maasv Memory

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:21 PM UTC
• Version: 0.1.3

Overview

This is a disclosed local memory integration, with the main caution that it installs external packages and stores conversation-derived memory data.

Before installing, review the maasv and @maasv/openclaw-memory packages you will run, consider pinning exact versions, and enable autoCapture only if you are comfortable storing conversation summaries in a local SQLite memory database and sending needed content to your selected LLM or embedding provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-24
Vulnerability Type: Unpinned executable dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install "maasv[server,anthropic,voyage]"
cp server.env.example .env  # fill in API keys (see below)
maasv-server

bash

openclaw plugins install @maasv/openclaw-memory

Technical Analysis

The installation instructions resolve maasv and @maasv/openclaw-memory without fixed versions, lockfiles, cryptographic hashes, or signature verification. Consequently, the code installed by these commands can change after the Skill has been reviewed.

The PyPI package is installed and its maasv-server executable is subsequently launched. The npm package is installed as an OpenClaw plugin and activated as the agent's memory backend. These components therefore execute with the permissions of the installing user and may receive conversation summaries, persistent memory records, configuration values, and provider credentials.

This finding does not establish that the referenced packages are currently malicious. The vulnerability is the unsafe trust placed in mutable package-registry releases. A compromised maintainer account, registry compromise, or malicious future release could turn the documented installation path into arbitrary code execution.

Attack Path

1. An attacker compromises a package maintainer or registry account, or otherwise causes a malicious release to be published under one of the referenced package names.
2. Because no version or integrity value is specified, a user following the instructions resolves the malicious release.
3. Malicious code executes during package installation, when maasv-server is launched, or when the OpenClaw memory plugin is loaded.
4. The code runs with the installing user's privileges and can inspect accessible files, environment variables, configuration, and memory data.
5. It may steal ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both dependencies to specifically reviewed versions, for example by using exact PyPI and npm package versions.
2. Publish a lockfile or constraints file that fixes all transitive dependency versions.
3. Verify package integrity with trusted hashes, signed provenance, or registry signature mechanisms before installation.
4. Document the expected package publisher, release provenance, and verified checksums.
5. Test updates in an isolated environment and require explicit review before changing pinned versions.
6. Run the server and plugin as a dedicated, unprivileged account with restricted filesystem and environment access.
7. Expose only the credentials required for the selected providers and avoid placing unrelated secrets in the process environment.
8. Restrict access to the local memory database and monitor dependency advisories and package ownership changes.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

bash

pip install "maasv[server,anthropic,voyage]"
cp server.env.example .env  # fill in API keys (see below)
maasv-server

Static analysis

No suspicious patterns detected.