Security audit

Openclaw Deeprecall

Security checks across malware telemetry and agentic risk

Overview

DeepRecall is a coherent agent-memory skill, but it stores long-lived raw memory data and can send memory files to an auto-selected LLM provider without strong consent, privacy, or deletion controls.

Install only if you intentionally want persistent agent memory. Before using it, choose a trusted or local LLM provider, avoid processing secrets or regulated data, use --no-store-raw for sensitive files, run cleanup with --dry-run first, and plan how to inspect, back up, or delete memory.db because archived records are described as permanent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The module advertises itself as a retrieval engine, but it also bootstraps and mutates persistent storage and includes raw-file cleanup logic. This broader-than-advertised behavior is dangerous because callers may grant it read-oriented trust while it can create databases and participate in destructive workflows affecting memory artifacts.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: A retrieval-focused skill includes file-deletion capability that removes raw memory markdown files based on age and size, with auto-detected paths and no access-control boundary in this module. In an agent memory context, this can destroy forensic history, impair auditability, and cause denial of service or evidence loss if invoked improperly or maliciously.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide explicitly instructs users to configure third-party LLM providers and states that content will be sent to those providers, but it does not warn that potentially sensitive data may leave the local environment. In a memory/summarization feature, users may reasonably assume notes or recalled content stay local, so the omission can lead to unintended disclosure of private or regulated information.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The configuration documents `store_raw_content: true` as the default and describes storing raw content in an archive, but it does not warn about retention, access control, or privacy consequences. This increases the risk that sensitive source material is preserved longer than users expect, expanding exposure in the event of local compromise, backup leakage, or unauthorized access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly states that both structured facts and raw content are stored permanently, but it does not prominently warn users that potentially sensitive session data may be retained indefinitely. In an agent-memory context, this creates a real privacy and data-retention risk because credentials, personal data, internal notes, or confidential project content could be persisted beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises automatic cleanup of raw .md files after short retention, but it does not clearly foreground that deletion will occur or explain the operational consequences to users. This can cause unexpected data loss, reduce forensic/auditability, and mislead users into thinking source files remain available when only database copies persist.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The cleanup function deletes markdown files at runtime without interactive confirmation or any mandatory warning, while also auto-detecting the target memory directory. In a memory-management skill, silent deletion increases the likelihood of accidental data loss and makes misuse more dangerous because destructive behavior can occur under the guise of routine maintenance.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The code sends raw memory content to a configured external LLM provider with no explicit consent gate, redaction step, or prominent disclosure that private memory data will leave the local environment. Because these memory files may contain sensitive personal, project, or credential-adjacent information, this creates a real confidentiality risk and expands exposure to third-party providers and any compromised endpoint configured in openclaw.json.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The summarizer stores full raw memory content into the SQLite archive by default, increasing persistent retention of potentially sensitive information without any clear warning, retention policy, or minimization controls. This broadens the blast radius of later database compromise, accidental disclosure, or unauthorized local access.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The prompt is explicitly designed to extract structured facts from arbitrary raw memory content, which may include private or sensitive user data. In this skill's context, that prompt is later coupled to external LLM submission, so it materially facilitates natural-language disclosure and transformation of sensitive content into more easily consumable summaries.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.