Security audit

Openclaw Deeprecall

Security checks for vulnerabilities and agentic risk

Overview

DeepRecall has a coherent memory purpose, but it stores raw session memory permanently and has under-scoped paths that can read, transmit, or delete more local data than users would reasonably expect.

Review this skill carefully before installing. Use it only for memory content you are comfortable storing long term, set no_store_raw or store_raw_content false where possible, avoid scheduling automatic jobs until retention and provider settings are understood, and do not process arbitrary file paths. Prefer an explicit trusted provider or local-only extraction, and keep sensitive secrets, credentials, private keys, and regulated data out of memory files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/memory_summarizer.py:863
Finding: Arbitrary Local File Read, Persistent Archival, and External Transmission
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/memory_summarizer.py:233
Finding: Sensitive Agent Memory Sent to an Unrestricted Automatically Selected Endpoint
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/memory_retriever.py:489
Finding: Cleanup Command Can Delete Markdown Files Outside the Agent Workspace
Content: View full analysis
dict: ``` ```python md_files = glob.glob(os.path.join(memory_dir, "*.md")) ``` ```python if not dry_run: for file_info in files_to_delete: try: os.remove(file_info["path"]) deleted_files.append(file_info["path"]) deleted_size_kb += file_info["size_kb"] except Exception as e: continue ``` ### Technical Analysis The cleanup operation accepts an arbitrary `memory_dir` and immediately deletes selected `.md` files unless dry-run mode is explicitly requested. It does not verify that the directory is the current agent's memory directory or even beneath the workspace. The numeric arguments are also not constrained to non-negative values. A negative retention period produces a cutoff time in the future, causing existing files to qualify as old. A negative size limit can cause the size-based ...[truncated 1186 chars]
Remediation: View remediation
= 0` and `max_size_kb >= 0`, and impose reasonable upper bounds. 5. Default cleanup to dry-run mode. 6. Require explicit confirmation containing the directory and number of files before deletion. 7. Refuse cleanup if the detected directory appears to be a filesystem root, home directory, or project root. 8. Move files into a recoverable quarantine directory before permanent deletion. 9. Log each deletion failure rather than silently suppressing exceptions. 10. Consider deleting only files already recorded as successfully processed. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/memory_retriever.py:90
Finding: Unencrypted Permanent Storage of Complete Session Memory Without Retention Controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:3
Finding: Unpinned Network-Facing Runtime Dependency
Content: View full analysis
=3.8.0 ``` ### Technical Analysis The lower-bound-only requirement allows installation of any future `aiohttp` release. As a result, the exact code installed in the Skill environment is not fixed to the version reviewed during the audit. No malicious package or dependency-confusion name was identified. The risk is that future compromised, vulnerable, or incompatible releases could be installed automatically without a corresponding Skill review. This dependency is security-sensitive because it handles bearer credentials and transmits memory content. ### Attack Path 1. The Skill is installed or rebuilt at a later date. 2. The package resolver selects a newer `aiohttp` release than the one originally tested. 3. The unreviewed release executes in the Skill process. 4. A compromised or vulnerable release could access API credentials, request payloads, local process data, or network traffic handled by the library. ### Impact Assessment A malicious dependency release would execute with the same filesystem and network privileges as the Skill. It could potentially read memory files, access provider credentials already loaded into the process, alter requests, or exfiltrate stored data. The finding is lower severity because the audited project does not identify a currently malicious dependency, and exploitation depends on a future unsafe release or compromised package distribution. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Rogue AgentSelf-Modification, Session Persistence

Findings (24)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly states that exact raw session content is stored permanently and that records are never deleted. Indefinite retention of verbatim user content materially increases the chance of long-term exposure of secrets, personal data, proprietary information, and prompt history through later retrieval, compromise, or misuse.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code transmits complete memory content to an external LLM provider for processing, and the prompt explicitly solicits user profile, identity, project, and technical information. In the context of a memory system, that content is especially likely to contain sensitive disclosures, credentials, internal architecture notes, or personal data, making third-party exfiltration a serious confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide documents configuration that sends content to third-party LLM providers but does not clearly warn users that their data may leave the local environment. In a memory/summarization feature, users may reasonably include sensitive notes or workspace content, so omission of a transmission warning creates a real privacy and compliance risk even if the document is otherwise instructional.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented default store_raw_content: true means original user content is retained, but the guide does not clearly warn about persistence, retention scope, or privacy implications. Retaining raw content can increase exposure of secrets, personal data, and internal documents if storage is later accessed, backed up, or exfiltrated.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs automatic tool registration and broad future-use retrieval for prior work, decisions, people, preferences, and todos, effectively enabling persistent cross-session memory by default. This widens the blast radius of any sensitive data captured once, because future interactions may surface it without fresh user intent or contextual authorization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents permanent storage of raw session content and the use of an external LLM for summarization, but it does not present a clear, prominent privacy warning or require informed user consent before either action. This creates a real risk that sensitive prompts, notes, credentials, or personal data are retained indefinitely and potentially disclosed to third-party model providers.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Describing the database as a permanent vault for all extracted knowledge promotes indefinite accumulation of user-derived information and normalizes over-retention. Even without an exploit chain in the markdown itself, this design encourages broad preservation and later resurfacing of sensitive context beyond the original purpose of collection.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 81% confidence
Finding: Self-initializing persistent storage is not inherently unsafe, but in this skill it materially supports silent, durable session persistence without explicit setup or user review. In the context of a memory system that stores raw content and facts across sessions, automatic database creation lowers friction for broad retention and increases the chance of unnoticed data accumulation.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
## Self-Bootstrapping Design DeepRecall features zero-config deployment: - Tables are created automatically on first use (`CREATE TABLE IF NOT EXISTS`) - No "no such table" errors - database self-initializes - Indexes are created for optimal query performance - Works out-of-the-box with no manual setup

