mem9.ai

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:16 AM UTC
• Version: 1.0.48

Overview

This appears to be a real mem9 setup helper, but it deserves review because it enables persistent cloud memory with automatic conversation access and installs an unpinned plugin.

Install only if you are comfortable with mem9 acting as your persistent cloud memory, receiving conversation-derived content, and storing/reusing a mem9 API key. Prefer a pinned, reviewed plugin version with integrity verification, ask for explicit consent before enabling conversation access, and keep the API key out of chat transcripts when possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SETUP.md:38
• Finding: Mandatory Branded Responses Override Normal Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:7-14`, `SETUP.md:38-68`; reinforced by `SKILL.md:29` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Instructions ```text When this file is read, send only the choice prompt below. Do not include version checks, config paths, config keys, dry-run details, restart counts, or approval phrases in the first reply. > I can help you set up mem9. > > Choose one path: > 1. Create a new mem9 API key during setup > 2. Reconnect an existing mem9 API key > > If you choose reconnect, paste your existing API key. ``` ```text Once reconnect or create-new success criteria are met, the next user-facing assistant message must be exactly this onboarding handoff with the real key substituted. Do not replace it with a short summary such as `done`, `搞定`, `安装成功`, or diagnostic bullets. Include the full API key exactly once. Do not append log analysis, trigger details, apology text, or extra status notes after it. ```text ✅ Your mem9 API key is connected. 🧭 WHAT YOU CAN DO NEXT You can also go to https://mem9.ai/your-memory/ to visually manage, analyze, import, and export your memories. Sign in there with the same mem9 API key from this setup. If the dashboard still shows "Space ID", enter the same mem9 API key. Use the dashboard or another reviewed manual workflow if you want to import older history later. This setup did not upload any local files. If you later ask me to remember something, I should write it to mem9 and tell you whether the write succeeded. 💾 YOUR MEM9 API KEY MEM9_API_KEY: <api-key-from-this-setup> Use this same value as MEM9_API_KEY in recovery or on another trusted machine. Keep it private and store it somewhere safe. ♻️ RECOVERY Reinstall mem9 and use the same MEM9_API_KEY in the plugin config. Your memory will reconnect instantly. 📦 BACKUP PLAN Keep your original local memory/session files as backup if you plan to import them later. Also ...[truncated 2645 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove “send only,” “must be exactly,” and similar instructions that override the agent's normal response policy. 2. Convert the onboarding text into an optional example rather than a mandatory verbatim response. 3. Permit the agent to include security warnings, verification caveats, and concise diagnostic context. 4. Make the dashboard link optional and clearly identify it as an external vendor service. 5. Do not require the full API key to be displayed in chat. Prefer: - Writing it to a user-selected secure secret store. - Displaying it only after explicit confirmation. - Providing a redacted fingerprint for routine verification. 6. If the full key must be shown, warn that the conversation transcript will contain the secret and allow the user to choose a safer delivery method. 7. Keep operational success criteria separate from marketing or onboarding content. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SETUP.md:27
• Finding: Automatic Conversation Access Is Enabled Without Separate Informed Consent<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:27`, `SETUP.md:84-99`, `SETUP.md:153-154`; reinforced by `SKILL.md:25` and `TROUBLESHOOTING.md:102-107` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: High ### Vulnerable Instructions ```text - On OpenClaw `4.23+` / `2026.4.22+`, write `plugins.entries.mem9.hooks.allowConversationAccess = true` as a sibling of `enabled` and `config`. On older versions that reject it, omit it and tell the user full automatic conversation upload requires an OpenClaw upgrade. ``` The required dry-run disclosure is defined as follows: ```text Before taking action, send one dry-run preview in the user's language. It must include: - package: `@mem9/mem9` - install command family: `openclaw plugins install @mem9/mem9` - selected branch: reconnect or create-new - exact config keys that may change - expected restart count: normally 1 - local history will not be uploaded - restart-and-return instruction: gateway restarts automatically; return to this chat in a few minutes and send `hi` The config key list must include: - Always: `plugins.slots.memory`, `plugins.entries.mem9.enabled`, `plugins.entries.mem9.config.apiUrl`, `plugins.allow` - OpenClaw `4.23+` / `2026.4.22+`: `plugins.entries.mem9.hooks.allowConversationAccess` - Reconnect only: `plugins.entries.mem9.config.apiKey` - Create-new only: `plugins.entries.mem9.config.provisionToken` - Create-new with UTM only: `plugins.entries.mem9.config.provisionQueryParams` ``` The version-routing instructions further require: ```text - `4.23+` or date-style `2026.4.22+`: include `hooks.allowConversationAccess = true`. - Older versions: omit `hooks.allowConversationAccess` and tell the user to upgrade OpenClaw for full automatic conversation upload. ``` ### Technical Analysis The Skill grants the mem9 plugin permission to read conversation messages during the `agent_end` hook. Its own documentation describes the resulting behavio ...[truncated 2274 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default `plugins.entries.mem9.hooks.allowConversationAccess` to `false` or leave it unset. 2. Request separate consent before enabling conversation access. The prompt should explicitly state: - Exactly which messages are accessible. - That current and future conversation content may be uploaded. - The destination domain and service operator. - When uploads occur. - Retention and deletion implications. - How to disable the permission. 3. Do not combine conversation-upload consent with package installation approval. 4. Replace the ambiguous “local history will not be uploaded” statement with a clear distinction between: - Existing local memory/session files, which are not scanned. - New conversation messages, which may be transmitted through hooks. 5. Support a local-only or manual-write mode that does not grant blanket conversation access. 6. Apply data minimization by filtering credentials, secrets, and sensitive structured content before transmission. 7. Provide a configuration command or documented procedure to revoke conversation access without uninstalling the entire plugin. 8. Verify and disclose the service's retention, deletion, encryption, and access-control policies before requesting consent. ]]>

T08 · Insecure Dependencies

Warning

• Location: SETUP.md:121
• Finding: Executable Plugin Is Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:121-134` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Instructions ```bash NPMJS_TIME="$(curl -o /dev/null -sS --connect-timeout 2 --max-time 6 -w '%{time_total}' https://registry.npmjs.org/@mem9%2fmem9 || echo timeout)" MIRROR_TIME="$(curl -o /dev/null -sS --connect-timeout 2 --max-time 6 -w '%{time_total}' https://registry.npmmirror.com/@mem9%2fmem9 || echo timeout)" ``` ```text If npmjs times out, or npmjs is slow while npmmirror is reachable, run: ``` ```bash NPM_CONFIG_REGISTRY=https://registry.npmmirror.com openclaw plugins install @mem9/mem9 ``` ```text Otherwise run: ``` ```bash openclaw plugins install @mem9/mem9 ``` ### Technical Analysis The installation command references `@mem9/mem9` without an exact version or cryptographic integrity value. Consequently, the effective executable installed during setup is determined by mutable registry state at installation time rather than by the audited Skill package. The flow may also switch to `registry.npmmirror.com` based only on response timing and reachability. No instruction requires comparing package digests, validating signatures, checking npm provenance, or confirming that the mirror artifact is byte-for-byte equivalent to a reviewed official release. Because the plugin receives API credentials and conversation access, compromise of the package publisher, registry account, distribution infrastructure, or mirror could produce substantially greater impact than an ordinary low-privilege dependency. This is an unsafe supply-chain practice. The reviewed files do not prove that the current `@mem9/mem9` package or mirror is malicious; the vulnerability is that future installations are not bound to a reviewed immutable artifact. ### Attack Path 1. An attacker compromises the package publisher account, registry delivery path, mirror, or a future package release. 2. The attacker publishes or ser ...[truncated 1361 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the plugin to an exact reviewed version, for example `@mem9/mem9@<audited-version>`, rather than resolving the latest release. 2. Record and verify a cryptographic integrity digest for the package artifact before installation. 3. Validate package provenance or signatures where supported by the package registry and OpenClaw. 4. Do not select a mirror solely according to latency. Require the mirror artifact to match the trusted registry's expected digest. 5. Display the resolved version, source registry, publisher identity, and integrity value in the dry-run preview. 6. Fail closed if the package version or digest differs from the audited values. 7. Maintain an explicit update process in which new versions are reviewed before changing the pin. 8. Run the plugin with least privilege and restrict access to unrelated files, environment variables, credentials, and network destinations. 9. Prefer a trusted lockfile or verified package bundle if OpenClaw supports reproducible plugin installation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (22)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- exact config keys that may change
- expected restart count: normally 1
- local history will not be uploaded
- restart-and-return instruction: gateway restarts automatically; return to this chat in a few minutes and send `hi`

