Community code plugin. Review compatibility and verification before install.
Latest release: v0.1.5Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (persistent memory) align with code and config. The plugin only needs an endpoint, optional apiKey, agentId, and projectId to provide the declared functionality; no unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md and source instruct the agent to batch and POST session events, checkpoints, summaries, heartbeats and derived metadata to the configured endpoint — exactly what a memory layer should do. Important note: all conversation turns, tool outputs, and derived summaries may be sent to the configured external endpoint; the plugin will also expose tool APIs (memory.record/log/flag/task) that allow the agent to push arbitrary text to that endpoint. This is expected behavior but means the endpoint must be trusted.
Install Mechanism
No install spec and no external downloads. Package.json and source files are present (source/plugin bundle model is normal). Dependencies are minimal (@sinclair/typebox) and heavy packages seen in the lockfile are dev/peer dependencies — no evidence of a remote install step or arbitrary code download.
Credentials
The plugin does not require environment variables or system credentials. Configuration is limited to endpoint, apiKey (optional), agentId, and projectId — all proportional to a network-backed memory service. The only sensitive flow is sending conversation data to the configured endpoint (controlled by the plugin owner/operator).
Persistence & Privilege
always is false and the plugin does not request elevated platform privileges. It registers a context engine and tools (normal for a memory plugin) and does not modify other skills or global settings.
Assessment
This plugin legitimately implements a persistent memory layer and will send conversation turns, tool outputs, checkpoints, and summaries to whatever endpoint you configure. Before installing, ensure the Lethe endpoint is trusted (prefer a local or organization-controlled server), protect any apiKey you supply, and consider data-retention/privacy policies: sensitive messages and tool outputs may be persisted and accessible to whoever operates the endpoint. If you need stricter guarantees, run Lethe on a local host or inside your secure network and avoid using third-party endpoints.