ClawHub
Back to skill

Security audit

mem0 Local Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a real local memory setup guide, but it asks users to run unpinned external code, enable persistence, and import/share sensitive agent memories in ways that need careful review.

Install only if you are comfortable with a shared long-term memory pool across agents, third-party processing of memory snippets, and running an external repository's code. Before use, pin the repo to a reviewed commit, keep the endpoint loopback-only, review/redact imported workspace files, avoid system-wide auto-start, and prefer user-level service configuration with secure secret storage.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T06 · System Persistence

Error
Location
SKILL.md:58
Finding

Persistent Auto-Start Service Exceeds Minimum Privileges

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/import_openclaw_memories.py:15
Finding

Sensitive Workspace Memories Can Be Sent to an Arbitrary Endpoint

Content
View full analysis
bool: """Add a memory to mem0 with unified user_id and source metadata.""" try: r = requests.post( f"{MEM0_URL}/api/memory/add", json={ "text": text, "user_id": UNIFIED_USER_ID, "metadata": { "source_agent": source_agent, "source_file": source_file, } }, headers={"Content-Type": "application/json"}, timeout=30, ) return r.status_code == 200 except Exception as e: print(f" ⚠️ Failed to add memory: {e}") return False ``` ```python with open(filepath, "r", encoding="utf-8") as f: content = f.read() if not content.strip(): print(f" ⏭️ {filename} is empty, skipping") continue sections = split_by_sections(content) print(f" 📄 {filename}: {len(sections)} sections") for i, section in enumerate(sections): # Skip pure title/header-only sections lines = [l for l in section.split("\n") if l.strip() and not l.startswith("#")] if not lines or len("\n".join(lines)) < 15: total_skipped += 1 continue # Pre ...[truncated 2558 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/import_openclaw_memories.py:16
Finding

Unified Memory Identity Breaks Cross-Agent Isolation

Content
View full analysis
bool: """Add a memory to mem0 with unified user_id and source metadata.""" try: r = requests.post( f"{MEM0_URL}/api/memory/add", json={ "text": text, "user_id": UNIFIED_USER_ID, "metadata": { "source_agent": source_agent, "source_file": source_file, } }, ``` The design is also explicitly documented in `SKILL.md`, lines 178-179: ```text - **All agents share one memory pool** (`user_id: "openclaw"`). Cross-agent by design. ``` ### Technical Analysis Content from five separate workspace directories is stored under the same `user_id`. The `source_agent` metadata records where content originated but does not create an authorization boundary or prevent retrieval by another Agent. If the Agents differ in their users, tools, responsibilities, or trust levels, the unified identity defeats least privilege. An Agent that should only access its own workspace can receive memories imported from a more privileged Agent through semantic recall. The behavior is documented and intentional rather than hidden. Nevertheless, documenting a boundary violation does not remove its confidentiality risk, particularly because automatic recal ...[truncated 1081 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:22
Finding

Mutable Remote Repository Is Retrieved, Built, and Persistently Executed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (15)

Tainted flow: 'MEM0_URL' from os.environ.get (line 17, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/import_openclaw_memories.py (reported line 34)May include surrounding context.

python
def check_health():
    """Check mem0 server is running."""
    try:
        r = requests.get(f"{MEM0_URL}/api/health", timeout=5)
        data = r.json()
        if data.get("status") == "ok":
            print(f"✅ mem0 server healthy (memories: {data.get('total_memories', '?')})")

Tainted flow: 'MEM0_URL' from os.environ.get (line 17, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The script reads MEMORY.md and TOOLS.md from multiple workspaces and posts their contents to whatever endpoint MEM0_URL specifies, without restricting that destination to a local trusted service. If MEM0_URL is changed to a remote or attacker-controlled host, sensitive cross-session memory content can be exfiltrated in bulk; the unified user_id also aggregates all agents' data, increasing blast radius.

