Security audit

MemPalace Memory System for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This is a real local memory archive tool, but it can automatically retain broad conversation and code content and has privacy/permission gaps users should review before installing.

Install only if you intentionally want a durable local archive of AI conversations and are prepared to manage privacy. Avoid enabling the Stop/PreCompact hooks or cron auto-save unless you explicitly want automatic capture; use a dedicated virtual environment with pinned dependencies; do not run mining on broad project directories that may contain secrets; and assume stored memories can later be surfaced verbatim to agents or tools. Treat Wikipedia/entity research as network disclosure of the exact researched term.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: mempalace/hooks/mempal_save_hook.sh:135
Finding: Lifecycle hooks inject mandatory system-level archive instructions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: mempalace/layers.py:387
Finding: Untrusted indexed content can be injected into future agent prompts
Content: View full analysis
200: snippet = snippet[:197] + "..." entry_line = f" - {snippet}" if source: entry_line += f" ({source})" if total_len + len(entry_line) > self.MAX_CHARS: lines.append(" ... (more in L3 search)") return "\n".join(lines) lines.append(entry_line) total_len += len(entry_line) ``` ```python # mempalace/layers.py:387-404 def wake_up(self, wing: str = None) -> str: """ Generate wake-up text: L0 (identity) + L1 (essential story). Typically ~600-900 tokens. Inject into system prompt or first message. """ parts = [] # L0: Identity parts.append(self.l0.render()) parts.append("") # L1: Essential Story if wing: self.l1.wing = wing parts.append(self.l1.generate()) return "\n".join(parts) ``` ### Technical Analysis Project and transcript content is stored verbatim in ChromaDB. Layer 1 later selects stored documents, performs only whitespace normalization and truncation, and returns them through `wake_up()`. The method explicitly recommends injecting the result into a system prompt or first message. No trust boundary separates factual mem ...[truncated 1107 chars]
Remediation: View remediation

