Fast Unified Memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:12 AM UTC
• Version: 1.0.1

Overview

The skill appears intended for local memory search, but its installer guidance and hard-coded memory path create review-worthy safety risks.

Review before installing. Do not run the documented curl-to-shell installer blindly; install Ollama through a trusted, inspectable method. Before use, change the hard-coded OpenClaw memory path and default user id to your own intended workspace, and avoid storing highly sensitive material unless you accept plaintext local storage and local Ollama processing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:27

Finding

Unpinned Remote Installation Script Is Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://ollama.ai/install.sh | sh

Technical Analysis

The installation instructions download a mutable script from an external URL and pipe it directly into a shell. The script is executed without version pinning, checksum validation, signature verification, or an opportunity for the user to inspect the downloaded content.

Ollama is a documented prerequisite, but dynamically executing its current remote installation script is not necessary for the Skill's runtime functionality and does not follow least-privilege or secure supply-chain practices. Even if the domain is legitimate, the effective payload can change after this Skill has been reviewed. A compromise of the website, hosting infrastructure, DNS resolution, certificate issuance chain, or installation script could convert the documented command into arbitrary local code execution.

Attack Path

1. An attacker compromises or gains control over the remote installation endpoint or its delivery infrastructure.
2. The attacker modifies the response from https://ollama.ai/install.sh to contain malicious shell commands.
3. A user follows the Skill's installation instructions.
4. curl retrieves the modified response.
5. The pipe sends the response directly to sh, which executes it without verification.
6. The payload performs arbitrary actions under the invoking user's account and may seek elevated privileges if the installer invokes or requests sudo.

Impact Assessment

Successful exploitation permits arbitrary command execution with the privileges of the user following the installation instructions. The payload could read or modify user data, steal credentials accessible to that account, install persistence, download additional payloads, or alter development a ...[truncated 146 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | sh pipeline from the installation instructions.
• Prefer a trusted operating-system package manager with a pinned package version.
• If a standalone installer is required, download a versioned artifact to disk before executing it.
• Publish and verify a cryptographic signature from a trusted publisher key and a pinned SHA-256 or stronger checksum.
• Let the user inspect the downloaded artifact before execution.
• Clearly document whether elevated privileges are required and avoid invoking the installer as root unless strictly necessary.
• Pin the download to an immutable release rather than a mutable installation endpoint.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: fast-unified-memory.js:52

Finding

Hard-Coded Path May Expose Another User's OpenClaw Memory

Content

View full analysis

Vulnerability Details

File Location: fast-unified-memory.js, lines 52 and 64–81
Vulnerability Type: Cross-user data access caused by a hard-coded account path
Risk Level: Medium

Vulnerable Code:

js

const MEMORY_DIR = '/home/broedkrummen/.openclaw/workspace/memory';

// Search OpenClaw memory files (keyword-based for speed)
async function searchOpenClaw(query) {
  const start = Date.now();
  const results = [];
  const q = query.toLowerCase();
  
  try {
    const files = FS.readdirSync(MEMORY_DIR).filter(f => f.endsWith('.md'));
    for (const file of files) {
      const content = FS.readFileSync(PATH.join(MEMORY_DIR, file), 'utf-8');
      if (content.toLowerCase().includes(q)) {
        const lines = content.split('\n').filter(l => l.toLowerCase().includes(q));
        results.push({ file, snippet: lines[0]?.substring(0, 100) });
      }
    }
  } catch {}
  
  return { results, time: Date.now() - start };
}

Technical Analysis

The program always reads OpenClaw memory from the fixed account path /home/broedkrummen/..., rather than resolving the current user's home directory or requiring an explicitly authorized workspace. This differs from the documentation, which describes the location as ~/.openclaw/workspace/memory/.

Reading OpenClaw memory is part of the declared functionality, but implicitly targeting a named user's account is broader than caller-relative memory access. If the process runs under another user, service account, shared group, container, or privileged context that can access this path, search queries can retrieve and print snippets from the named user's Markdown memory files. The empty catch block also hides permission and configuration errors, making the incorrect security boundary difficult to detect.

Attack Path

1. The Skill is installed or invoked by a local user or service account other than broedkrummen.
2. Filesystem permis ...[truncated 1022 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the current user's home directory with os.homedir() and construct the default path with path.join.
• Prefer an explicit configuration option for the OpenClaw workspace and require the user to authorize non-default locations.
• Canonicalize the configured path with realpath and verify that it remains inside the intended workspace.
• Verify directory and file ownership before reading sensitive memory.
• Run the Skill under an unprivileged account that can access only its own memory.
• Replace the empty catch block with safe error reporting that distinguishes a missing directory from denied access.
• Avoid printing memory snippets where standard output may be captured by shared logs.

