OpenClaw Memory (Docs)

• Outcome: Pass
• Latest audit: May 28, 2026 at 8:14 AM UTC
• Version:
  0.2.1

Overview

This is a local documentation-memory plugin with disclosed save, search, delete, import, and export behavior; exports need careful handling because they can contain sensitive notes.

Install only where command/tool callers are trusted to read the stored documentation memories. Do not rely on pattern-based redaction for highly sensitive secrets, and export only to trusted directories that will not be unintentionally committed, synced, or backed up.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The export feature writes stored memory text into markdown files, which can increase exposure if users later commit, sync, share, or back up that directory without realizing it contains potentially sensitive notes. Although the plugin mentions optional secret redaction, redaction is pattern-based and cannot guarantee removal of all confidential content, so exported files may still leak sensitive project information.

VirusTotal

No VirusTotal findings