Content

Scanner excerpt · scripts/import_openclaw_memories.py (reported line 70)May include surrounding context.

python
def add_memory(text: str, source_agent: str, source_file: str) -> bool:
    """Add a memory to mem0 with unified user_id and source metadata."""
    try:
        r = requests.post(
            f"{MEM0_URL}/api/memory/add",
            json={
                "text": text,

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description emphasizes a local memory plugin setup, but the guide also instructs importing data from all agent workspaces, sharing one memory pool across agents, and transmitting snippets to external LLM/embedding providers. This mismatch is dangerous because it can cause operators to approve or run the skill under an incomplete understanding of its data collection, cross-agent exposure, and outbound data flows.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

text

```bash
sudo systemctl enable mem0 && sudo systemctl start mem0

Verify:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs users to clone a repo, run shell scripts, use environment variables, access local files, and perform network/API operations, but it does not declare any tool scope or permissions metadata. That omission reduces transparency and weakens policy enforcement, making it easier for a high-capability skill to be invoked without users or the platform clearly understanding its access needs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

Copying a launchd plist into LaunchAgents prepares the service to run persistently for the user account. Because the plist may contain API keys and defines automatic execution of a local server, this persistence should be considered sensitive and disclosed more prominently.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

bash
# Copy and edit the template — replace $HOME, API keys, proxy settings
cp launchd/ai.openclaw.mem0.plist ~/Library/LaunchAgents/
# IMPORTANT: edit the plist to fill in your actual paths and API keys
nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist
# Load the service

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

Editing a launchd plist to include paths and API keys supports a persistent agent process and may encourage secret placement in a long-lived config file. This is risky because it combines automatic execution with potentially sensitive credential storage in user-managed files.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
# Copy and edit the template — replace $HOME, API keys, proxy settings
cp launchd/ai.openclaw.mem0.plist ~/Library/LaunchAgents/
# IMPORTANT: edit the plist to fill in your actual paths and API keys
nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist
# Load the service
launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

Loading the launchd plist activates a persistent background service. Given that the service handles memory ingestion and may forward snippets to external APIs, automatic execution increases the chance of unnoticed long-term data processing if users do not fully understand the behavior.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Copy and edit the template — replace $HOME, API keys, proxy settings

cp launchd/ai.openclaw.mem0.plist ~/Library/LaunchAgents/

IMPORTANT: edit the plist to fill in your actual paths and API keys

nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist

Load the service

launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

This duplicate finding points to the same launchd persistence behavior at the same location. The security concern is the same: automatic background execution of a data-processing service with external API dependencies.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

IMPORTANT: edit the plist to fill in your actual paths and API keys

nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist

Load the service

launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist

text

**Option C — Linux systemd:**

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

This duplicate finding points to the same launchd persistence behavior at the same location. The security concern is the same: automatic background execution of a data-processing service with external API dependencies.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

IMPORTANT: edit the plist to fill in your actual paths and API keys

nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist

Load the service

launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist

text

**Option C — Linux systemd:**

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Creating a systemd unit file is part of setting up persistent background execution. In the context of a memory service that may read/import workspace data and contact third-party APIs, persistence materially increases exposure duration and should be treated as a security-relevant behavior, not just installation detail.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Option C — Linux systemd:

Create /etc/systemd/system/mem0.service:

ini
[Unit]
Description=mem0 local memory server

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

text

```bash
sudo systemctl enable mem0 && sudo systemctl start mem0

Verify:

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

Enabling a service at boot establishes persistence on the host, which is a sensitive capability even when presented as a convenience feature. Persistent services can continue processing local data and making outbound API calls across sessions, so users must clearly understand and consent to this ongoing behavior.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

text

```bash
sudo systemctl enable mem0 && sudo systemctl start mem0

Verify:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Verify:

bash
curl http://127.0.0.1:8300/api/health
# Should return {"status": "ok", ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This code intentionally transmits local memory files to an external HTTP API endpoint. In the context of a memory-import skill, that behavior is expected, but it is still security-sensitive because the imported files may contain secrets, internal instructions, or other sensitive agent state, and the destination is configurable rather than strongly bound to a local service.

Content

Scanner excerpt · scripts/import_openclaw_memories.py (reported line 70)May include surrounding context.

python
def add_memory(text: str, source_agent: str, source_file: str) -> bool:
    """Add a memory to mem0 with unified user_id and source metadata."""
    try:
        r = requests.post(
            f"{MEM0_URL}/api/memory/add",
            json={
                "text": text,

Static analysis

No suspicious patterns detected.