Fast Unified Memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:12 AM UTC
• Version: 1.0.1

Overview

The skill appears intended for local memory search, but its installer guidance and hard-coded memory path create review-worthy safety risks.

Review before installing. Do not run the documented curl-to-shell installer blindly; install Ollama through a trusted, inspectable method. Before use, change the hard-coded OpenClaw memory path and default user id to your own intended workspace, and avoid storing highly sensitive material unless you accept plaintext local storage and local Ollama processing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:27
• Finding: Unpinned Remote Installation Script Is Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, line 27 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://ollama.ai/install.sh | sh ``` ### Technical Analysis The installation instructions download a mutable script from an external URL and pipe it directly into a shell. The script is executed without version pinning, checksum validation, signature verification, or an opportunity for the user to inspect the downloaded content. Ollama is a documented prerequisite, but dynamically executing its current remote installation script is not necessary for the Skill's runtime functionality and does not follow least-privilege or secure supply-chain practices. Even if the domain is legitimate, the effective payload can change after this Skill has been reviewed. A compromise of the website, hosting infrastructure, DNS resolution, certificate issuance chain, or installation script could convert the documented command into arbitrary local code execution. ### Attack Path 1. An attacker compromises or gains control over the remote installation endpoint or its delivery infrastructure. 2. The attacker modifies the response from `https://ollama.ai/install.sh` to contain malicious shell commands. 3. A user follows the Skill's installation instructions. 4. `curl` retrieves the modified response. 5. The pipe sends the response directly to `sh`, which executes it without verification. 6. The payload performs arbitrary actions under the invoking user's account and may seek elevated privileges if the installer invokes or requests `sudo`. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the user following the installation instructions. The payload could read or modify user data, steal credentials accessible to that account, install persistence, download additional payloads, or alter development a ...[truncated 146 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | sh` pipeline from the installation instructions. - Prefer a trusted operating-system package manager with a pinned package version. - If a standalone installer is required, download a versioned artifact to disk before executing it. - Publish and verify a cryptographic signature from a trusted publisher key and a pinned SHA-256 or stronger checksum. - Let the user inspect the downloaded artifact before execution. - Clearly document whether elevated privileges are required and avoid invoking the installer as `root` unless strictly necessary. - Pin the download to an immutable release rather than a mutable installation endpoint.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: fast-unified-memory.js:52
• Finding: Hard-Coded Path May Expose Another User's OpenClaw Memory## Vulnerability Details **File Location**: `fast-unified-memory.js`, lines 52 and 64–81 **Vulnerability Type**: Cross-user data access caused by a hard-coded account path **Risk Level**: Medium **Vulnerable Code**: ```js const MEMORY_DIR = '/home/broedkrummen/.openclaw/workspace/memory'; // Search OpenClaw memory files (keyword-based for speed) async function searchOpenClaw(query) { const start = Date.now(); const results = []; const q = query.toLowerCase(); try { const files = FS.readdirSync(MEMORY_DIR).filter(f => f.endsWith('.md')); for (const file of files) { const content = FS.readFileSync(PATH.join(MEMORY_DIR, file), 'utf-8'); if (content.toLowerCase().includes(q)) { const lines = content.split('\n').filter(l => l.toLowerCase().includes(q)); results.push({ file, snippet: lines[0]?.substring(0, 100) }); } } } catch {} return { results, time: Date.now() - start }; } ``` ### Technical Analysis The program always reads OpenClaw memory from the fixed account path `/home/broedkrummen/...`, rather than resolving the current user's home directory or requiring an explicitly authorized workspace. This differs from the documentation, which describes the location as `~/.openclaw/workspace/memory/`. Reading OpenClaw memory is part of the declared functionality, but implicitly targeting a named user's account is broader than caller-relative memory access. If the process runs under another user, service account, shared group, container, or privileged context that can access this path, search queries can retrieve and print snippets from the named user's Markdown memory files. The empty `catch` block also hides permission and configuration errors, making the incorrect security boundary difficult to detect. ### Attack Path 1. The Skill is installed or invoked by a local user or service account other than `broedkrummen`. 2. Filesystem permis ...[truncated 1022 chars]
• Remediation: ## Remediation Suggestions - Resolve the current user's home directory with `os.homedir()` and construct the default path with `path.join`. - Prefer an explicit configuration option for the OpenClaw workspace and require the user to authorize non-default locations. - Canonicalize the configured path with `realpath` and verify that it remains inside the intended workspace. - Verify directory and file ownership before reading sensitive memory. - Run the Skill under an unprivileged account that can access only its own memory. - Replace the empty `catch` block with safe error reporting that distinguishes a missing directory from denied access. - Avoid printing memory snippets where standard output may be captured by shared logs.

