchema": true,
  "configUiHints": false,
  "executesCode": true,
  "hooks": [
    "message_received",
    "session_end"
  ],
  "httpRouteCount": 0,
  "materializesDependencies": false,
  "providers": [],
  "runtimeId": "openclaw-cortex-memory",
  "serviceNames": [],
  "setupEntry": false,
  "toolNames": [
    "search_memory",
    "store_event",
    "query_graph",
    "get_hot_context",
    "get_auto_context",
    "reflect_memory",
    "sync_memory",
    "delete_memory",
    "diagnostics"
  ]
}

Security Scan

VirusTotal

Benign

View report →

OpenClaw

Suspicious

medium confidence

Purpose & Capability

The code implements exactly the described memory features (archive, vector store, deduplication, reflection, session sync). However the registry metadata lists no required environment variables or credentials while SKILL.md and the code expect embedding/LLM/reranker API keys and base URLs; that mismatch is incoherent and worth flagging. The plugin also reads/writes OpenClaw config and creates a data/memory directory — behavior consistent with a memory plugin but not declared in metadata.

ℹ

Instruction Scope

SKILL.md's runtime instructions and config focus on memory functionality and installation. The plugin will read and write local files (openclaw.json, memory data under plugin dir, schema/graph.schema.yaml) and may perform automated background operations (autoSync, autoReflect). autoReflect uses an LLM endpoint to generate rules from archived events — this means conversation content can be sent to external LLM/embedding endpoints if enabled. SKILL.md warns to keep autoReflect off until validated, which is appropriate; still, the ability to autonomously send historical conversational data to configured endpoints expands the plugin's scope and risk.

✓

Install Mechanism

Installation instructions use pnpm/openclaw plugin install or an npm registry tarball (registry.npmjs.org) and a git clone. These are normal, well-known sources. There is no opaque download from an unknown host in the provided instructions. The package contains many compiled/dist files and a CLI script which will modify config — expected for this type of plugin.

Credentials

The plugin clearly requires API credentials (embedding.apiKey, llm.apiKey, reranker.apiKey or equivalent) and a Node.js runtime per SKILL.md and the source code (network requests to baseURL with Bearer tokens). Yet the registry metadata declares no required env vars or primary credential — an under-declaration. The plugin also reads and writes local storage under the agent project (dbPath/data/memory) and openclaw.json; those config and file accesses were not declared either. Asking for LLM/embedding keys is reasonable for its purpose, but the metadata omission is a coherence/visibility problem.

ℹ

Persistence & Privilege

always is false (good). The provided CLI and code will modify openclaw.json to add/enable the plugin and will write data to a memory directory. Changing the agent config and creating persistent memory files is normal for a memory plugin, but combined with autonomous invocation (allowed by default) and network calls to LLM/embedding endpoints this increases the blast radius — especially if keys/endpoints are misconfigured or untrusted. SKILL.md recommends leaving autoReflect disabled by default.

Scan Findings in Context

[network_fetch_calls] expected: Code makes HTTP POST requests (fetch) to embedding and LLM endpoints using configured baseURLs and API keys. This is expected for a memory plugin that computes embeddings and uses LLMs for reflection/reranking, but it means conversational content and summaries will be transmitted to external endpoints if configured.

[child_process_spawn] expected: The CLI and index code use child_process.spawn / process.execPath for running uninstall scripts. This is expected for a CLI that manages plugin enable/disable/uninstall, but it has the usual risk of executing local scripts — verify scripts before running and prefer repository/package signatures.

[local_config_write] expected: The CLI writes to openclaw.json and the plugin writes to project data/memory paths. This is expected for a persistent memory plugin, but the registry metadata did not declare required config paths, so the write/read behavior is not visible from metadata alone.

What to consider before installing

This plugin appears to implement the long‑term memory features it claims, but there are two important mismatches to consider before installing: (1) the registry metadata does not declare the API keys and config files the plugin expects, and (2) the plugin will modify openclaw.json and create persistent memory files and can send archived/session content to external LLM/embedding endpoints if enabled. Recommendations: (a) only install from the official npm/ClawHub source or verified GitHub repo and inspect SIGNATURE.md and the package signature if provided; (b) review the code (especially scripts/cli.js and dist/index.js) and the CLI uninstall script before running; (c) do not enable autoReflect or autoSync until you’ve tested locally — these features will cause automatic network calls using your LLM/embedding keys; (d) provide API keys only to trusted endpoints (set explicit baseURL values) and consider using a limited-privilege key or a proxy if you must protect data; (e) run first in an isolated environment or staging instance and verify removal behavior (uninstall options) before enabling in production. If you want, I can point to the exact lines that send data externally and the config keys to verify or redact prior to installation.

✗

scripts/cli.js:185

Shell command execution detected (child_process).

✗

dist/index.js:486

Environment variable access combined with network send.

dist/index.js:543