Jasper Recall

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:42 AM UTC
• Version: 0.4.0

Overview

Jasper Recall is a coherent local memory skill, but it exposes high-impact memory access and has artifact-backed command-injection and auto-recall privacy risks that need review before installation.

Install only if you want a persistent local memory system and are comfortable reviewing its configuration. Keep the HTTP server bound to localhost, do not enable private HTTP queries for untrusted callers, set publicOnly for sandboxed agents, and avoid enabling autoRecall until the shell command construction is fixed or replaced with argument-array subprocess calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Tainted flow: 'archive_path' from os.environ.get (line 207, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow

Content

rel_path = os.path.relpath(filepath, MEMORY_DIR)
    archive_path = os.path.join(ARCHIVE_DIR, rel_path)
    os.makedirs(os.path.dirname(archive_path), exist_ok=True)
    shutil.copy2(filepath, archive_path)
    
    # Write summarized version
    with open(filepath, 'w', encoding='utf-8') as f:

• Confidence: 84% confidence
• Finding: shutil.copy2(filepath, archive_path)

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document describes 'privacy controls' while also enabling a shared memory directory with symlinks into sandboxed workspaces, which weakens isolation guarantees and can expose data across trust boundaries. In an agent skill focused on cross-agent memory sharing, this is especially risky because symlinks and sync jobs can cause unintended access, propagation, or leakage of information that users or agents may assume remains private.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The plugin exposes index-maintenance operations (/index and recall.index) in a skill primarily framed as recall/search. In this context, adding mutating maintenance actions expands the attack surface: any caller able to invoke these interfaces can trigger expensive local subprocess execution and modify local memory indexes, which can be abused for unauthorized state changes or denial of service.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code creates separate collections that imply access segregation, but then unconditionally writes every indexed document into the legacy 'jasper_memory' collection as well. If any consumer still reads from that legacy collection without equivalent authorization checks, private or restricted content becomes available through a less restricted path, undermining the intended private/shared/learnings separation.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The recall function builds a shell command string and passes user-controlled input into execSync, which invokes a shell. Wrapping arguments in double quotes is not sufficient to prevent shell metacharacter expansion such as command substitution, so a crafted query could execute arbitrary local commands in the agent context.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The module exposes local indexing and session-digest processing by launching external binaries from a user-writable home-directory path. Even if the arguments here are less obviously injectable than in recall, execution of unverified binaries from ~/.local/bin expands the trust boundary and could run attacker-planted executables or unexpectedly modify local memory artifacts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The plugin's auto-recall feature automatically injects retrieved past memories into every message context, which can expose sensitive prior conversation data without an explicit consent, warning, or strict default privacy boundary. In this skill's context, the risk is amplified because the same README also promotes shared memory, multi-agent access, and an HTTP recall server, making accidental cross-session or cross-agent disclosure more likely.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The markdown documents shared-memory syncing and logging behavior without any explicit warning that data may be shared across agents or persisted in shared locations. That omission can lead operators to enable or use the feature without understanding the privacy consequences, increasing the chance of accidental disclosure of sensitive notes, prompts, or agent-generated artifacts.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The stated goal is 'bidirectional memory sharing between agents with privacy controls,' but the document does not include an explicit warning about cross-agent exposure despite advertising sync and shared recall capabilities. In this skill context, the absence of a clear warning is more dangerous because the feature is specifically designed to move memory across agent boundaries, making accidental data leakage a core operational risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The HTTP API returns memory search results and the raw backend output to any caller, while also setting Access-Control-Allow-Origin: * and offering an option to bind to 0.0.0.0. In skill/agent contexts, memories can contain sensitive prompts, secrets, file paths, or private notes, so exposing both parsed results and raw output creates a clear data disclosure risk, especially if the service is made remotely reachable or queried by an untrusted local process/web page.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly promotes cross-agent memory sharing and mesh queries over multiple agents' collections, including access to agent-specific stores plus shared collections, but it does not describe any authorization boundaries, consent model, or safeguards to prevent accidental disclosure of sensitive data. In a multi-agent system, treating agent-private memories as queryable by other agents via `--mesh` can lead to unintended data exposure, especially because the doc frames this as normal operation and only mentions permissions as a future enhancement.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents an auto-recall feature that injects retrieved memory content into the agent context before every message, which can expose sensitive prior notes, private memories, or unrelated internal data without explicit user awareness or per-request consent. This is more dangerous because the feature is automatic, enabled in the example configuration, and the injected context can influence downstream handling of untrusted or external-facing prompts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When autoRecall is enabled, the plugin forwards the full prompt to an external binary before agent processing. That can expose sensitive user or system prompt content to another executable and downstream storage/indexing components without explicit consent, minimization, or clear trust boundaries; in this skill context, that is more dangerous because prompts may contain secrets, personal data, or hidden instructions.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The plugin explicitly supports automatically injecting recalled memories into the agent context, but the manifest text does not clearly warn that this can surface prior sensitive content or alter downstream model behavior without a fresh user action. In a memory/RAG skill, that omission is meaningful because users or sandboxed agents may not realize historical private data can be reintroduced into prompts automatically.

