ClawHub
Back to skill

Security audit

mem0 Local Memory

Security checks for vulnerabilities and agentic risk

Overview

This looks like a disclosed local memory plugin, but it asks users to enable broad persistent cross-agent memory with limited containment guidance.

Install only if you intentionally want shared long-term memory across OpenClaw agents. Review MEMORY.md and TOOLS.md before importing, keep MEM0_URL on localhost unless you explicitly trust the remote server, use dedicated API keys, consider disabling autoCapture until tested, and make sure you know how to stop the service and delete stored memories.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tainted flow: 'MEM0_URL' from os.environ.get (line 17, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
def add_memory(text: str, source_agent: str, source_file: str) -> bool:
    """Add a memory to mem0 with unified user_id and source metadata."""
    try:
        r = requests.post(
            f"{MEM0_URL}/api/memory/add",
            json={
                "text": text,
Confidence
90% confidence
Finding
The script sends workspace-derived content to whatever endpoint MEM0_URL specifies, and that content may include sensitive memory and tool data from multiple agent workspaces. If MEM0_URL is changed to a remote or attacker-controlled host, the script will exfiltrate those files without any validation, confirmation, or locality restriction.

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill requires environment variables, local file access, network communication, and shell execution, but does not declare those capabilities explicitly. This creates a transparency and consent problem: users may approve a 'memory plugin' without realizing it reads workspace files, installs software, and transmits content to external APIs.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior goes beyond a simple local-memory setup by importing MEMORY.md and TOOLS.md from multiple workspaces, centralizing data across agents, and forwarding text to services that depend on external APIs. In this context, the mismatch is dangerous because users may expect isolated local storage, while the skill enables cross-workspace aggregation and third-party exposure of potentially sensitive operational notes.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The script intentionally collapses memories from multiple agent workspaces into a single shared user_id, removing logical separation between agents. This can cause cross-agent data leakage, prompt contamination, and unintended access to another agent's memory content across sessions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script uploads memory contents from local workspace files to the mem0 server without explicit user-facing notice about the privacy implications. Because these files can contain sensitive notes, operational details, or credentials, silent transmission increases the chance of unintentional disclosure.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script unifies multiple agents' memories under one shared user_id without a runtime warning that isolation is being lost. In this skill context, persistent semantic memory is central functionality, so removing separation materially increases the risk of cross-agent disclosure and incorrect recall of another workspace's data.

Session Persistence

Medium
Category
Rogue Agent
Content
```

```bash
sudo systemctl enable mem0 && sudo systemctl start mem0
```

**Verify:**
Confidence
91% confidence
Finding
Enabling the service with systemd creates persistent execution across reboots, which increases the blast radius of any misconfiguration, data leakage, or future compromise in the memory server. In a plugin that processes sensitive memory and API keys, persistence materially raises risk even if it is presented as convenience.

Session Persistence

Medium
Category
Rogue Agent
Content
**Option C — Linux systemd:**

Create `/etc/systemd/system/mem0.service`:
```ini
[Unit]
Description=mem0 local memory server
Confidence
89% confidence
Finding
The systemd service definition establishes a long-running background process that will survive user sessions and potentially system restarts. Because this service handles sensitive memory content and credentials, persistence increases exposure if the service is insecure or the host is shared.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# Copy and edit the template — replace $HOME, API keys, proxy settings
cp launchd/ai.openclaw.mem0.plist ~/Library/LaunchAgents/
# IMPORTANT: edit the plist to fill in your actual paths and API keys
nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist
# Load the service
Confidence
86% confidence
Finding
Installing a launchd plist into LaunchAgents is a persistence mechanism that causes the memory service to start automatically. In this skill, that means a background process with access to local memory data and API keys may continue running without the user actively invoking it.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# Copy and edit the template — replace $HOME, API keys, proxy settings
cp launchd/ai.openclaw.mem0.plist ~/Library/LaunchAgents/
# IMPORTANT: edit the plist to fill in your actual paths and API keys
nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist
# Load the service
launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist
Confidence
84% confidence
Finding
The instruction to edit the plist with actual API keys suggests placing secrets into a persistent service configuration file. This combines persistence with weaker secret hygiene, increasing the chance that credentials remain stored in plaintext and are reused automatically.

Session Persistence

Medium
Category
Rogue Agent
Content
# Copy and edit the template — replace $HOME, API keys, proxy settings
cp launchd/ai.openclaw.mem0.plist ~/Library/LaunchAgents/
# IMPORTANT: edit the plist to fill in your actual paths and API keys
nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist
# Load the service
launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist
```
Confidence
87% confidence
Finding
The launchctl load step activates a persistent LaunchAgent, causing the service to start automatically in future sessions. For a component that aggregates agent memories and can send text to external APIs, auto-start increases ongoing data-handling exposure.

Session Persistence

Medium
Category
Rogue Agent
Content
# IMPORTANT: edit the plist to fill in your actual paths and API keys
nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist
# Load the service
launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist
```

**Option C — Linux systemd:**
Confidence
83% confidence
Finding
The repeated plist-related persistence setup indicates ongoing background execution through launchd. Even if not malicious, persistent startup for a memory aggregation service increases the likelihood of unnoticed data processing and long-term credential exposure.

Session Persistence

Medium
Category
Rogue Agent
Content
# IMPORTANT: edit the plist to fill in your actual paths and API keys
nano ~/Library/LaunchAgents/ai.openclaw.mem0.plist
# Load the service
launchctl load ~/Library/LaunchAgents/ai.openclaw.mem0.plist
```

**Option C — Linux systemd:**
Confidence
83% confidence
Finding
The repeated plist-related persistence setup indicates ongoing background execution through launchd. Even if not malicious, persistent startup for a memory aggregation service increases the likelihood of unnoticed data processing and long-term credential exposure.

Static analysis

No suspicious patterns detected.