Security audit

MemOS Cloud Integration

Security checks for vulnerabilities and agentic risk

Overview

This cloud-memory recall skill is review-worthy because it can send conversation-derived queries to an external service and tells the agent to run those queries through an unsafe shell command.

Review before installing. Use this only if you trust MemOS Cloud with conversation-derived search terms and memories. Avoid sensitive conversations until the shell command is replaced with safe argument passing, recall and storage require clearer user control, API keys are stored non-destructively with restrictive permissions, and recalled memory is treated only as untrusted context.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:18
Finding: Shell Command Injection Through User-Controlled Search Query
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:25
Finding: Untrusted Remote Memory Can Influence Agent Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:20
Finding: Installation Command Destructively Overwrites a Shared Plaintext Credential File
Content: View full analysis
~/.claude/.env << 'EOF' MEMOS_API_KEY=your_api_key_here MEMOS_USER_ID=openclaw-user MEMOS_BASE_URL=https://memos.memtensor.cn/api/openmem/v1 EOF ``` The troubleshooting section at `README.md:92` also instructs users to place `MEMOS_API_KEY` in `~/.claude/.env`. ### Technical Analysis An API key is legitimately required for the declared cloud-memory functionality, so requesting the credential does not itself exceed the Skill's functional needs. However, the documented command uses the destructive `>` redirection operator against the shared `~/.claude/.env` file. Following the instructions truncates any existing file before writing the MemOS values. This may erase unrelated Claude configuration and credentials. The instructions also store the API key in plaintext without creating the file under a restrictive `umask` or applying explicit permissions such as mode `0600`. On systems using a common `umask` of `022`, a newly created file may be readable by other local users. The actual exposure depends on directory permissions and the user's environment. ### Attack Path 1. A user already has settings or secrets in `~/.claude/.env`, or follows the instructions on a multi-user system. 2. The user runs the documented installation command. 3. Shell redirection truncates the existing file and replaces its contents. 4. Unrelated configuration or credentials are lost. 5. If the resulting mode or parent-directory permissions are permissive, another local account may read the plaintext MemOS API key. 6. A disclosed key may then be used against the remote service within the permissions assigned to that key. ### Impact Assessment The command may cause: - Loss of unrelated configuration stored in the shared environment file. - Plaintext exposu ...[truncated 477 chars]
Remediation: View remediation
` redirection on an existing shared configuration file. - Detect existing files and preserve their contents, or provide non-destructive instructions for adding only missing variables. - Prefer an operating-system credential manager or secret store where supported. - Clearly warn users that the value is sensitive and must not be committed to source control, included in logs, or shared. - Recommend narrowly scoped, revocable API keys and document rotation procedures. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
bash
# 创建配置文件 cat > ~/.claude/.env << 'EOF' MEMOS_API_KEY=your_api_key_here MEMOS_USER_ID=openclaw-user MEMOS_BASE_URL=https://memos.memtensor.cn/api/openmem/v1

Credential Access

High

Category: Privilege Escalation
Confidence: 76% confidence
Finding: The README tells users to store an API key in ~/.claude/.env but does not mention secret-handling precautions such as file permissions, avoiding accidental commits, or limiting exposure to other local processes. In an agent/plugin environment, poorly documented credential storage can increase the chance of key leakage and unauthorized access to the memory service.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
bash
# 创建配置文件 cat > ~/.claude/.env << 'EOF' MEMOS_API_KEY=your_api_key_here MEMOS_USER_ID=openclaw-user MEMOS_BASE_URL=https://memos.memtensor.cn/api/openmem/v1

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to query MemOS Cloud with the user’s input or extracted search keywords before responding, but it does not disclose this behavior or obtain user consent. This creates a significant privacy risk because potentially sensitive prompts may be transmitted to an external service unexpectedly, especially given the broad triggers and the instruction to fail silently on API errors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README promotes cross-session memory through a cloud service but does not provide an explicit warning about privacy, data transmission, retention, or sensitivity of stored content. In this skill context, the plugin handles prior conversations and preferences, so silent or under-disclosed cloud storage materially increases the risk of exposing sensitive personal information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest for this skill says its purpose is to recall memories before responding, focused on retrieving prior conversations, preferences, or decisions. However, the documentation in this skill file presents broader functionality including storing memories and managing them via commands, which exceeds the recall-only scope claimed for memos-recall.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The automatic recall trigger is described ambiguously as activating when a conversation involves previous content. In a recall skill, unclear activation boundaries can lead to unnecessary transmission of prompts or retrieval of unrelated memories, increasing privacy and data-minimization risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented behavior says Claude will automatically call an add operation to save important information. For a skill whose manifest purpose is only to recall prior memories, advertising write behavior is a semantic mismatch because it expands from read/retrieval into persistence.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The phrase describing storage activation (e.g. when the user says 'remember' or when information is 'important') is too broad and subjective. In a memory plugin that sends data to a cloud service, vague triggers can cause the agent to store ordinary or sensitive user content without clear, informed intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to fire on common words like "before," "last time," or any request needing context, which can cause the skill to send user input or derived keywords to MemOS Cloud without clear necessity. In this skill’s context, over-invocation increases the chance of unnecessary disclosure of sensitive conversational content and may retrieve unrelated prior memories that influence the response incorrectly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language instructions, headings, and examples are presented in Chinese, which can impose a specific language on operators or users without opt-in. The file does not state that this is a region-specific skill or offer an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Most operational instructions and trigger descriptions are presented only in Chinese, which can impose a language constraint on users without opt-in. The file does not state that the skill is region-specific or offer an alternate language path.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.