Vague Triggers

Low

• Confidence: 72% confidence
• Finding: The top-level description advertises 'auto-recall' but does not state when it activates, what inputs trigger it, or what memory scope is eligible for injection. That ambiguity can lead to unintended context inclusion and makes it harder for users or integrators to reason about privacy and prompt-safety behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly states that it searches memory before every message and injects matching memories into agent context, but it does not describe any user-facing notice, consent flow, or clear boundary around what may be surfaced. This creates a real privacy and data-minimization risk: sensitive prior notes, SOPs, or personal/project context can be exposed to prompts or downstream agent behavior when only loosely relevant, especially with low similarity thresholds and `publicOnly: false`.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Auto-recall sends the full user prompt to the local recall subprocess without explicit disclosure at the point of use. Even though the subprocess appears local, this still transfers potentially sensitive prompt contents outside the immediate agent flow into another executable and data store boundary, increasing privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The /index command executes a local indexing subprocess that can mutate memory indexes without any confirmation, disclosure, or secondary guard beyond requireAuth. If an authenticated but low-trust user or compromised session can invoke commands, this enables unreviewed state changes and potentially resource-intensive reindexing.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The recall.index gateway method exposes a mutating subprocess operation over RPC with no visible authorization or confirmation in this code path. In skill/plugin contexts, remotely invocable mutating methods are more dangerous than local commands because they may be reachable by other components or clients and can be abused to alter state or exhaust resources.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script extracts user-message content from session logs and persists that extracted content into markdown digest files on disk without any warning, consent check, retention control, or access restriction. Because session logs can contain sensitive prompts, secrets, or personal data, creating secondary summaries increases the persistence and exposure surface of that data.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This script automatically indexes local memory, session digests, founder logs, repos, and SOP files into a persistent vector database, which can include highly sensitive material. Because it does so without explicit consent, warning, or data minimization, operators may unknowingly persist confidential information in an additional storage layer that can later be queried or exposed by other components.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Setup for Sandboxed Agents

1. Create shared directory: `mkdir -p ~/.openclaw/workspace/memory/shared`
2. Symlink to sandboxed workspace: `ln -s ~/.openclaw/workspace/memory/shared ~/.openclaw/workspace-sandbox/shared`
3. Use `--public-only` flag in sandboxed agent's recall queries

• Confidence: 78% confidence
• Finding: Create shared directory: `mkdir -p ~/.openclaw/workspace/memory/shared` 2. Symlink to sandboxed workspace: `ln -s ~/.openclaw/workspace/memory/shared ~/.openclaw/workspace-sandbox/shared` 3. Use `--pu

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env python3
"""
Write a learning to the agent_learnings collection.
Designed for sandboxed agents to contribute back to shared memory.

Usage:

• Confidence: 89% confidence
• Finding: Write a learning to the agent_learnings collection. Designed for sandboxed agents to contribute back to shared memory. Usage: write-learning "Brief title" "Learning content..." write-learning --a

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: cli/doctor.js:15

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: cli/jasper-recall.js:43

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: cli/server.js:33

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: extensions/jasper-recall/index.ts:58

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: extensions/openclaw-plugin/index.ts:58

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/index.js:28

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:424