Supermemory

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 0.2.1

Overview

The skill is purpose-built for long-term agent memory, but it stores and serves sensitive cross-session data with automatic ingestion and external LLM use that are not tightly scoped or access-controlled in the artifact.

Review this carefully before installing. Use a pinned, trusted package version, inspect the plugin source, keep the API bound to localhost or protected by authentication, and avoid auto-ingesting sensitive conversations unless you have clear redaction, retention, and deletion controls. Treat the memory database as private data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned and Unaudited Third-Party Package and Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-18, SKILL.md:78-80
Vulnerability Type: Unpinned third-party dependencies and mutable external plugin source
Risk Level: Medium

Vulnerable Code

SKILL.md:16-18:

bash

pip install openclaw-supermemory[local]
supermemory init        # creates ~/.supermemory/memory.db
supermemory serve       # starts API on :8642

SKILL.md:78-80:

markdown

### OpenClaw plugin (zero-config)

Install the [supermemory-claw plugin](https://github.com/jared-goering/openclaw-supermemory/tree/main/plugin) for automatic memory injection and extraction with no agent code changes.

Technical Analysis

The setup instructions install openclaw-supermemory[local] without an exact version, integrity hash, or locked transitive dependency set. Consequently, the code installed by this command can change independently of the reviewed Skill document. Python package installation can also execute dependency-controlled build logic, and the subsequently invoked supermemory commands execute the externally supplied implementation.

The recommended OpenClaw plugin is referenced through a mutable GitHub branch path rather than an immutable commit and verified checksum. Its source code is not included in the audited artifact. The audit therefore cannot establish that either the package implementation, its transitive dependencies, or the plugin performs only the documented operations.

This is a supply-chain weakness rather than evidence that the currently published dependencies are malicious. The project contains only SKILL.md; no executable implementation, lockfile, package hashes, or vendored plugin source was available for verification.

Attack Path

1. An attacker compromises the package publisher account, plugin repository, release process, or a transitive dependency.
2. The attacker publishes a modified package release or changes code available through the mutable plugin reference.
3. A user follows t ...[truncated 1334 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openclaw-supermemory to an explicitly reviewed version rather than allowing the newest available release:

   bash

   pip install "openclaw-supermemory[local]==0.2.1"
   

2. Generate and publish a lockfile containing exact versions for all transitive dependencies.

3. Require package hashes during installation, such as through a hash-locked requirements file and pip install --require-hashes.

4. Replace the mutable GitHub plugin link with an immutable reviewed commit or signed release tag. Publish the expected archive checksum and verify it before installation.

5. Audit and document the package's build configuration, installation hooks, runtime entry points, and transitive dependencies.

6. Vendor the reviewed plugin source into the Skill package when practical so that the executable implementation is included in the audit boundary.

7. Verify release provenance through signed tags, trusted publishing, and reproducible build artifacts.

8. Run the service under a dedicated, unprivileged account with access restricted to its database and required configuration. Do not expose unrelated credentials to the process.

9. Bind the API to localhost by default, require authentication if it is made reachable by other hosts or users, and protect the memory database with restrictive filesystem permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The setup instructions encourage starting an API service and exposing ingestion/search functionality, but the documentation does not warn about authentication, network binding, or the sensitivity of stored memory contents. In a memory system that aggregates cross-session and cross-agent knowledge, an exposed or misconfigured service could leak sensitive data or allow unauthorized ingestion and retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly recommends automatically ingesting agent response text into long-term memory, while earlier stating that fact extraction uses an external LLM API by default. This creates a real privacy and data-governance risk because sensitive conversation content may be transmitted to third-party providers and persistently stored without an explicit warning, consent flow, redaction guidance, or scoping controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.