ClawHub
Back to skill

Security audit

Auto Memory

Security checks across malware telemetry and agentic risk

Overview

This skill clearly implements permanent public memory storage, and the reviewed artifacts disclose the key risks rather than hiding unrelated behavior.

Install only if you intentionally want an agent to upload selected memories or files to permanent public decentralized storage. Do not store secrets, credentials, private personal data, regulated data, or proprietary workspace snapshots unless you have reviewed and encrypted them first; protect the local Auto Drive API key because it is saved in plaintext config files with file permissions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The skill advertises durable memory storage, but also includes setup flows that open a browser, collect and persist API credentials, inspect account state, and download arbitrary files by CID. That broader capability increases the trust surface and may cause an agent or user to invoke credential-handling or unrelated retrieval behaviors under the simpler label of 'memory,' which can lead to unintended disclosure or over-broad use.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases are broad enough that routine conversation such as 'remember this permanently' or 'load history' could invoke a skill that writes public, immutable data to decentralized storage. In this context, accidental invocation is especially risky because uploads are irreversible and may expose sensitive agent context, identity, or user data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document repeatedly emphasizes that data stored via Autonomys/Auto Drive is permanent and 'never lost,' but it does not clearly warn that any sensitive, regulated, or mistakenly uploaded data may be irreversible and publicly retrievable indefinitely. In the context of an agent memory skill, this is more dangerous because agents may automatically persist prompts, identities, decisions, secrets, or personal data, increasing the risk of irreversible privacy and data-governance violations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document explicitly encourages storing 'full file snapshots' and 'anything worth keeping permanently' on immutable decentralized storage, but it does not warn about privacy, secret leakage, or the irreversibility of publishing sensitive data. In an agent-memory context, this is especially risky because memories may include tokens, credentials, personal data, internal prompts, or proprietary workspace contents that cannot be deleted once uploaded.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script uploads the full memory payload to a remote service via `automemory-upload.sh` without an explicit runtime warning, confirmation, or content redaction step. In an agent-memory context, payloads may contain prompts, secrets, tokens, or sensitive workspace data, so silent exfiltration to a network service creates a meaningful confidentiality risk.

Credential Access

High
Category
Privilege Escalation
Content
AD_BASE_URL="https://mainnet.auto-drive.autonomys.xyz/api"
AD_DOWNLOAD_URL="https://public.auto-drive.autonomys.xyz/api"
AM_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}"
AM_ENV_FILE="$AM_OPENCLAW_DIR/.env"
AM_CONFIG_FILE="$AM_OPENCLAW_DIR/openclaw.json"

GREEN='\033[0;32m'
Confidence
95% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
fi
  echo -e "${GREEN}✓ Saved to $AM_CONFIG_FILE${NC}"

  # --- .env ------------------------------------------------------------------
  # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates,
  # then append exactly one entry.
  if [[ -f "$AM_ENV_FILE" ]]; then
Confidence
96% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
sed '/^AUTO_DRIVE_API_KEY=/d' "$AM_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AM_ENV_FILE"
  fi
  # Single-quote the value so characters like #, $, and backticks are
  # preserved literally when the .env file is later sourced by bash.
  local safe_key="${key//\'/\'\\\'\'}"
  echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AM_ENV_FILE"
  chmod 600 "$AM_ENV_FILE"
Confidence
97% confidence
Finding
.env

Session Persistence

Medium
Category
Rogue Agent
Content
license: Apache-2.0
description: Indestructible agent memory — permanently stored, never lost. Save decisions, identity, and context as a memory chain on the Autonomys Network. Rebuild your full history from a single CID, even after total state loss.
compatibility: Requires curl, jq, and the file utility, plus outbound HTTPS to the Autonomys Auto Drive API (ai3.storage) and public gateway. Stored data is permanent and public — do not store secrets. Works with OpenClaw and Hermes agents on macOS and Linux.
allowed-tools: Bash(curl:*) Bash(jq:*) Bash(file:*) Read Write
metadata:
  openclaw:
    emoji: "🧬"
Confidence
90% confidence
Finding
Write metadata: openclaw: emoji: "🧬" primaryEnv: AUTO_DRIVE_API_KEY requires: bins: ["curl", "jq", "file"] env: ["AUTO_DRIVE_API_KEY"] install: - id: curl-brew

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.