other

Warning

Location: mempalace/entity_registry.py:179
Finding: Wikipedia lookup transmits user-derived entity names despite local-only claims
Content: View full analysis
dict: """ Look up a word via Wikipedia REST API. Returns inferred type (person/place/concept/unknown) + confidence + summary. Free, no API key, handles disambiguation pages. """ try: url = f"https://en.wikipedia.org/api/rest_v1/page/summary/{urllib.parse.quote(word)}" req = urllib.request.Request(url, headers={"User-Agent": "MemPalace/1.0"}) with urllib.request.urlopen(req, timeout=5) as resp: data = json.loads(resp.read()) ``` ```python # mempalace/entity_registry.py:512-528 def research(self, word: str, auto_confirm: bool = False) -> dict: """ Research an unknown word via Wikipedia. Caches result. If auto_confirm=False, marks as unconfirmed (needs user review). Returns the lookup result. """ # Already cached? cache = self._data.setdefault("wiki_cache", {}) if word in cache: return cache[word] result = _wikipedia_lookup(word) result["word"] = word result["confirmed"] = auto_confirm cache[word] = result self.save() return result ``` ### Technical Analysis The raw `word` supplied to `research()` is URL-encoded and placed in the path of an HTTPS request to Wikipedia. Unknown entities can include personal names, employer names, internal projects, client names, or confidential identifiers derived from conversation data. The reviewed call graph does not show this lookup being invoked automatically during standard mining. Nevertheless, whenever a caller invokes `research()`, the entity is transmitted. This contradicts the documentation’s broad assertions that all data remains local and that Wikipedia lookup does not upload user data. ...[truncated 660 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: mempalace/layers.py:374
Finding: Default MemoryStack bypasses the Skill-local identity path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: mempalace/miner.py:286
Finding: Recursive mining can persist secrets and files outside the intended trust boundary
Content: View full analysis
list: """Return list of all readable file paths.""" project_path = Path(project_dir).expanduser().resolve() files = [] for root, dirs, filenames in os.walk(project_path): dirs[:] = [d for d in dirs if d not in SKIP_DIRS] for filename in filenames: filepath = Path(root) / filename if filepath.suffix.lower() in READABLE_EXTENSIONS: # Skip config files if filename in ( "mempalace.yaml", "mempalace.yml", "mempal.yaml", "mempal.yml", ".gitignore", "package-lock.json", ): continue files.append(filepath) return files ``` ```python # mempalace/miner.py:248-260 try: content = filepath.read_text(encoding="utf-8", errors="replace") except Exception: return 0 content = content.strip() if len(content) < MIN_CHUNK_SIZE: return 0 room = detect_room(filepath, content, rooms, project_path) chunks = chunk_text(content, source_file) ``` ### Technical Analysis Mining recursively accepts b ...[truncated 1418 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: mempalace/requirements.txt:1
Finding: First-run setup installs mutable dependencies into the active Python environment
Content: View full analysis
=64"] build-backend = "setuptools.build_meta" ``` ```toml # mempalace/pyproject.toml:27-30 dependencies = [ "chromadb>=0.4.0,<1", "pyyaml>=6.0", ] ``` ```text # mempalace/requirements.txt:1-2 chromadb>=0.4.0 pyyaml>=6.0 ``` ### Technical Analysis The documented setup installs packages from the default Python package index without exact versions or integrity hashes. It also modifies whichever Python environment is active. The requirements manifest permits an unrestricted future ChromaDB major version, while `pyproject.toml` allows any release below version 1. Build tooling is also mutable. No evidence of a deliberately malicious or typosquatted package was found. The vulnerability is the non-reproducible, mutable supply-chain process: future direct or transitive releases can change the code installed and executed after the Skill itself has been reviewed. ### Attack Path 1. A user follows the automatic first-run installation procedure. 2. `pip` queries the configured package index. 3. The resolver selects currently available versions and transitive dependencies. 4. A compromised, malicious, or incompatible future release is downloaded. 5. Package build or import code executes with the user’s Python-environment privileges. ### Impact Assessment A compromised dependency could obtain the filesystem and network privileges of the installing user, tamper with the Python environment, access archived conversations, or execute ar ...[truncated 117 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (90)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Inferring rooms from local directories, prompting for approval/editing, and writing configuration files are setup behaviors that go beyond the advertised memory commands. This is risky mainly because it expands filesystem interaction and persists metadata in ways not obvious from the high-level description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill markets itself as 'local only' and says 'nothing uploaded,' but later discloses outbound Wikipedia API requests. This is a direct trust-boundary violation: users may provide sensitive content under a local-only assumption, while the software performs network activity inconsistent with that claim.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Claiming that all data remains on the user's machine while also acknowledging outbound HTTP is materially misleading. In a data-retention skill, such contradictory statements are especially dangerous because they undermine informed consent around privacy and data exposure.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The hook explicitly instructs the AI to save all topics, decisions, quotes, code, and important context from the session before compaction, including verbatim quotes. In the context of a long-term memory/archive skill, this can cause wholesale exfiltration of sensitive session content into persistent storage without scoped consent, data minimization, or filtering for secrets, making privacy leakage and retention of credentials/PII much more likely.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The injected instruction explicitly tells the AI to save key topics, decisions, quotes, and code, including verbatim quotes where possible. That is dangerous because it encourages durable retention and reproduction of potentially sensitive user data, secrets, proprietary code, or personal information, with no filtering, minimization, or consent gate.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README promotes persistent archival of AI conversations as a core feature, which creates a real data-retention risk because conversations commonly contain credentials, personal data, internal project details, and other sensitive material. Even with local-only storage, long-term accumulation increases exposure if the host is shared, compromised, backed up insecurely, or searched without proper filtering.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Automatic daily archiving increases risk because it normalizes ongoing background retention without clear per-archive consent or contextual review. In this skill context, the danger is higher than generic note-taking because the feature is specifically designed to capture AI conversations, which may include transient but highly sensitive user inputs that were never intended for durable storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises automatic daily archival of conversations but does not clearly warn users about privacy, retention duration, sensitive-content capture, or how to disable the behavior. In a memory/archive skill, this can cause users to unknowingly retain secrets, personal data, or regulated information on disk beyond the original conversation context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation describes capabilities equivalent to shell execution, file read/write, environment access, and network use, but it does not declare any tool scope or allowed-tools restrictions. That mismatch prevents users and the host from understanding or constraining what the skill can actually do, increasing the risk of over-privileged execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest frames the skill as a local memory tool, but the setup instructions include runtime package installation from PyPI and modification of the Python environment. That creates an undeclared supply-chain and system-modification risk beyond what many users would expect from a local archive utility.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition 'user wants to save, search or back up AI conversation memories' is broad enough that the skill may activate in many ordinary contexts involving memory, search, or backup discussion. Over-broad triggering is risky for a retention-oriented skill because it can cause unplanned data capture or execution of setup/install steps.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly promotes permanent archiving and searchable retention of conversations, which creates a real privacy and secondary-disclosure risk even if that is its intended purpose. In context, the danger is elevated because long-term semantic search can resurface sensitive user content far beyond the original session.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Runtime pip install from external sources grants the skill a broader capability than needed for a memory archive/search workflow and introduces supply-chain risk. It also means execution depends on mutable external artifacts at run time, making behavior less predictable and harder to audit.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The archive flow instructs reading workspace memory/ content, compressing it, and writing it into searchable storage. That creates a straightforward pathway for accidental collection of secrets, personal data, or sensitive project information if the source folder contains more than intended conversation summaries.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Wikipedia lookups are not necessary for the core stated function of archiving and semantically searching local conversation memories. Adding unnecessary network capability broadens the attack surface and weakens privacy guarantees without a compelling functional need.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation normalizes recursive scanning of many file types and shifts responsibility to the operator to ensure no sensitive files are present. For a tool that builds searchable memory, this is dangerous because a single mis-scoped directory can ingest confidential content into durable indexed storage.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.