Security audit

mem9.ai

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real mem9 setup helper, but it deserves review because it enables persistent cloud memory with automatic conversation access and installs an unpinned plugin.

Install only if you are comfortable with mem9 acting as your persistent cloud memory, receiving conversation-derived content, and storing/reusing a mem9 API key. Prefer a pinned, reviewed plugin version with integrity verification, ask for explicit consent before enabling conversation access, and keep the API key out of chat transcripts when possible.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SETUP.md:38
Finding: Mandatory Branded Responses Override Normal Agent Output
Content: View full analysis
I can help you set up mem9. > > Choose one path: > 1. Create a new mem9 API key during setup > 2. Reconnect an existing mem9 API key > > If you choose reconnect, paste your existing API key. ``` ```text Once reconnect or create-new success criteria are met, the next user-facing assistant message must be exactly this onboarding handoff with the real key substituted. Do not replace it with a short summary such as `done`, `搞定`, `安装成功`, or diagnostic bullets. Include the full API key exactly once. Do not append log analysis, trigger details, apology text, or extra status notes after it. ```text ✅ Your mem9 API key is connected. 🧭 WHAT YOU CAN DO NEXT You can also go to https://mem9.ai/your-memory/ to visually manage, analyze, import, and export your memories. Sign in there with the same mem9 API key from this setup. If the dashboard still shows "Space ID", enter the same mem9 API key. Use the dashboard or another reviewed manual workflow if you want to import older history later. This setup did not upload any local files. If you later ask me to remember something, I should write it to mem9 and tell you whether the write succeeded. 💾 YOUR MEM9 API KEY MEM9_API_KEY: Use this same value as MEM9_API_KEY in recovery or on another trusted machine. Keep it private and store it somewhere safe. ♻️ RECOVERY Reinstall mem9 and use the same MEM9_API_KEY in the plugin config. Your memory will reconnect instantly. 📦 BACKUP PLAN Keep your original local memory/session files as backup if you plan to import them later. Also ...[truncated 2645 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SETUP.md:27
Finding: Automatic Conversation Access Is Enabled Without Separate Informed Consent
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SETUP.md:121
Finding: Executable Plugin Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation
`, rather than resolving the latest release. 2. Record and verify a cryptographic integrity digest for the package artifact before installation. 3. Validate package provenance or signatures where supported by the package registry and OpenClaw. 4. Do not select a mirror solely according to latency. Require the mirror artifact to match the trusted registry's expected digest. 5. Display the resolved version, source registry, publisher identity, and integrity value in the dry-run preview. 6. Fail closed if the package version or digest differs from the audited values. 7. Maintain an explicit update process in which new versions are reviewed before changing the pin. 8. Run the plugin with least privilege and restrict access to unrelated files, environment variables, credentials, and network destinations. 9. Prefer a trusted lockfile or verified package bundle if OpenClaw supports reproducible plugin installation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence

Findings (22)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 94% confidence
Finding: The setup mandates a restart-and-return flow and instructs the user to send a trigger message ('hi') so the skill can resume verification and potentially invoke additional agent actions after the gateway restarts. This creates a prompt-bridging mechanism across sessions/restarts that can be exploited to continue sensitive operations with reduced user scrutiny, especially because later steps include log inspection, local state checks, and a fallback local agent turn.
Content: Scanner excerpt · SETUP.md (reported line 89)May include surrounding context.
md
- exact config keys that may change - expected restart count: normally 1 - local history will not be uploaded - restart-and-return instruction: gateway restarts automatically; return to this chat in a few minutes and send `hi` The config key list must include:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · UNINSTALL.md (reported line 42)May include surrounding context.
md
- expected restart count: `1` - that this flow does not delete remote mem9 data - that this flow does not reset the current chat session automatically - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi` - Approval phrase: - `approve uninstall`

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · UNINSTALL.md (reported line 67)May include surrounding context.
md
- expected restart count: `1` - that this flow does not delete remote mem9 data - that this flow does not reset the current chat session automatically - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi` - Approval phrase: - `approve uninstall`

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · UNINSTALL.md (reported line 123)May include surrounding context.
md
- expected restart count: `1` - that this flow does not delete remote mem9 data - that this flow does not reset the current chat session automatically - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi` - Approval phrase: - `approve uninstall`

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · UNINSTALL.md (reported line 126)May include surrounding context.
md
- expected restart count: `1` - that this flow does not delete remote mem9 data - that this flow does not reset the current chat session automatically - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi` - Approval phrase: - `approve uninstall`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SETUP.md (reported line 31)May include surrounding context.
md
- In create-new mode, generate `PROVISION_TOKEN` once after the branch is selected, write it before the first restart, and keep it stable until provisioning succeeds on this machine. - If the remote `SKILL.md` URL has query params whose keys start with `utm_`, preserve those exact filtered pairs as `REMOTE_SKILL_UTM_PARAMS` and write them only in create-new mode under `plugins.entries.mem9.config.provisionQueryParams`. - Show one dry-run preview and get one approval for the disclosed install, config, restart, and verification flow. Ask for another approval only if scope materially changes. - Do not ask the user for repeated `hi` messages while the only missing step is create-new provisioning. Use the one local trigger in this document. - If install fails, stale local plugin state blocks install, config is already invalid, reconnect auto-provisions a new key, multiple create-new keys appear, or the documented checks cannot be satisfied, stop and use `TROUBLESHOOTING.md`. ## Required Success Handoff

