Security audit

self-evolving-memory

Security checks across malware telemetry and agentic risk

Overview

This skill persistently manages OpenClaw memory files as advertised, with some privacy and control considerations but no artifact-backed malicious behavior.

Install only if you want an agent to maintain persistent memory and possibly update agent-behavior files. Review the setup script before running it, point it at the correct workspace, keep backups of existing memory or rule files, and prefer local embeddings for sensitive memory unless you trust the external provider and its data handling.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill description emphasizes memory orchestration, but the body also authorizes workspace scaffolding, file creation, and configuration-oriented setup behavior. This mismatch matters because it expands the effective capability surface beyond what a user may reasonably expect when invoking the skill, increasing the chance of unintended filesystem changes and overbroad trust.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README says the skill will scan the user's workspace and report what is configured, but it does not clearly warn that this may access broad workspace contents or describe scope limits. In a memory-oriented skill, users may expose sensitive files, notes, secrets, or unrelated project data without realizing the extent of inspection, making this a real privacy and data-minimization issue.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad enough that ordinary conversation about remembering, saving notes, or continuity could invoke a skill that performs persistent edits. In this context, overbroad invocation is risky because the skill is authorized to write multiple files and can do so without re-confirmation, making accidental activation more consequential.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This section instructs automatic creation of required files from templates and presents it as the default action when files are missing. Automatic scaffolding modifies the workspace persistently, and without an upfront warning or explicit consent gate, it can create unwanted files or alter repository state in a way the user did not anticipate.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runtime and routing rules direct edits across many persistent memory and enforcement files, and the skill explicitly says not to ask for permission again when the memory action seems clear. In practice, this creates a high risk of silent or ambiguous long-term changes to behavioral control files like SOUL.md, AGENTS.md, or TOOLS.md, which can materially influence future agent behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide presents cloud and third-party embedding providers as normal configuration options without a prominent warning that memory content and queries may be sent off-device. In a memory-management skill, that data can include sensitive user preferences, task state, and long-term stored information, so omission of a clear disclosure meaningfully increases privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.