T09 · Insecure Skill Coding Practices

Note

• Location: fast-unified-memory.js:19

Finding

Sensitive Memory Store Uses Ambient Permissions and Follows Existing Paths

Content

View full analysis

Vulnerability Details

File Location: fast-unified-memory.js, lines 19–36
Vulnerability Type: Insecure local storage of potentially sensitive memory
Risk Level: Low

Vulnerable Code:

js

const MEM0_STORE = process.env.HOME + '/.mem0/fast-store.json';

function getMem0Store() {
  try {
    if (!FS.existsSync(MEM0_STORE)) {
      FS.writeFileSync(MEM0_STORE, JSON.stringify({ memories: [] }));
    }
    return JSON.parse(FS.readFileSync(MEM0_STORE, 'utf-8'));
  } catch {
    return { memories: [] };
  }
}

function saveMem0Store(store) {
  FS.writeFileSync(MEM0_STORE, JSON.stringify(store, null, 2));
}

Technical Analysis

The Skill stores memory text, user identifiers, metadata, and embeddings in a plaintext JSON file. When creating or replacing that file, it does not explicitly request a restrictive file mode, verify ownership, reject symbolic links, or use an atomic replacement procedure. Access therefore depends on the process umask, existing directory permissions, and the state of the destination path.

If ~/.mem0 or fast-store.json was prepared by another local principal and is writable or replaceable, ordinary file APIs may follow a symbolic link and write the JSON to another file accessible to the victim. On systems with a permissive umask, the resulting store may also be readable by unintended local users. The code does not create the parent directory, so first-run initialization fails when ~/.mem0 is absent; the broad exception handler hides that failure and returns an empty store.

Attack Path

A practical exploitation path requires local filesystem access:

1. An attacker gains write access to the victim's .mem0 directory or can prepare the relevant path before the Skill runs.
2. The attacker creates fast-store.json as a symbolic link to a file the victim process can overwrite, or relies on permissive resulting file permissions.
3. The victim invokes the ...[truncated 791 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the home directory with os.homedir() instead of directly concatenating process.env.HOME.
• Create ~/.mem0 with mode 0700 and verify that it is owned by the current user.
• Create the store with mode 0600, and correct overly broad permissions on an existing store.
• Use lstat and platform-appropriate no-follow protections to reject symbolic links for both the directory and store.
• Verify file ownership and that the destination is a regular file before reading or writing it.
• Write to a securely created temporary file in the same directory, flush it, set restrictive permissions, and atomically rename it over the store.
• Report initialization and persistence failures instead of silently returning an empty store.
• Consider encrypting memory at rest when its confidentiality requirements warrant protection beyond filesystem permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to download and immediately execute a remote shell script via curl ... | sh, which bypasses review of the downloaded content and creates a direct remote code execution path if the server, CDN, DNS, or transport path is compromised. Even if Ollama is a legitimate dependency, embedding this install pattern in a skill increases risk because users may copy-paste it without verification.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash

# Install Ollama first
curl -fsSL https://ollama.ai/install.sh | sh

# Pull the embedding model
ollama pull nomic-embed-text

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | sh construct is itself dangerous because it chains untrusted network input directly into a shell interpreter, eliminating any opportunity for inspection or integrity validation before execution. In a skill document, this is especially risky because it normalizes unsafe operational behavior and can lead to arbitrary command execution on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash

# Install Ollama first
curl -fsSL https://ollama.ai/install.sh | sh

# Pull the embedding model
ollama pull nomic-embed-text

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

- `fast-unified-memory.js` - Main CLI tool

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The top-level command documentation describes add <text> as simply adding data to Fast Mem0. In practice, addMem0 first calls getEmbedding, which POSTs the raw text to the Ollama HTTP API before storing it, so the documented behavior omits a materially different side effect involving external service communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

User-provided memory content is transmitted to an HTTP service for embedding generation without an explicit disclosure in the interface. Even though the endpoint is localhost, this can expose sensitive material to another process, service, or misconfigured listener on the host, and users may reasonably believe add only writes to a local JSON store.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The comment suggests a lightweight search approach, but the implementation performs a full directory scan and reads each .md file into memory before checking for matches. While this is still keyword matching, the comment implies a simpler/cheaper behavior than the actual full-file traversal.

Content

No source excerpt is available for this finding.