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest auto-registers several tools, including data retrieval and cleanup operations, without any explicit trigger boundaries, consent requirements, or examples of when they must not be invoked. In an agent setting, ambiguous tool scope can lead to unintended access to stored memory or accidental destructive actions such as cleanup being invoked without a clearly scoped user request.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring presents this file as a memory retrieval engine focused on searching and retrieving content. In practice, constructing MemoryRetriever bootstraps the database schema, creates directories, creates triggers/indexes, and other functions mark files as processed and delete raw files, which are active write/delete side effects rather than retrieval-only behavior.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: L1 retrieval returns content in full with no truncation or output-size controls, and L2 retrieval also returns complete raw content. In an agent environment, this can leak excessive sensitive memory contents into model context, logs, or downstream tools and can also cause denial-of-service-like token bloat when large records are retrieved.
Content: Scanner excerpt · scripts/memory_retriever.py (reported line 323)May include surrounding context.
python
clean_type = fact_type # Compact format: [date | type | source:file] content # Note: no truncation is applied; content is returned in full line = f"[{date} | {clean_type} | source:{source_file}] {content}" formatted.append(line)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The cleanup function claims to operate only on workspace memory files, but it accepts an arbitrary memory_dir and then deletes matching .md files in that directory. In an agent/tool context, any caller able to influence memory_dir can turn a maintenance helper into a generic file-deletion primitive against accessible paths, causing unintended data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The function deletes files automatically once retention or size thresholds are met, with no interactive confirmation or user-visible warning at execution time. In an autonomous agent setting, silent destructive behavior increases the chance of accidental or policy-bypassing data loss, especially if invoked with unexpected parameters or against the wrong directory.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The tool stores full raw memory files in the archive database by default, creating long-term retention of potentially sensitive information beyond what may be necessary for fact extraction. Persistent storage increases blast radius if the SQLite database is accessed by other local users, included in backups, or later exfiltrated.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · CONFIG_GUIDE.md (reported line 150)May include surrounding context.
md
print("Warning: No LLM API configuration found, using rule-based extraction") return await self._extract_facts_with_rules(content) base_url = api_config.get("baseUrl", "https://api.deepseek.com/v1") # Remove trailing slash to avoid double slashes in URL concatenation if base_url.endswith('/'): base_url = base_url.rstrip('/')

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/memory_summarizer.py (reported line 254)May include surrounding context.
python
print("Warning: No LLM API configuration found, using rule-based extraction") return await self._extract_facts_with_rules(content) base_url = api_config.get("baseUrl", "https://api.deepseek.com/v1") # Remove trailing slash to avoid double slashes in URL concatenation if base_url.endswith('/'): base_url = base_url.rstrip('/')

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code sends raw memory content to a configured external LLM endpoint during normal processing, but there is no explicit user consent or warning at the point of transmission. Because the prompt explicitly targets personal, project, and technical facts, users may unknowingly export sensitive material to third-party providers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The statement "All content in English for international compatibility" imposes a language policy rather than offering a user choice. This is a natural-language policy violation because it forces a specific language without opt-in or documented necessity.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Allowing an empty query to return the latest facts creates a permissive default that may disclose memory contents even when the user did not ask for retrieval with sufficient specificity. Because this skill is a persistent memory system, broad default recall increases the chance of unintended exposure of prior session data or sensitive stored facts.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified with a minimum version only, which allows installation of any later release and makes builds non-reproducible. This increases supply-chain risk because different environments may resolve to different versions, including ones with breaking changes or known vulnerabilities.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
# DeepRecall Dependencies # Required for LLM summarization functionality aiohttp>=3.8.0 # SQLite3 is included in Python standard library # No additional dependencies needed for core memory retrieval functions

Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Because aiohttp is not pinned, it is impossible to verify from this manifest whether the installed version is one affected by known advisories. In a skill that performs LLM summarization over networked components, using a vulnerable HTTP client library could expose the system to issues such as request handling flaws, injection, cookie handling weaknesses, or denial of service depending on the resolved version.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The function unlinks .md.processed marker files automatically when their corresponding source files are absent. This is another file-deletion path with no confirmation or explicit user-facing notification at execution time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code labels the prompt template as an English version and uses fixed English instructions for analysis. This imposes a specific language choice in natural-language behavior without any user opt-in or documented justification for the locale constraint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The --test-config help text says it will "Test OpenClaw configuration and API connectivity," which implies an active network connectivity check. However, when invoked, the code only calls test_configuration(), and that function reads config files and reports provider/model selection details without making any API request.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.