Openclaw Memory Ollama

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.0.2

Overview

This is a mostly coherent local memory setup guide, but it asks users to create persistent AI memory and includes an overbroad global model configuration without enough privacy and scoping guidance.

Review this carefully before installing. Use non-sensitive test data first, decide what conversations may be stored permanently, document how to delete or export memory records, and merge only the memorySearch settings unless you intentionally want to change your global model provider.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/config-reference.md:49

Finding

Unnecessary Global Agent Model Configuration Exceeds the Skill's Functional Scope

Content

View full analysis

Vulnerability Details

File Location: references/config-reference.md, lines 49–60
Vulnerability Type: Unnecessarily broad modification of global Agent configuration
Risk Level: Medium

Vulnerable Configuration

json

{
  "agents": {
    "defaults": {
      "model": {
        "primary": "minimax/MiniMax-M2.7"
      },
      "memorySearch": {
        "provider": "ollama",
        "model": "nomic-embed-text:latest"
      },
      "thinkingDefault": "high"
    }
  }
}

Technical Analysis

The Skill declares local memory management using Ollama for embeddings. Only the memorySearch configuration is necessary for that functionality. However, the supplied configuration also changes the global primary language model to minimax/MiniMax-M2.7 and sets the default reasoning level to high.

These settings affect general Agent behavior rather than the memory subsystem and therefore exceed the minimum configuration privileges required by the Skill. If a user replaces or broadly merges their existing openclaw.json with this example, all subsequent Agent requests may use the unrelated primary model configuration.

The actual network and data-handling behavior of the named model provider is not defined in this repository. Consequently, external transmission cannot be conclusively established from the audited files alone. Nevertheless, changing the global model may undermine the documented local-only expectation and can cause unintended processing, availability, privacy, or cost consequences depending on the user's installed provider configuration.

The separately flagged embedding request in references/deployment.md targets the fixed loopback endpoint http://localhost:11434/api/embeddings. Sending input text to that local Ollama endpoint is necessary to generate embeddings, and no external exfiltration endpoint, credential collection, or obfuscated payload was identified.

Attack Path

1. A user follows the configuration instructions ...[truncated 1331 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unrelated agents.defaults.model.primary and thinkingDefault fields from the memory configuration example.
2. Document only the minimum required configuration:

json

{
  "agents": {
    "defaults": {
      "memorySearch": {
        "provider": "ollama",
        "model": "nomic-embed-text:latest"
      }
    }
  }
}

3. Explicitly instruct users to merge only the memorySearch object into their existing configuration rather than replacing the complete agents.defaults object.
4. State that users should retain their existing primary model and reasoning settings unless they intentionally choose to change them.
5. Add a warning that selecting a nonlocal primary model may transmit conversation content according to that provider's configuration and privacy policy.
6. Recommend backing up ~/.openclaw/openclaw.json before modification and validating the effective configuration after the change.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that L3/L4 memories are stored permanently in PostgreSQL but does not warn users that conversations or derived memory artifacts may be retained indefinitely. In a memory-management skill, this omission can lead operators to deploy persistent storage without understanding privacy, retention, or compliance consequences, especially if personal or sensitive user data is stored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The architecture explicitly describes persisting user meeting content and later injecting retrieved memories into the AI context, but it does not mention consent, retention disclosure, privacy boundaries, or handling of sensitive data. In a memory-management skill, this omission can lead to silent long-term storage and resurfacing of private user information, increasing privacy, compliance, and prompt-context leakage risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-reference.md (reported line 85)May include surrounding context.

可选: 覆盖默认 OpenAI 配置

export OPENAI_API_KEY=your-key

export OPENAI_BASE_URL=https://api.openai.com/v1

text

## 数据库表结构

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide tells users to test memory writing and retrieval using real conversational content, but it does not disclose that those inputs may be persisted in the memory system and sent to the local Ollama embedding service for processing. In a memory-management skill, this omission can lead users to store sensitive personal or business information without informed consent or data-handling safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 158)May include surrounding context.

md

1. 检查 Ollama 是否运行: `ollama serve`
2. 检查模型是否已拉取: `ollama list`
3. 检查 API 端口: `curl localhost:11434/api/tags`

### 记忆检索失败

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill documentation presents core usage and deployment instructions only in Chinese, with no indication that users may choose another language or that the locale is intentionally limited. This can violate language/locale policy when a skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This file presents all operational guidance in Chinese only, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is natural-language documentation, and its content forces a specific language for all users. Under the policy rule, language-specific content should either offer user choice or clearly justify the locale constraint; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file consistently uses Chinese for all instructions and demonstrates activation and verification with Chinese phrases only. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.