Security audit

Memory Tools

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local memory plugin with real privacy and prompt-context risks, but its behavior fits its stated purpose and the highest-impact features are opt-in.

Install only if you want OpenClaw to keep local plaintext memories. Avoid storing secrets, handle exports as sensitive files, periodically review or delete memory files, keep autoInjectInstructions off unless you trust the instruction memories, and keep OpenClaw, QMD, and development dependencies updated.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill description emphasizes agent-controlled memory without auto-capture noise, but the documentation also discloses optional automatic instruction injection and legacy auto-migration behaviors. This mismatch can cause operators to enable the plugin without fully understanding that stored instruction memories may be silently inserted into agent context or that older data may be imported, increasing prompt-injection and unintended data exposure risk.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The tool documentation says deletion should occur when the user explicitly asks to forget something or when information is clearly obsolete, but the implementation will auto-delete based on fuzzy search heuristics such as substring inclusion or a 'clear winner' score gap. In a memory-management skill, this can cause unintended permanent deletion of user data from ambiguous queries, making the agent susceptible to prompt mistakes or adversarial phrasing that triggers destructive actions without confirmation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The memory_store API advertises that existing memories should be updated via memory_update, but the code automatically deletes same-category moderately similar memories when similarity exceeds 0.5. Because semantic similarity is imperfect, new content can silently replace unrelated or partially related memories, enabling accidental or adversarial corruption of long-term memory state.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README documents exporting and inspecting stored memories, which may contain sensitive personal data, but does not warn users about privacy, local file exposure, shell history, or safe handling of exported JSON. In a memory plugin, this omission is meaningful because the feature is explicitly designed to retain user facts, preferences, relationships, and instructions, increasing the likelihood that operators will handle sensitive data without appropriate caution.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill persistently stores user-related information on disk, including facts, preferences, relationships, and instructions, but the introductory description lacks a prominent privacy warning. In practice, this can lead users or operators to store sensitive personal data without understanding retention, local access, backup exposure, or the consequences of exporting/searching those memories.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This code path performs irreversible deletion immediately after fuzzy matching, without a confirmation prompt at the point of action. In an agent-controlled memory system, destructive operations based on heuristic matches are dangerous because a malformed prompt, model error, or adversarial instruction can erase important memories with no user review.

Ssd 3

High

Confidence: 97% confidence
Finding: This hook automatically injects previously stored memories in the 'instruction' category into every future agent prompt as trusted standing instructions. Because those instructions can originate from prior tool calls or untrusted conversational content, this creates persistent prompt injection: a malicious or accidental instruction can survive across sessions, override future user intent, exfiltrate secrets, or coerce unsafe tool usage without fresh user approval.

Known Vulnerable Dependency: vitest==2.1.0 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: vitest==2.1.0

Known Vulnerable Dependency: openclaw==2026.0.0 — 10 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +7 more

High

Category: Supply Chain
Confidence: 87% confidence
Finding: openclaw==2026.0.0

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal