Openclaw mneme vision

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed local photo and video search helper, with a notable but non-malicious supply-chain caution around its unpinned server install.

Install only if you trust the mneme-mcp package source and are comfortable letting it index selected local media folders. For stronger supply-chain control, pin the MCP package to a reviewed version or install it in a restricted environment with access only to intended media directories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: openclaw.json:10

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: README.md:15-24; openclaw.json:10
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

README.md:15-24:

bash

mcporter add mneme -- uvx --from 'mneme-mcp[clip,video]' mneme-mcp

bash

openclaw plugins install @nepa-ai/openclaw-polymath
openclaw plugins enable mneme

openclaw.json:10:

json

"install": "mcporter add mneme -- uvx --from 'mneme-mcp[clip,video]' mneme-mcp",

Technical Analysis

The installation instructions download and execute mneme-mcp through uvx without specifying an exact version or integrity hash. The @nepa-ai/openclaw-polymath plugin is also installed without an exact version.

Consequently, the code executed during installation is determined by the package versions served by external package registries at installation time, rather than by a dependency artifact reviewed with this skill. The effective implementation may change after this project has been audited. Optional dependencies selected through the clip and video extras also increase the unverified supply-chain surface.

This does not establish that the referenced packages are currently malicious. The vulnerability is the lack of version and integrity controls: compromise of a publisher account, registry, release pipeline, or transitive dependency could cause future installations to execute attacker-controlled code.

Attack Path

1. An attacker compromises the package publisher, release pipeline, registry account, or an applicable dependency.
2. The attacker publishes a malicious release under the expected package name or replaces a dependency selected during resolution.
3. A user follows the documented installation command, or a host consumes the installation command from openclaw.json.
4. uvx resolves the unpinned package and dependencies to the attacker-controlled release and executes its entry poin ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mneme-mcp to an exact reviewed version in both the README and manifest, for example by using the package manager's exact-version syntax.
2. Pin @nepa-ai/openclaw-polymath to an exact reviewed version rather than allowing the installer to select the latest release.
3. Use cryptographic hashes, signed package provenance, or lockfiles where supported, including hashes for transitive dependencies.
4. Ensure installation uses only explicitly trusted package registries and disable unexpected fallback indexes to reduce dependency-confusion risk.
5. Audit and retain the exact mneme-mcp and plugin artifacts corresponding to each published skill release.
6. Add automated dependency scanning, release-signature verification, and publisher-account protections to the release process.
7. Run installation and plugin execution under a least-privileged account or sandbox with access restricted to the media directories and services required by the skill.
8. Keep the version constraints in README.md and openclaw.json synchronized so documented and automated installations execute the same reviewed artifacts.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.