OMP Memory Protocol
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill generally matches its stated purpose (on‑chain encrypted storage) but its metadata, runtime instructions, and install script have inconsistent declarations and a few operational risks (local wallet handling, undeclared binary/env requirements, and an external GitHub clone) that warrant caution before installing or using it.
Before installing or running this skill: 1) Verify and review the GitHub repository (openclawai/omp) and its package.json/dependencies — do not run npm install on unreviewed code. 2) Be aware the CLI creates/stores an encrypted wallet at ~/.omp/wallet.json and uses WALLET_PASSWORD; if you import a real private key or fund the wallet, the CLI (and any automated agent runs) can sign transactions and spend tokens. Use an empty/ephemeral wallet with no funds for testing, or a hardware wallet / separate environment for real funds. 3) The SKILL.md expects node and npm but the registry metadata didn't declare those — ensure those binaries are present and trustworthy. 4) If you do not trust the repo owner, do not run scripts/install.sh; instead review the source offline or run in an isolated VM/container. 5) Consider requiring explicit user confirmation before any agent-run operation that would unlock or use the wallet (sign/submit transactions).
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings