VideoMemory

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:50 AM UTC
• Version: 0.1.15

Overview

The skill is a narrowly scoped VideoMemory installer/launcher, with a normal third-party package installation risk users should understand.

Install this only if you trust the @clamepending/videomemory package and are comfortable with it adding OpenClaw bridge files and starting a local VideoMemory service. Review the --safe --explain onboarding plan before allowing setup, and run it in a constrained environment if you need stronger supply-chain isolation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unreviewed Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–39
Vulnerability Type: Third-party supply-chain risk caused by automatic package installation and execution
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install @clamepending/videomemory@0.1.7

bash

npx -y @clamepending/videomemory@0.1.7 onboard --safe --repo-ref v0.1.3 --explain

bash

npx -y @clamepending/videomemory@0.1.7 onboard --safe --repo-ref v0.1.3

bash

npx -y @clamepending/videomemory@0.1.7 relaunch --repo-ref v0.1.3

Technical Analysis

The skill directs the agent to install and execute the external npm/OpenClaw package @clamepending/videomemory@0.1.7. The audited project does not contain the package implementation, integrity hashes, a lockfile, permission declarations, or other evidence sufficient to verify the downloaded code.

The npx -y option downloads and executes package code without an interactive confirmation step. Installing the OpenClaw plugin also introduces executable third-party code into the environment. Although the package and repository reference are version-pinned, version pinning alone does not verify package integrity or protect against a compromised registry account, malicious package publication, registry tampering, or unsafe lifecycle scripts.

The --safe argument does not independently enforce a security boundary because it is interpreted by the same unreviewed package. No malicious behavior is proven in the supplied artifact; the finding concerns the unsafe trust and execution model.

Attack Path

1. An attacker compromises the package publisher, registry account, distribution infrastructure, or the referenced package artifact.
2. The user requests installation, onboarding, or relaunch through this skill.
3. The agent runs openclaw plugins install or npx -y, retrieving the external package.
4. The package or its installation lifecycle scripts ...[truncated 1199 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor and review the package implementation, including installation scripts, lifecycle hooks, onboarding behavior, relaunch behavior, and bridge-file modifications.
2. Verify publisher identity, registry provenance, release signatures, and the relationship between package version 0.1.7 and repository reference v0.1.3.
3. Pin the package using an immutable cryptographic integrity digest or a reviewed lockfile rather than relying only on a mutable registry name and version.
4. Avoid unattended npx -y execution. Require explicit user approval after presenting the package source, expected changes, requested permissions, and verified integrity information.
5. Disable package lifecycle scripts where compatible, or separately inspect and approve each required lifecycle operation.
6. Run installation and onboarding inside a sandbox or restricted account with minimal filesystem access, no unnecessary credentials, and tightly limited network permissions.
7. Restrict writable plugin, configuration, and startup locations to reduce the potential for persistent modification.
8. Record and verify the files, processes, ports, and network destinations created by onboarding. Alert on behavior outside the documented VideoMemory setup scope.
9. Treat --safe as an application option rather than a security control; enforce safety through operating-system permissions, network policy, and process isolation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep