Security audit

Memory Pro System

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is coherent, but it asks users to install unaudited mutable code and grants broad long-term memory, credential, and background-service behavior that needs careful review.

Install only if you are comfortable with a persistent memory service that may store conversations, route high-importance content into training/export paths, run scheduled background work, and access LLM credentials. Prefer pinning the source repository to a reviewed commit, installing in an isolated environment, using dedicated low-quota API keys, and avoiding shared credential profile fallback unless you have verified the implementation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: setup.md:5
Finding: Installation of Unpinned Code from a Mutable Remote Repository
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: setup.md:24
Finding: Automatic Access to Shared OpenClaw Credential Profiles
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill clearly advertises persistent storage of notes and conversations as long-term memory, but it does not provide a prominent user warning about retention scope, downstream processing, or where that data may flow across subsystems like vector storage, MSA, the knowledge graph, logs, and feedback pipelines. This creates a privacy and consent risk because users may disclose sensitive content without understanding that it will be broadly retained, linked, and reused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description states that Chronos supports training data export, but it gives no user-facing warning that stored memories, notes, or conversations may be converted into training artifacts. That omission is dangerous because users may unknowingly contribute sensitive or proprietary information to exportable datasets, increasing the risk of secondary disclosure, misuse, or policy noncompliance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file instructs users to export OPENROUTER_API_KEY and XAI_API_KEY environment variables but does not include any warning that these values are sensitive credentials or should be kept out of shell history, logs, or committed config files. For setup documentation, this is a user-facing behavior affecting privacy and account security, so a brief warning is expected.
Content: No source excerpt is available for this finding.