Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real EverOS memory plugin, but it needs Review because it automatically persists conversation content and uses unsafe install and memory-injection patterns.
Install only if you trust EverMind, the npm package, and the EverOS backend you configure. Prefer pinning the npm package to the reviewed version, avoid curl-to-shell setup, keep the backend on localhost or HTTPS, review changes to ~/.openclaw/openclaw.json, and avoid sensitive conversations until logging, retention, deletion, and memory-review controls are acceptable for your environment.
SKILL.md:130Remote Installer Is Downloaded and Executed Without Integrity Verification
src/engine.js:218Backend-Controlled Persistent Memory Is Injected at System-Message Priority
src/api.js:28Sensitive Conversation and Memory Data Is Logged Without Redaction
src/config.js:5Automatic Conversation Export Allows Arbitrary and Plaintext Backend URLs
SKILL.md:140Preferred Installation Executes an Unpinned Registry Package
The README explicitly instructs curl -LsSf https://astral.sh/uv/install.sh | sh, which chains network retrieval directly into shell execution. This is dangerous because any compromise of the hosting domain, CDN, TLS interception point, or upstream script would result in arbitrary command execution on the user's machine.
git clone https://github.com/EverMind-AI/EverMemOS.git
cd EverMemOS
docker compose up -d
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp env.template .env
# edit .env
The | sh construct chains network retrieval directly into shell execution, creating a high-risk remote code execution pathway. In this skill context, where users are being guided through installation, the likelihood of blind copy-paste is high, so a compromise of the remote script source would immediately compromise the host system.
git clone https://github.com/EverMind-AI/EverMemOS.git
cd EverMemOS
docker compose up -d
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp env.template .env
# 编辑 .env
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
docker compose up -d curl -LsSf https://astral.sh/uv/install.sh | sh uv sync cp env.template .env
uv run python src/run.py
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
docker compose up -d curl -LsSf https://astral.sh/uv/install.sh | sh uv sync cp env.template .env
uv run python src/run.py
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
docker compose up -d curl -LsSf https://astral.sh/uv/install.sh | sh uv sync cp env.template .env
uv run python src/run.py
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
docker compose up -d curl -LsSf https://astral.sh/uv/install.sh | sh uv sync cp env.template .env
uv run python src/run.py
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
docker compose up -d curl -LsSf https://astral.sh/uv/install.sh | sh uv sync cp env.template .env
uv run python src/run.py
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
docker compose up -d curl -LsSf https://astral.sh/uv/install.sh | sh uv sync cp env.template .env
uv run python src/run.py
The declared description says this skill installs and configures EverOS for OpenClaw memory. However, the provided code only acts as a plugin entry point: it loads plugin metadata, logs registration, and calls api.registerContextEngine to register the EverOS backend. That aligns with enabling/integrating a memory backend, but not with actually installing or configuring software. Because the primary described action is installation/setup while the observable behavior is plugin registration, this is a material description-versus-behavior mismatch.
The declared description says this skill installs and configures EverOS for OpenClaw memory. However, the supplied code does not perform installation, setup, enablement, or configuration tasks. Instead, it implements operational memory-service client functions: searching memories by type and saving chat messages as memory records through HTTP requests to backend API endpoints. This is a materially different primary purpose from installation/configuration. The code also handles and transmits user/assistant message content, user/group identifiers, and flush behavior to a remote service, which is a meaningful capability absent from the description and inconsistent with the empty declared permissions.
The declared description says this skill installs/configures EverOS for OpenClaw memory. The supplied code does not install, configure, enable, or manage any plugin or memory system. Instead, it is a utility module that transforms message objects: it strips context markers from user text, caps message length, drops unsupported roles, flattens block content, and summarizes tool calls. That is a materially different primary purpose from installation/setup, so this is a clear description-behavior mismatch.
The description claims this skill is for installing and configuring EverOS, triggered by phrases like 'install everos' or 'setup everos.' The supplied code does not perform installation or setup tasks such as downloading packages, modifying configuration files, enabling plugins, or provisioning services. Instead, it is the core runtime engine for an already-installed memory system: it bootstraps sessions, calls a backend /health endpoint, tracks session state, saves messages via saveMemories, retrieves contextual memories through an assembler, injects them as system messages, and manages subagent-related context. This is a materially different primary purpose from installation/configuration, so the description does not accurately represent the code's actual behavior.
The declared purpose is about installing and configuring EverOS memory functionality for OpenClaw. The supplied code does not perform installation, configuration, plugin enablement, memory management, or any EverOS/OpenClaw setup actions. Instead, it implements a helper to flatten text content and a detector for a specific session-reset prompt based on edit distance. This is a materially different primary purpose and appears unrelated to the declared installation/setup behavior.
The declared description says this skill installs and configures EverOS, implying setup or system/plugin installation behavior. The supplied code does not perform installation, configuration, plugin enablement, or environment changes. Instead, it is purely prompt/memory-processing logic: it parses returned memory search data, selects/filter memories by type and score, formats timestamps, and generates an XML-like memory section plus guidance text for an LLM prompt. This is a materially different primary purpose from installation/configuration, so the description does not accurately represent the code.
The declared description says this skill installs and configures EverOS for OpenClaw memory, implying setup actions. The code shown instead is a runtime retrieval component: it calls searchMemories with query/user/group parameters, parses the response, counts memories, and builds a memory prompt string. It also has a separate path for subagent context assembly. There is no code for installation, plugin setup, enabling memory, modifying system configuration, or handling setup triggers. This is a material description-behavior mismatch because the primary purpose is memory retrieval/context assembly, not installation/configuration.
The declared description says this skill installs and configures EverOS for OpenClaw memory features. The supplied code does not install, configure, or enable anything; it only provides an in-memory tracker for subagent lifecycle state and cleanup, plus logging. While subagent tracking may be a supporting internal component of a memory system, this chunk’s primary behavior is materially different from the declared install/setup purpose, so this is a description-behavior mismatch.
The use of curl ... | sh creates an immediate command-execution chain from untrusted network content to the local shell, bypassing review and integrity checks. In the context of a skill that may automate shell actions, this materially increases the chance of remote code execution if the fetched script is malicious or tampered with.
git clone https://github.com/EverMind-AI/EverMemOS.git
cd EverMemOS
docker compose up -d
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp env.template .env
# edit .env
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
| GET | `/health` | Health check |
| POST | `/api/v1/memories` | Save memory |
| GET | `/api/v1/memories/search` | Search memory |
| DELETE | `/api/v1/memories` | Delete memory |
---
The README advertises automatic saving of conversation content after each turn but does not clearly warn users that their prompts and responses will be persisted and transmitted to a backend. In a memory plugin context, this can lead to unintended storage of sensitive personal, operational, or confidential data.
The README instructs users to execute an unpinned package via npx, which fetches and runs the latest published installer code at execution time. If the package is compromised, typosquatted, or a malicious update is published, users could execute arbitrary code during installation.
The installer changes an existing OpenClaw configuration and disables the memory slot by setting plugins.slots.memory = "none", but the README does not present this as a prominent warning before execution. Silent or under-emphasized configuration changes can disrupt existing security controls, workflows, or expected memory behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Health check:
curl http://localhost:1995/health
If you have not started the EverOS backend yet:
The README states that each conversation turn is automatically saved to the backend, but it does not foreground the privacy and data-retention implications before users enable it. Because this plugin handles natural-language memory, it is likely to collect sensitive personal or organizational information, making silent persistence materially risky in this context.
The README recommends executing an unpinned package directly with npx, which fetches whatever version is current at execution time. This creates a supply-chain risk: a compromised publisher account, malicious new release, or dependency hijack could cause arbitrary code to run on the user's system during installation.
The installation steps automatically modify OpenClaw configuration, enable this plugin, and disable the existing memory slot without a clear up-front warning. Unexpected configuration changes can break existing setups, alter security/privacy posture, or silently replace another memory mechanism with different trust assumptions.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access