Security audit

Ditto

Security checks across malware telemetry and agentic risk

Overview

Ditto appears to be a real memory integration, but it needs review because it can automatically create and persist third-party memory access and use broad prompts to save, retrieve, edit, or publish personal memories.

Install only if you want OpenClaw to use Ditto as a third-party long-term memory service. Before use, require explicit confirmation for account setup, saving, searching, updating, publishing, unpublishing, login, logout, or key rotation. Treat both the Ditto API key and claim URL as secrets, avoid storing sensitive or confidential content unless you intend it, and rotate/logout if either credential may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documented workflow expands the skill from memory retrieval/manipulation into account bootstrap and credential-management operations. That scope creep is dangerous because it enables the agent to provision identity-bearing access and alter persistent authentication state, which is materially different from the declared save/search/fetch/traverse purpose.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Instructing the agent to create a temporary claimable account gives it the ability to provision a new access context and obtain a working API key, even when the user only asked for memory operations. This can create unintended accounts, route data into a new identity, and expose access-bearing claim material without informed user approval.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The login/logout guidance authorizes persistent credential changes unrelated to the stated memory operations and can silently switch the active Ditto identity for future sessions. That creates a risk of cross-account access, data mixing, and unintended persistence of credentials beyond the immediate user request.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The setup instructs the user to create and persist a live Ditto API key, and explicitly suggests exporting it as an environment variable, but does not clearly emphasize that this credential grants access to the user's memory graph and must be treated as secret. In an agent skill context, normalizing credential creation and storage without strong handling guidance increases the chance of accidental disclosure through shell history, logs, screenshots, or inherited process environments.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The top-level description instructs agents to use the skill whenever users reference broad phrases like "remember" or "from my notes," which can cause over-activation in ordinary conversation. Because this skill reads and writes long-term memory, unintended invocation can expose prior private data or persist sensitive information without sufficiently clear user intent.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The "When to use" section contains broad, everyday phrases and vague conditions like topics that "might be in their memory," encouraging the agent to query a personal memory store speculatively. In the context of a memory-graph skill, that increases the risk of unnecessary retrieval of sensitive past content and accidental retention of new data based on ambiguous prompts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The claim URL is access-bearing account-recovery material, and the documentation tells the agent to share it without a meaningful warning about ownership transfer, privacy implications, or the sensitivity of the token in the query string. A leaked or mishandled claim URL could let another party claim the account and access associated memories.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.