T09 · Insecure Skill Coding Practices

Note

• Location: fast-unified-memory.js:19
• Finding: Sensitive Memory Store Uses Ambient Permissions and Follows Existing Paths## Vulnerability Details **File Location**: `fast-unified-memory.js`, lines 19–36 **Vulnerability Type**: Insecure local storage of potentially sensitive memory **Risk Level**: Low **Vulnerable Code**: ```js const MEM0_STORE = process.env.HOME + '/.mem0/fast-store.json'; function getMem0Store() { try { if (!FS.existsSync(MEM0_STORE)) { FS.writeFileSync(MEM0_STORE, JSON.stringify({ memories: [] })); } return JSON.parse(FS.readFileSync(MEM0_STORE, 'utf-8')); } catch { return { memories: [] }; } } function saveMem0Store(store) { FS.writeFileSync(MEM0_STORE, JSON.stringify(store, null, 2)); } ``` ### Technical Analysis The Skill stores memory text, user identifiers, metadata, and embeddings in a plaintext JSON file. When creating or replacing that file, it does not explicitly request a restrictive file mode, verify ownership, reject symbolic links, or use an atomic replacement procedure. Access therefore depends on the process umask, existing directory permissions, and the state of the destination path. If `~/.mem0` or `fast-store.json` was prepared by another local principal and is writable or replaceable, ordinary file APIs may follow a symbolic link and write the JSON to another file accessible to the victim. On systems with a permissive umask, the resulting store may also be readable by unintended local users. The code does not create the parent directory, so first-run initialization fails when `~/.mem0` is absent; the broad exception handler hides that failure and returns an empty store. ### Attack Path A practical exploitation path requires local filesystem access: 1. An attacker gains write access to the victim's `.mem0` directory or can prepare the relevant path before the Skill runs. 2. The attacker creates `fast-store.json` as a symbolic link to a file the victim process can overwrite, or relies on permissive resulting file permissions. 3. The victim invokes the ...[truncated 791 chars]
• Remediation: ## Remediation Suggestions - Resolve the home directory with `os.homedir()` instead of directly concatenating `process.env.HOME`. - Create `~/.mem0` with mode `0700` and verify that it is owned by the current user. - Create the store with mode `0600`, and correct overly broad permissions on an existing store. - Use `lstat` and platform-appropriate no-follow protections to reject symbolic links for both the directory and store. - Verify file ownership and that the destination is a regular file before reading or writing it. - Write to a securely created temporary file in the same directory, flush it, set restrictive permissions, and atomically rename it over the store. - Report initialization and persistence failures instead of silently returning an empty store. - Consider encrypting memory at rest when its confidentiality requirements warrant protection beyond filesystem permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install Ollama first
curl -fsSL https://ollama.ai/install.sh | sh

# Pull the embedding model
ollama pull nomic-embed-text

• Confidence: 98% confidence
• Finding: The skill instructs users to download and immediately execute a remote shell script via `curl ... | sh`, which bypasses review of the downloaded content and creates a direct remote code execution path if the server, CDN, DNS, or transport path is compromised. Even if Ollama is a legitimate dependency, embedding this install pattern in a skill increases risk because users may copy-paste it without verification.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install Ollama first
curl -fsSL https://ollama.ai/install.sh | sh

# Pull the embedding model
ollama pull nomic-embed-text

• Confidence: 97% confidence
• Finding: The `| sh` construct is itself dangerous because it chains untrusted network input directly into a shell interpreter, eliminating any opportunity for inspection or integrity validation before execution. In a skill document, this is especially risky because it normalizes unsafe operational behavior and can lead to arbitrary command execution on the user's system.

Ae1

High

• Category: analysis-evasion

Content

- `fast-unified-memory.js` - Main CLI tool

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The top-level command documentation describes `add <text>` as simply adding data to Fast Mem0. In practice, `addMem0` first calls `getEmbedding`, which POSTs the raw text to the Ollama HTTP API before storing it, so the documented behavior omits a materially different side effect involving external service communication.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User-provided memory content is transmitted to an HTTP service for embedding generation without an explicit disclosure in the interface. Even though the endpoint is localhost, this can expose sensitive material to another process, service, or misconfigured listener on the host, and users may reasonably believe `add` only writes to a local JSON store.

Intent-Code Divergence

Low

• Confidence: 73% confidence
• Finding: The comment suggests a lightweight search approach, but the implementation performs a full directory scan and reads each `.md` file into memory before checking for matches. While this is still keyword matching, the comment implies a simpler/cheaper behavior than the actual full-file traversal.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: fast-unified-memory.js:21