ClawHub
Back to skill

Security audit

Memos Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local MemOS memory API reference, but users should treat memory deletion and broad memory reads as sensitive operations.

Install only if you intend to let the agent store, read, search, list, and delete MemOS memories. Keep MEMOS_API_URL pointed at a trusted local or controlled service, avoid storing secrets unless you accept that service's data handling, and require explicit confirmation before deleting memory files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Memory Manipulation

High
Category
Memory Poisoning
Content
---
name: memos
description: Use MemOS API for memory operations. Use when: (1) user asks to save/store/remember something to memory, (2) user asks to read/retrieve memory, (3) user wants to list/delete memory files, (4) replacing OpenClaw's default memory with MemOS.
---

# MemOS - External Memory Service
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
Body: {"query": "...", "top_k": 3}
```

### Delete Memory
```bash
DELETE /delete/{agent}/{filename}
```
Confidence
88% confidence
Finding
Providing a direct delete-memory endpoint in an agent skill enables modification of persistent state and can be abused to erase evidence, sabotage agent behavior, or destroy user data if invoked without proper checks. The skill presents the capability plainly and without any mention of authorization boundaries, confirmation, or auditability, which makes misuse materially more dangerous.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Delete Memory
```bash
DELETE /delete/{agent}/{filename}
```

### List Agents
Confidence
91% confidence
Finding
The path-parameterized delete endpoint accepts agent and filename components directly, creating a tool-abuse risk if those parameters are derived from untrusted prompts or insufficiently validated input. Without strict normalization, authorization, and scoping, an attacker could cause deletion of arbitrary memories belonging to other agents or target unexpected files via crafted path values.

Memory Manipulation

High
Category
Memory Poisoning
Content
print(f"{item['source']}: {item['score']}")
```

**Delete memory:**
```python
import requests
requests.delete('{{MEMOS_API_URL}}/delete/alin/2026-02-23.md')
Confidence
90% confidence
Finding
The code example demonstrates how to invoke deletion directly against a concrete memory path, lowering the barrier for accidental or prompt-induced destructive actions. In an agent environment, examples often become operational behavior, so showing an unguarded deletion call increases the chance that memory state is removed without adequate validation or user approval.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill exposes a destructive delete capability for persistent memory files without any requirement to confirm user intent, warn about permanence, or limit scope. In an agent setting, this can lead to accidental or unauthorized deletion of stored memories, especially if natural-language prompts are misinterpreted or the agent is induced to call the endpoint on the wrong target.

External Transmission

Medium
Category
Data Exfiltration
Content
**Add memory:**
```python
import requests
requests.post('{{MEMOS_API_URL}}/add', json={
    'content': '咖啡大佬今天教我使用MemOS',
    'source': 'alin/2026-02-23.md'
})
Confidence
84% confidence
Finding
This example sends memory content to an external service endpoint, which creates an exfiltration path for potentially sensitive user data if the API URL is remote, untrusted, or misconfigured. Because the skill is explicitly for persistent memory storage, the transmission is expected, but it still carries privacy and data-handling risk without trust, authentication, or minimization controls.

External Transmission

Medium
Category
Data Exfiltration
Content
**Search memory:**
```python
import requests
r = requests.post('{{MEMOS_API_URL}}/search', json={
    'query': '咖啡大佬教了什么',
    'top_k': 3
})
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.