{
  "schemaVersion": "1.0",
  "item": {
    "slug": "memory-scan",
    "name": "Memory Scan",
    "source": "tencent",
    "type": "skill",
    "category": "效率提升",
    "sourceUrl": "https://clawhub.ai/dgriffin831/memory-scan",
    "canonicalUrl": "https://clawhub.ai/dgriffin831/memory-scan",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/memory-scan",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=memory-scan",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "CHANGELOG.md",
      "TESTING.md",
      "README.md",
      "SKILL.md",
      "scripts/schedule-scan.sh",
      "scripts/setup-venv.sh"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "slug": "memory-scan",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-30T09:12:23.599Z",
      "expiresAt": "2026-05-07T09:12:23.599Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=memory-scan",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=memory-scan",
        "contentDisposition": "attachment; filename=\"memory-scan-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null,
        "slug": "memory-scan"
      },
      "scope": "item",
      "summary": "Item download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this item.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/memory-scan"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/memory-scan",
    "agentPageUrl": "https://openagent3.xyz/skills/memory-scan/agent",
    "manifestUrl": "https://openagent3.xyz/skills/memory-scan/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/memory-scan/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "memory-scan",
        "body": "Security scanner for OpenClaw agent memory files\n\nScans MEMORY.md, daily logs (memory/*.md), and workspace configuration files for malicious content, prompt injection, credential leakage, and dangerous instructions that could compromise user security."
      },
      {
        "title": "Purpose",
        "body": "Detect security threats embedded in agent memory:\n\nMalicious instructions to bypass guardrails\nPrompt injection patterns in stored memories\nCredential/secret leakage\nData exfiltration commands\nBehavioral manipulation\nSecurity policy violations"
      },
      {
        "title": "On-Demand Scan",
        "body": "Scan all memory files:\n\npython3 skills/memory-scan/scripts/memory-scan.py\n\nAllow remote LLM analysis (redacted content only):\n\npython3 skills/memory-scan/scripts/memory-scan.py --allow-remote\n\nScan specific file:\n\npython3 skills/memory-scan/scripts/memory-scan.py --file memory/2026-02-01.md\n\nQuiet mode (for automation):\n\npython3 skills/memory-scan/scripts/memory-scan.py --quiet\n\nJSON output:\n\npython3 skills/memory-scan/scripts/memory-scan.py --json"
      },
      {
        "title": "Scheduled Monitoring",
        "body": "Cron Job (Daily Security Audit)\n\nAlready included in safe-install daily audit - runs 2pm PT daily.\n\nTo add standalone cron:\n\nbash skills/memory-scan/scripts/schedule-scan.sh\n\nRequires:\n\nOPENCLAW_ALERT_CHANNEL (configured in OpenClaw)\nOPENCLAW_ALERT_TO (optional, for channels that require a recipient)\n\nCreates cron job: daily at 3pm PT, sends alert only if threats found.\n\nHeartbeat Integration\n\nAdd to HEARTBEAT.md:\n\n## Weekly Memory Scan\n\nEvery Sunday, run memory scan:\npython3 skills/memory-scan/scripts/memory-scan.py --quiet"
      },
      {
        "title": "Security Levels",
        "body": "SAFE - No threats detected\nLOW - Minor concerns, proceed with awareness\nMEDIUM - Potential threat, review recommended\nHIGH - Likely threat, immediate review required\nCRITICAL - Active threat detected, quarantine recommended"
      },
      {
        "title": "What It Scans",
        "body": "MEMORY.md - Long-term memory\nmemory/*.md - Daily logs (last 30 days by default)\nWorkspace config files:\n\nAGENTS.md, SOUL.md, USER.md, TOOLS.md\nHEARTBEAT.md, GUARDRAILS.md, IDENTITY.md\nBOOTSTRAP.md (if exists)\nSTOCKS_MEMORIES.md (if exists)"
      },
      {
        "title": "Detection Categories",
        "body": "Malicious Instructions - Commands to harm user/data\nPrompt Injection - Embedded manipulation patterns\nCredential Leakage - API keys, passwords, tokens\nData Exfiltration - Instructions to leak data\nGuardrail Bypass - Attempts to override security\nBehavioral Manipulation - Unauthorized personality changes\nPrivilege Escalation - Attempts to gain unauthorized access"
      },
      {
        "title": "Alert Workflow",
        "body": "On MEDIUM/HIGH/CRITICAL detection:\n\nStop processing\nSend alert via configured OpenClaw channel with:\n\nSeverity level\nFile location (file:line)\nThreat description\nRecommended action\n\n\nOptional: Quarantine threat (backup + redact)"
      },
      {
        "title": "LLM Provider",
        "body": "Auto-detects provider from OpenClaw config:\n\nPrefers OpenAI (gpt-4o-mini) if OPENAI_API_KEY set\nFalls back to Anthropic (claude-sonnet-4-5) if available\nUses gateway model config\n\nRemote LLM scanning is disabled by default. Use --allow-remote to enable\nredacted LLM analysis."
