Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:74
- Evidence
function readBootstrap(env = process.env) {
Security audit
memini
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed persistent-memory plugin that recalls and stores OpenClaw conversation context through a configured memini service.
Install only if you want conversation history persisted to memini. Review base_url, namespace, per-agent settings, and MEMINI_API_KEY handling before use, especially if pointing at a remote server; avoid sending secrets in conversations that automatic capture may store.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access