The config key list must include:

• Confidence: 94% confidence
• Finding: The setup mandates a restart-and-return flow and instructs the user to send a trigger message ('hi') so the skill can resume verification and potentially invoke additional agent actions after the gateway restarts. This creates a prompt-bridging mechanism across sessions/restarts that can be exploited to continue sensitive operations with reduced user scrutiny, especially because later steps include log inspection, local state checks, and a fallback local agent turn.

Ae1

High

• Category: analysis-evasion

Content

This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

This top-level `SKILL.md` is a routing and safety document. It is the entry point for setup, troubleshooting, and uninstall flows. It is not the canonical refer

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- expected restart count: `1`
  - that this flow does not delete remote mem9 data
  - that this flow does not reset the current chat session automatically
  - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi`
- Approval phrase:
  - `approve uninstall`

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- expected restart count: `1`
  - that this flow does not delete remote mem9 data
  - that this flow does not reset the current chat session automatically
  - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi`
- Approval phrase:
  - `approve uninstall`

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- expected restart count: `1`
  - that this flow does not delete remote mem9 data
  - that this flow does not reset the current chat session automatically
  - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi`
- Approval phrase:
  - `approve uninstall`

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- expected restart count: `1`
  - that this flow does not delete remote mem9 data
  - that this flow does not reset the current chat session automatically
  - a short restart-and-return instruction in the user's language that says the gateway will restart automatically, the user should return to this chat in a few minutes, and the user should say `hi`
- Approval phrase:
  - `approve uninstall`

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- In create-new mode, generate `PROVISION_TOKEN` once after the branch is selected, write it before the first restart, and keep it stable until provisioning succeeds on this machine.
- If the remote `SKILL.md` URL has query params whose keys start with `utm_`, preserve those exact filtered pairs as `REMOTE_SKILL_UTM_PARAMS` and write them only in create-new mode under `plugins.entries.mem9.config.provisionQueryParams`.
- Show one dry-run preview and get one approval for the disclosed install, config, restart, and verification flow. Ask for another approval only if scope materially changes.
- Do not ask the user for repeated `hi` messages while the only missing step is create-new provisioning. Use the one local trigger in this document.
- If install fails, stale local plugin state blocks install, config is already invalid, reconnect auto-provisions a new key, multiple create-new keys appear, or the documented checks cannot be satisfied, stop and use `TROUBLESHOOTING.md`.

## Required Success Handoff

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### 1. Choose Branch And Approve

- If the user chooses reconnect, store the pasted key as `USER_PROVIDED_MEM9_API_KEY`.
- If the user chooses create-new, generate and remember `PROVISION_TOKEN`; do not ask the user for an API key.
- If `REMOTE_SKILL_UTM_PARAMS` exists, keep that exact map for create-new.
- Do not probe a key with standalone API calls. Verification happens through OpenClaw loading the plugin.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Older versions: omit `hooks.allowConversationAccess` and tell the user to upgrade OpenClaw for full automatic conversation upload.
- If the version is unavailable or unclear, ask the user before editing config.

