Persistent, semantic memory for AI agents. Gives your AI long-term recall that survives compaction and session resets — 98% accuracy, 20ms latency.
Security Analysis
medium confidenceBrainDB's code and installer mostly match a local memory plugin, but there are multiple inconsistencies and privacy-sensitive behaviors (automatic capture of command outputs/workspace files, optional opt-in migration to an external API, auto-patching of OpenClaw config) that you should review before installing.
The name/description (persistent semantic memory) align with the included files: a gateway, embedder, Neo4j DB, migration and auto-capture code. Required binaries (docker, node) are reasonable for the bundled installer. However there are internal inconsistencies: the registry metadata said 'no install spec / no required config paths' while SKILL.md metadata and installer expect to write/patch ~/.openclaw/openclaw.json and create ~/.openclaw/plugins/braindb. The included code also reads many workspace and user files (~/bin/, workspace scripts, skills), which is plausible for a memory/migration tool but broader than the registry's earlier declarations.
Runtime instructions and code do more than simple encode/recall. install.sh will (by default) back up workspace files, start Docker containers, and patch OpenClaw's config to enable autoCapture/autoRecall. execution-awareness.js actively enumerates system/tooling (which CLI tools are installed, ~/bin scripts, workspace scripts, other installed skills) and auto-capture middleware (auto-capture.js) will ingest tool execution outputs (errors, command output) and encode them into the DB. That means command outputs, script contents, and discovered metadata can be stored automatically. The migration tool can optionally send file contents to Google's Gemini API if the user opts into '--swarm'. These behaviors are within a memory-plugin's remit but are high-risk for sensitive data exfiltration if not understood/controlled.
SKILL.md declares a download/install from a GitHub Releases URL (braindb-v0.5.0.zip) and postInstall runs the included install.sh; GitHub releases is a standard host. The installer builds and runs Docker Compose (building local images, downloading the embedding model). That is expected for this workload but will write files, create containers, and download a ~420MB model. The registry-level summary incorrectly indicated 'instruction-only' (no install spec) which is inconsistent with the packaged install scripts and SKILL.md metadata.
The skill requests no external API keys by default, and the gateway binds to localhost. It generates and stores NEO4J_PASSWORD in a .env and will patch your OpenClaw config. However the code reads numerous local paths and tool outputs (workspace files, ~/bin scripts, other skills' SKILL.md, /tmp/fleet-nodes.json), and auto-capture may store outputs of arbitrary tool executions (including errors and command output). Those actions can capture secrets or sensitive data. Migration can optionally transmit file contents to Google Gemini (opt-in via --swarm), which is explicitly documented but must be chosen by the user to expose data externally.
The installer patches OpenClaw config to enable the plugin and autoCapture by default (writes to ~/.openclaw/openclaw.json), creates Docker volumes and persists data. always:false so it's not force-included globally, but it does gain persistent presence in the agent config and autonomous invocation (autoCapture/autoRecall). That persistence is normal for a plugin but increases blast radius because the skill will run automatically and record data unless you disable it in config.
Guidance
Things to check before installing: - Review install.sh and the patch step that updates ~/.openclaw/openclaw.json. The installer will enable autoCapture/autoRecall automatically; if you prefer manual enablement, don't let the installer patch config or back up the config first. - Understand auto-capture: the plugin will automatically record tool execution results, discovered scripts, and workspace file metadata into the DB. That can include sensitive outputs (tokens, paths, command output). If you have secrets in outputs or files, either disable auto-capture or run the plugin in an isolated environment first. - Migration privacy: importing with --swarm will send file contents to Google's Gemini API. This is opt-in, but double-check you never run migrate.cjs without --no-swarm or without understanding the flag. Use --scan or --dry-run to preview what would be ingested. - Confirm local exposure: gateway is configured to bind to 127.0.0.1 only, and Neo4j/embedder are on an internal Docker network. Still verify port mappings and .env (NEO4J_PASSWORD) after install. - If you lack full trust in the release: run the installer in a disposable VM/container first, inspect generated .env and Docker images, and examine stored memories/exported backups before connecting to any production data. - If you want least privilege: decline the automatic config patch, keep BrainDB disabled until you audit encode/auto-capture behavior, and never use --swarm unless you explicitly need and approve external processing.
Latest Release
v0.5.2
Fix display name
More by @Chair4ce
Published by @Chair4ce on ClawHub
