registry / @tencentdb-agent-memory/memory-tencentdb / 1.0.1

@tencentdb-agent-memory/memory-tencentdb@1.0.1

Four-layer local memory system plugin for OpenClaw — auto-captures, structures, and profiles conversational knowledge using local LLM + SQLite vector search (L0→L1→L2→L3 pipeline)

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 220 file(s), 3.17 MB of source, external domains: 127.0.0.1, api.openai.com

Source & flagged code

6 flagged

package.jsonView file

Lines 15-55json

15 "default": "./dist/index.mjs"

16 }

17 },

18 "scripts": {

19 "build": "npm run build:plugin && npm run build:scripts",

20 "build:plugin": "tsdown",

21 "build:scripts": "npm run build:migrate-sqlite-to-vdb && npm run build:export-tencent-vdb && npm run build:read-local-memory && npm run build:seed-v2",

22 "prepack": "npm run build",

23 "build:migrate-sqlite-to-vdb": "tsc -p scripts/migrate-sqlite-to-tcvdb/tsconfig.json --noEmitOnError false",

24 "migrate-sqlite-to-tcvdb": "node ./bin/migrate-sqlite-to-tcvdb.mjs",

25 "build:export-tencent-vdb": "tsc --project scripts/export-tencent-vdb/tsconfig.json",

26 "export-tencent-vdb": "node ./bin/export-tencent-vdb.mjs",

27 "build:read-local-memory": "tsc --project scripts/read-local-memory/tsconfig.json",

28 "read-local-memory": "node ./bin/read-local-memory.mjs",

29 "build:seed-v2": "tsc --project scripts/seed-v2/tsconfig.json",

30 "seed-v2": "node ./bin/seed-v2.mjs",

31 "test": "vitest run",

32 "test:oss": "vitest run -c vitest.oss.config.ts",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "postinstall": "bash scripts/openclaw-after-tool-call-messages.patch.sh 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 },

37 "files": [

38 "dist/",

39 "bin/migrate-sqlite-to-tcvdb.mjs",

40 "bin/export-tencent-vdb.mjs",

41 "bin/read-local-memory.mjs",

42 "index.ts",

43 "scripts/migrate-sqlite-to-tcvdb/dist/",

44 "scripts/export-tencent-vdb/dist/",

45 "scripts/read-local-memory/dist/",

46 "scripts/memory-tencentdb-ctl.sh",

47 "scripts/install_hermes_memory_tencentdb.sh",

48 "scripts/install-hermes-plugin-v2.sh",

49 "scripts/install-openclaw-plugin-v2.sh",

50 "scripts/README.memory-tencentdb-ctl.md",

51 "src",

52 "scripts/openclaw-after-tool-call-messages.patch.sh",

53 "scripts/setup-offload.sh",

54 "hermes-plugin/",

55 "openclaw-plugin/",

bin/export-tencent-vdb.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3// 薄启动器：加载预编译好的 VDB 导出脚本。

4// 构建：npm run build:export-vdb

5// 使用：npm run export:vdb -- [参数] 或 node ./bin/export-tencent-vdb.mjs [参数]

7import path from "node:path";

8import { fileURLToPath } from "node:url";

dist/index.mjsView file

13import { fileURLToPath } from "url"; L14: import * as https from "node:https"; L15: import * as http from "node:http"; ... L131: cleaned = cleaned.replace(/^System:\s*\[[\s\S]*?$/gm, ""); L132: cleaned = cleaned.replace(/data:image\/[a-z+]+;base64,[A-Za-z0-9+/=]+/gi, ""); L133: cleaned = cleaned.replace(/\0/g, "").replace(/\n{3,}/g, "\n\n").trim(); ... L2338: /** Default root data directory (parent of all agent subdirectories) */ L2339: const DEFAULT_DATA_ROOT = join(homedir(), ".openclaw", "context-offload"); L2340: /** ... L5568: · 如果输入中该 tool pair 标记了 [NEEDS_COMPRESS]，你必须将工具名+关键参数压缩为一句简洁的描述（≤150字符），保留工具名、操作目标（如文件路径、命令意图），省略内联脚本/大段内容的细节。 L5569: 示例：exec({"command":"python3 -c 'import csv; ...200行脚本...'"}) → "exec: 运行 Python （xx/xx/xx.sh，标明具体路径和文件）脚本分析 sales_channels.csv 数据质量" L5570:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L13

hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.pyView file

•path = hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.pyView on unpkg

•path = hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.py kind = build_helper sizeBytes = 0

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hermes-plugin/memory/memory_tencentdb_v2/tests/__init__.pyView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

@tencentdb-agent-memory/memory-tencentdb@1.0.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code