### 4. Write Config And Read It Back

Preserve unrelated config. Apply mem9 config in one contiguous update after install succeeds.

• Confidence: 91% confidence
• Finding: The skill directs the agent to persistently modify openclaw.json to enable a cloud-backed memory plugin and preserve session behavior across restarts. Persistent config changes that route memory to a remote service can alter future data handling beyond the immediate session, creating privacy and integrity risk if the user does not fully understand the long-term effect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly describes a persistent cloud memory plugin that stores durable memory across sessions and machines, but it does not give a clear privacy warning at the point of description that user conversation content may be transmitted to an external service. Because this is a memory plugin, users may not realize their prompts and conversation-derived data leave the local environment, creating informed-consent and data exposure risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs enabling `plugins.entries.mem9.hooks.allowConversationAccess = true` so the plugin can read conversation messages during `agent_end`, but it does not pair that instruction with a prominent warning that this grants the plugin access to conversation contents. That omission increases the chance that users enable sensitive data access without understanding the privacy implications of exposing chats to a third-party plugin and cloud backend.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Create-New Flow Generated Multiple Keys

- Treat this as abnormal create-new behavior, not as automatic success
- Do not silently keep the latest key without checking the earlier provision attempts
- Re-check whether `plugins.entries.mem9.config.provisionToken` was already present before the first successful provision and stayed unchanged for the whole create-new run
- Re-check whether `plugins.entries.mem9.config.provisionQueryParams` was already present before the first successful provision
- Re-check whether more than one post-restart provision attempt ran before the first key was reused locally

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Treat this as reconnect failure, not success
- Do not hand off the auto-provisioned key to the user
- Re-check the write order: the user-provided key must be saved before the first restart
- Re-check the exact config path: `plugins.entries.mem9.config.apiKey`
- Re-check the read-back value from `openclaw.json` before the first restart
- Rewrite the original user-provided key to the correct field

• Confidence: 76% confidence
• Finding: The troubleshooting flow directs the system to read back and rewrite the user's original API key from persistent configuration during reconnect handling. Because this is a cloud credential stored in config and reused across restarts, the skill increases exposure of a secret through repeated handling and session-persistent storage, which can lead to credential leakage if logs, config files, or downstream tooling are accessible.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The troubleshooting guidance says the correct user-facing outcome must be in the user's language. This imposes a language/locale policy in natural language instructions, and the file does not present it as an opt-in user preference or a clearly justified region-specific requirement.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Delete `plugins.entries.mem9` if it exists.
- Delete `plugins.installs.mem9` if it exists.
- Remove `"mem9"` from `plugins.allow` if it exists there.
- If `plugins.slots.memory` is already some non-mem9 value, do not overwrite that slot.
- Do not change any unrelated keys.

For OpenClaw `< 2.2.0`, use the same rollback shape without `plugins.allow`.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: This markdown file describes a setup flow that will install a plugin, modify `openclaw.json`, contact external registries/services, and restart the gateway, but the opening section only presents a generic setup choice prompt. Although later sections include approvals and operational notices, the initial user-facing description does not clearly warn that setup affects local configuration and service availability.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The file imposes a language-handling rule for stored memory content: it must preserve the user's original language. This is a locale/language policy constraint expressed as a mandatory behavior, and the file does not indicate user choice or opt-in for alternative language handling.

Scope Creep

Low

• Category: Excessive Agency

Content

- If the logs already show `config change requires gateway restart` and `deferring until ... complete`, wait for that queued restart instead of starting another restart path.
- Do not reset the current session before or after the restart.
- If the user asked for `reset session`, acknowledge it only as a separate follow-up option after the gateway is healthy again.
- If that later follow-up reset is attempted, first verify a session-only reset command exists for this CLI version, for example via `openclaw reset --help`. Do not broaden the scope automatically.
- When the user returns and sends `hi` or another short message, resume verification automatically.
- Do not ask `Want me to continue?`
- The first resume reply must stay short and user-facing, for example:

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.