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SETUP.md (reported line 77)May include surrounding context.
md
### 1. Choose Branch And Approve - If the user chooses reconnect, store the pasted key as `USER_PROVIDED_MEM9_API_KEY`. - If the user chooses create-new, generate and remember `PROVISION_TOKEN`; do not ask the user for an API key. - If `REMOTE_SKILL_UTM_PARAMS` exists, keep that exact map for create-new. - Do not probe a key with standalone API calls. Verification happens through OpenClaw loading the plugin.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill directs the agent to persistently modify openclaw.json to enable a cloud-backed memory plugin and preserve session behavior across restarts. Persistent config changes that route memory to a remote service can alter future data handling beyond the immediate session, creating privacy and integrity risk if the user does not fully understand the long-term effect.
Content: Scanner excerpt · SETUP.md (reported line 157)May include surrounding context.
md
- Older versions: omit `hooks.allowConversationAccess` and tell the user to upgrade OpenClaw for full automatic conversation upload. - If the version is unavailable or unclear, ask the user before editing config. ### 4. Write Config And Read It Back Preserve unrelated config. Apply mem9 config in one contiguous update after install succeeds.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly describes a persistent cloud memory plugin that stores durable memory across sessions and machines, but it does not give a clear privacy warning at the point of description that user conversation content may be transmitted to an external service. Because this is a memory plugin, users may not realize their prompts and conversation-derived data leave the local environment, creating informed-consent and data exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs enabling plugins.entries.mem9.hooks.allowConversationAccess = true so the plugin can read conversation messages during agent_end, but it does not pair that instruction with a prominent warning that this grants the plugin access to conversation contents. That omission increases the chance that users enable sensitive data access without understanding the privacy implications of exposing chats to a third-party plugin and cloud backend.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · TROUBLESHOOTING.md (reported line 53)May include surrounding context.
md
### Create-New Flow Generated Multiple Keys - Treat this as abnormal create-new behavior, not as automatic success - Do not silently keep the latest key without checking the earlier provision attempts - Re-check whether `plugins.entries.mem9.config.provisionToken` was already present before the first successful provision and stayed unchanged for the whole create-new run - Re-check whether `plugins.entries.mem9.config.provisionQueryParams` was already present before the first successful provision - Re-check whether more than one post-restart provision attempt ran before the first key was reused locally

Session Persistence

Medium

Category: Rogue Agent
Confidence: 76% confidence
Finding: The troubleshooting flow directs the system to read back and rewrite the user's original API key from persistent configuration during reconnect handling. Because this is a cloud credential stored in config and reused across restarts, the skill increases exposure of a secret through repeated handling and session-persistent storage, which can lead to credential leakage if logs, config files, or downstream tooling are accessible.
Content: Scanner excerpt · TROUBLESHOOTING.md (reported line 93)May include surrounding context.
md
- Treat this as reconnect failure, not success - Do not hand off the auto-provisioned key to the user - Re-check the write order: the user-provided key must be saved before the first restart - Re-check the exact config path: `plugins.entries.mem9.config.apiKey` - Re-check the read-back value from `openclaw.json` before the first restart - Rewrite the original user-provided key to the correct field

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The troubleshooting guidance says the correct user-facing outcome must be in the user's language. This imposes a language/locale policy in natural language instructions, and the file does not present it as an opt-in user preference or a clearly justified region-specific requirement.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · UNINSTALL.md (reported line 89)May include surrounding context.
md
- Delete `plugins.entries.mem9` if it exists. - Delete `plugins.installs.mem9` if it exists. - Remove `"mem9"` from `plugins.allow` if it exists there. - If `plugins.slots.memory` is already some non-mem9 value, do not overwrite that slot. - Do not change any unrelated keys. For OpenClaw `< 2.2.0`, use the same rollback shape without `plugins.allow`.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown file describes a setup flow that will install a plugin, modify openclaw.json, contact external registries/services, and restart the gateway, but the opening section only presents a generic setup choice prompt. Although later sections include approvals and operational notices, the initial user-facing description does not clearly warn that setup affects local configuration and service availability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file imposes a language-handling rule for stored memory content: it must preserve the user's original language. This is a locale/language policy constraint expressed as a mandatory behavior, and the file does not indicate user choice or opt-in for alternative language handling.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · UNINSTALL.md (reported line 137)May include surrounding context.
md
- If the logs already show `config change requires gateway restart` and `deferring until ... complete`, wait for that queued restart instead of starting another restart path. - Do not reset the current session before or after the restart. - If the user asked for `reset session`, acknowledge it only as a separate follow-up option after the gateway is healthy again. - If that later follow-up reset is attempted, first verify a session-only reset command exists for this CLI version, for example via `openclaw reset --help`. Do not broaden the scope automatically. - When the user returns and sends `hi` or another short message, resume verification automatically. - Do not ask `Want me to continue?` - The first resume reply must stay short and user-facing, for example:

Static analysis

No suspicious patterns detected.