      },
      {
        "title": "Quarantine",
        "body": "To quarantine a detected threat:\n\npython3 skills/memory-scan/scripts/quarantine.py memory/2026-02-01.md 42\n\nCreates:\n\nBackup: .memory-scan/quarantine/memory_2026-02-01_line42.backup\nRedacts line 42 with: [QUARANTINED BY MEMORY-SCAN: <timestamp>]"
      },
      {
        "title": "Files",
        "body": "scripts/memory-scan.py - Main scanner (local patterns + optional LLM with --allow-remote)\nscripts/schedule-scan.sh - Create cron job for daily scans\nscripts/quarantine.py - Quarantine detected threats\ndocs/detection-prompt.md - LLM detection prompt template"
      },
      {
        "title": "Integration with Other Skills",
        "body": "safe-install: Daily audit already includes memory-scan\ninput-guard: Complementary (input-guard = external, memory-scan = internal)\nmolthreats: Can report memory-based threats to community feed"
      },
      {
        "title": "Example",
        "body": "$ python3 skills/memory-scan/scripts/memory-scan.py\n\n🧠 Memory Security Scan\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nScanning memory files...\n\n✓ MEMORY.md - SAFE\n✓ memory/2026-02-01.md - SAFE\n⚠ memory/2026-01-30.md - MEDIUM (line 42)\n  → Potential credential leakage: API key pattern detected\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOverall: MEDIUM\nAction: Review memory/2026-01-30.md:42"
      },
      {
        "title": "Agent Workflow",
        "body": "When user requests memory scan:\n\nRun: python3 skills/memory-scan/scripts/memory-scan.py\nIf MEDIUM+: Send alert immediately via configured channel\nSummarize findings\nAsk if user wants to quarantine threats"
      },
      {
        "title": "Notes",
        "body": "Scans last 30 days of daily logs by default (configurable with --days)\nUses same LLM approach as input-guard for consistency\nDoes NOT auto-quarantine - always asks first\nSafe to run frequently (minimal API cost with efficient chunking)"
      }
    ],
    "body": "memory-scan\n\nSecurity scanner for OpenClaw agent memory files\n\nScans MEMORY.md, daily logs (memory/*.md), and workspace configuration files for malicious content, prompt injection, credential leakage, and dangerous instructions that could compromise user security.\n\nPurpose\n\nDetect security threats embedded in agent memory:\n\nMalicious instructions to bypass guardrails\nPrompt injection patterns in stored memories\nCredential/secret leakage\nData exfiltration commands\nBehavioral manipulation\nSecurity policy violations\nUsage\nOn-Demand Scan\n\nScan all memory files:\n\npython3 skills/memory-scan/scripts/memory-scan.py\n\n\nAllow remote LLM analysis (redacted content only):\n\npython3 skills/memory-scan/scripts/memory-scan.py --allow-remote\n\n\nScan specific file:\n\npython3 skills/memory-scan/scripts/memory-scan.py --file memory/2026-02-01.md\n\n\nQuiet mode (for automation):\n\npython3 skills/memory-scan/scripts/memory-scan.py --quiet\n\n\nJSON output:\n\npython3 skills/memory-scan/scripts/memory-scan.py --json\n\nScheduled Monitoring\nCron Job (Daily Security Audit)\n\nAlready included in safe-install daily audit - runs 2pm PT daily.\n\nTo add standalone cron:\n\nbash skills/memory-scan/scripts/schedule-scan.sh\n\n\nRequires:\n\nOPENCLAW_ALERT_CHANNEL (configured in OpenClaw)\nOPENCLAW_ALERT_TO (optional, for channels that require a recipient)\n\nCreates cron job: daily at 3pm PT, sends alert only if threats found.\n\nHeartbeat Integration\n\nAdd to HEARTBEAT.md:\n\n## Weekly Memory Scan\n\nEvery Sunday, run memory scan:\npython3 skills/memory-scan/scripts/memory-scan.py --quiet\n\nSecurity Levels\nSAFE - No threats detected\nLOW - Minor concerns, proceed with awareness\nMEDIUM - Potential threat, review recommended\nHIGH - Likely threat, immediate review required\nCRITICAL - Active threat detected, quarantine recommended\nWhat It Scans\nMEMORY.md - Long-term memory\nmemory/*.md - Daily logs (last 30 days by default)\nWorkspace config files:\nAGENTS.md, SOUL.md, USER.md, TOOLS.md\nHEARTBEAT.md, GUARDRAILS.md, IDENTITY.md\nBOOTSTRAP.md (if exists)\nSTOCKS_MEMORIES.md (if exists)\nDetection Categories\nMalicious Instructions - Commands to harm user/data\nPrompt Injection - Embedded manipulation patterns\nCredential Leakage - API keys, passwords, tokens\nData Exfiltration - Instructions to leak data\nGuardrail Bypass - Attempts to override security\nBehavioral Manipulation - Unauthorized personality changes\nPrivilege Escalation - Attempts to gain unauthorized access\nAlert Workflow\n\nOn MEDIUM/HIGH/CRITICAL detection:\n\nStop processing\nSend alert via configured OpenClaw channel with:\nSeverity level\nFile location (file:line)\nThreat description\nRecommended action\nOptional: Quarantine threat (backup + redact)\nLLM Provider\n\nAuto-detects provider from OpenClaw config:\n\nPrefers OpenAI (gpt-4o-mini) if OPENAI_API_KEY set\nFalls back to Anthropic (claude-sonnet-4-5) if available\nUses gateway model config\n\nRemote LLM scanning is disabled by default. Use --allow-remote to enable redacted LLM analysis.\n\nQuarantine\n\nTo quarantine a detected threat:\n\npython3 skills/memory-scan/scripts/quarantine.py memory/2026-02-01.md 42\n\n\nCreates:\n\nBackup: .memory-scan/quarantine/memory_2026-02-01_line42.backup\nRedacts line 42 with: [QUARANTINED BY MEMORY-SCAN: <timestamp>]\nFiles\nscripts/memory-scan.py - Main scanner (local patterns + optional LLM with --allow-remote)\nscripts/schedule-scan.sh - Create cron job for daily scans\nscripts/quarantine.py - Quarantine detected threats\ndocs/detection-prompt.md - LLM detection prompt template\nIntegration with Other Skills\nsafe-install: Daily audit already includes memory-scan\ninput-guard: Complementary (input-guard = external, memory-scan = internal)\nmolthreats: Can report memory-based threats to community feed\nExample\n$ python3 skills/memory-scan/scripts/memory-scan.py\n\n🧠 Memory Security Scan\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nScanning memory files...\n\n✓ MEMORY.md - SAFE\n✓ memory/2026-02-01.md - SAFE\n⚠ memory/2026-01-30.md - MEDIUM (line 42)\n  → Potential credential leakage: API key pattern detected\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOverall: MEDIUM\nAction: Review memory/2026-01-30.md:42\n\nAgent Workflow\n\nWhen user requests memory scan:\n\nRun: python3 skills/memory-scan/scripts/memory-scan.py\nIf MEDIUM+: Send alert immediately via configured channel\nSummarize findings\nAsk if user wants to quarantine threats\nNotes\nScans last 30 days of daily logs by default (configurable with --days)\nUses same LLM approach as input-guard for consistency\nDoes NOT auto-quarantine - always asks first\nSafe to run frequently (minimal API cost with efficient chunking)"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/dgriffin831/memory-scan",
    "publisherUrl": "https://clawhub.ai/dgriffin831/memory-scan",
    "owner": "dgriffin831",
    "version": "1.0.0",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/memory-scan",
    "downloadUrl": "https://openagent3.xyz/downloads/memory-scan",
    "agentUrl": "https://openagent3.xyz/skills/memory-scan/agent",
    "manifestUrl": "https://openagent3.xyz/skills/memory-scan/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/memory-scan/agent.md"
  }
}