ClawHub

Pgmemory

Security checks across malware telemetry and agentic risk

Overview

This skill appears to provide real persistent memory functionality, but its setup can make broad, lasting host and agent-environment changes that users should review before installing.

Install only if you are comfortable with a persistent memory system that may run a local database, modify AGENTS.md, and send memory text to the configured embedding provider. Avoid storing secrets or regulated data, prefer Ollama/local embeddings for sensitive projects, protect pgmemory.json if it contains an API key, review any AGENTS.md changes, and do not run setup.py --yes unless you accept possible Docker installation and host configuration changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (19)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.run(["sudo","systemctl","enable","--now","docker"], capture_output=True)
        user = os.environ.get("USER","")
        if user:
            subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)
            warn(f"Added {user} to docker group — re-login for this to take effect")
        ok("Docker installed"); return True
    elif system == "darwin":
Confidence
85% confidence
Finding
subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
system = platform.system().lower()
    if system == "linux":
        if not yes and input("  Install Docker via get.docker.com? [y/n] ").lower() != "y": return False
        if subprocess.run("curl -fsSL https://get.docker.com | sh", shell=True).returncode != 0:
            err("Docker install failed"); return False
        subprocess.run(["sudo","systemctl","enable","--now","docker"], capture_output=True)
        user = os.environ.get("USER","")
Confidence
99% confidence
Finding
if subprocess.run("curl -fsSL https://get.docker.com | sh", shell=True).returncode != 0:

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            existing_cron = subprocess.run(["crontab","-l"], capture_output=True, text=True).stdout
            if "pgmemory" not in existing_cron:
                proc = subprocess.run(["crontab","-"], input=existing_cron.rstrip()+"\n"+decay_cmd+"\n",
                                      text=True, capture_output=True)
                if proc.returncode == 0: ok("Cron job added")
                else: warn(f"Could not add cron: {proc.stderr}")
Confidence
93% confidence
Finding
proc = subprocess.run(["crontab","-"], input=existing_cron.rstrip()+"\n"+decay_cmd+"\n", text=True, capture_output=True)

Tainted flow: 'user' from os.environ.get (line 480, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
subprocess.run(["sudo","systemctl","enable","--now","docker"], capture_output=True)
        user = os.environ.get("USER","")
        if user:
            subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)
            warn(f"Added {user} to docker group — re-login for this to take effect")
        ok("Docker installed"); return True
    elif system == "darwin":
Confidence
87% confidence
Finding
subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)

Tainted flow: 'agents_md' from os.environ.get (line 899, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
injected = inject_startup_into_agents_md(agents_md, agent_id, config)
            if injected:
                ok(f"{agent_id}: startup steps injected into 'Every Session' list")
            with open(agents_md, "a") as f: f.write(section)
        else:
            agents_md.parent.mkdir(parents=True, exist_ok=True)
            agents_md.write_text(section)
Confidence
84% confidence
Finding
with open(agents_md, "a") as f: f.write(section)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises significant capabilities (environment access, file read/write, network, and shell) but does not declare permissions or prominently disclose them. This creates a trust and consent problem: users may run setup and maintenance commands that modify the host, contact external services, and access sensitive local state without an explicit permission boundary.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose suggests a memory skill, but the described setup also installs or manages Docker/PostgreSQL, edits AGENTS.md across workspaces, syncs configuration into multiple agent environments, adds cron jobs, and runs migrations. That gap is security-relevant because users may authorize a seemingly narrow skill while it performs broad system administration and persistence actions affecting multiple projects and future execution contexts.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The changelog explicitly describes persisting the embedding API key in `pgmemory.json` and preferring that stored secret over environment variables. Persisting API credentials in a general config file materially increases secret exposure through repo commits, backups, workspace sharing, logs, and downstream agent/tool access, which is outside the core memory-storage purpose and creates a real credential-handling risk.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The script is presented as a query/search and inspection tool, but it also exposes --restore and --harvest operations that modify persistent memory state. In an agent-tooling context, misleading affordances are dangerous because higher-level agents or users may invoke a seemingly read-only tool and unintentionally alter durable state, enabling integrity issues and unsafe privilege expansion.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The setup script can install Docker, enable services, and modify Docker group membership on the host. For a PostgreSQL-backed memory skill, these are excessive capabilities that materially expand attack surface and system impact; combined with the remote install script they enable arbitrary host changes far beyond necessary setup.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script persists a recurring cron job to run itself daily. Background persistence is not necessary for the core purpose of semantic memory setup and increases risk because it silently creates ongoing execution behavior on the user's machine.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The sync feature enumerates OpenClaw agent workspaces and rewrites `AGENTS.md` across them, extending the tool's influence into multiple local projects. This broad file-modification capability is disproportionate to the stated memory backend function and becomes more dangerous because it can be steered by local config/environment state.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The changelog says AGENTS.md integration is 'startup-mandatory' and that agents should run memory queries before every task, reducing user control over agent behavior. In an agent skill context, forcibly inserting persistent behavior into startup flows can expand data access and execution scope without explicit per-workspace consent, making misuse or overcollection more likely.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README documents third-party embedding providers but does not warn that memory contents may be sent to those external services for embedding generation. In this skill’s context, users are explicitly encouraged to store infrastructure details, constraints, and other persistent operational knowledge, so omission of a privacy warning can lead to accidental disclosure of sensitive data to external vendors.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill encourages storing decisions, constraints, infrastructure facts, and discoveries persistently, and its config shows use of an external embedding provider. Without a clear warning, users may place secrets, internal architecture details, customer data, or other sensitive project context into PostgreSQL and potentially transmit that content to third-party embedding services.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The wizard may store the embedding provider API key directly in the JSON config file, but does not present a clear explicit warning at the point of save about storing a secret on disk. This can lead to accidental credential exposure through backups, loose file permissions, or repository inclusion.

Missing User Warnings

High
Confidence
99% confidence
Finding
In `--yes` mode the script can auto-approve downloading and executing Docker's remote install script, then perform privileged service changes, without a strong just-in-time warning. Non-interactive acceptance of such invasive actions is especially unsafe because users may not realize a memory setup tool will alter the host this extensively.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The wizard appends or creates `AGENTS.md` content automatically, and in `--yes` mode this can occur without an interactive warning at the moment files are changed. Silent modification of workspace instructions is risky because it changes agent behavior and local project files in a way users may not anticipate from setup.

Unpinned Dependencies

Low
Category
Supply Chain
Content
psycopg2-binary>=2.9
Confidence
93% confidence
Finding
psycopg2-binary>=2.9

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal