ClawHub
Back to skill

Security audit

Bamdra Memory Upgrade Operator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local repair tool for managing one OpenClaw memory suite, with backups before it changes OpenClaw configuration or moves related files.

Install this only if you intend to manage the Bamdra memory suite. Before running it, confirm the OpenClaw home path and package spec, and keep the generated backup directory until you have verified OpenClaw starts and the memory suite works correctly.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly performs configuration edits and moves plugin/skill directories, but it does not clearly warn the user that filesystem state and OpenClaw configuration will be modified. In an agent setting, this can lead to unintended destructive changes, especially if the user expects a non-invasive repair action and the agent proceeds without explicit confirmation.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/upgrade-bamdra-memory.cjs:203