ClawHub
Back to skill

Security audit

Auto Memory

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for permanent agent memory, but it can publish memory or files to public irreversible storage with broad triggers and persistent local credential handling.

Install only if you intentionally want agent memory or selected files written to permanent public storage. Do not use it for secrets, credentials, private conversation history, personal data, regulated data, or broad workspace snapshots, and verify exactly what will be uploaded before every save.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The skill is presented as agent memory, but its documented behavior includes broader capabilities: arbitrary file upload/download, credential setup/storage, browser-assisted auth flow, and modification of local state files such as `~/.openclaw/.env` and `MEMORY.md`. That gap can cause users or agents to invoke it under a narrower trust model than warranted, increasing the chance of unintended exfiltration of local data to permanent public storage or unwanted local state changes.

Intent-Code Divergence

Low
Confidence
87% confidence
Finding
The comment says the default state-file path is trusted, but the actual default path is derived from OPENCLAW_WORKSPACE, an environment variable that may be attacker-controlled in some execution contexts. Because validation is skipped for the default path, an attacker who can influence the environment can redirect state writes and MEMORY.md updates to unintended locations, potentially causing unauthorized file modification within the user’s permissions.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger guidance includes broad activation conditions such as storing data permanently or retrieving by CID, which could cause the skill to run in situations where the user did not intend irreversible public publication. Because this skill writes to permanent public storage, accidental activation has stronger consequences than a typical utility skill.

Vague Triggers

Medium
Confidence
87% confidence
Finding
Everyday-language triggers like 'save memory', 'remember this permanently', 'checkpoint', 'resurrect', or 'load history' are vague and overlap with normal conversational requests. In this context, vague triggers are dangerous because they can lead to irreversible publication of context, identity, decisions, or other sensitive workspace content to a public decentralized network.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document promotes permanent storage as a core feature without clearly warning that uploaded data is effectively irreversible and publicly retrievable, creating a meaningful risk of privacy breaches and long-term exposure of secrets or personal data. In the context of an agent memory skill, this is more dangerous because users may store conversation history, identity data, tokens, or internal reasoning that cannot be deleted once published.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The file instructs users to create an API key but does not include security guidance on protecting that credential, increasing the chance that developers place it in code, logs, prompts, or permanent memory. Because this skill is centered on durable agent memory and permanent storage, accidental key exposure could become long-lived and difficult to contain.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation explicitly encourages storing arbitrary agent memory, including full file snapshots and 'anything worth keeping permanently,' on immutable decentralized storage without prominent warnings about privacy, secret handling, or the inability to delete data later. In the context of an agent memory skill, this creates a realistic risk that operators or downstream agents will persist API keys, personal data, internal files, or sensitive decision history permanently, causing irreversible data exposure.

Credential Access

High
Category
Privilege Escalation
Content
AD_BASE_URL="https://mainnet.auto-drive.autonomys.xyz/api"
AD_DOWNLOAD_URL="https://public.auto-drive.autonomys.xyz/api"
AM_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}"
AM_ENV_FILE="$AM_OPENCLAW_DIR/.env"
AM_CONFIG_FILE="$AM_OPENCLAW_DIR/openclaw.json"

GREEN='\033[0;32m'
Confidence
87% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
fi
  echo -e "${GREEN}✓ Saved to $AM_CONFIG_FILE${NC}"

  # --- .env ------------------------------------------------------------------
  # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates,
  # then append exactly one entry.
  if [[ -f "$AM_ENV_FILE" ]]; then
Confidence
91% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
sed '/^AUTO_DRIVE_API_KEY=/d' "$AM_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AM_ENV_FILE"
  fi
  # Single-quote the value so characters like #, $, and backticks are
  # preserved literally when the .env file is later sourced by bash.
  local safe_key="${key//\'/\'\\\'\'}"
  echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AM_ENV_FILE"
  chmod 600 "$AM_ENV_FILE"
Confidence
95% confidence
Finding
.env

Session Persistence

Medium
Category
Rogue Agent
Content
license: Apache-2.0
description: Indestructible agent memory — permanently stored, never lost. Save decisions, identity, and context as a memory chain on the Autonomys Network. Rebuild your full history from a single CID, even after total state loss.
compatibility: Requires curl, jq, and the file utility, plus outbound HTTPS to the Autonomys Auto Drive API (ai3.storage) and public gateway. Stored data is permanent and public — do not store secrets. Works with OpenClaw and Hermes agents on macOS and Linux.
allowed-tools: Bash(curl:*) Bash(jq:*) Bash(file:*) Read Write
metadata:
  openclaw:
    emoji: "🧬"
Confidence
90% confidence
Finding
Write metadata: openclaw: emoji: "🧬" primaryEnv: AUTO_DRIVE_API_KEY requires: bins: ["curl", "jq", "file"] env: ["AUTO_DRIVE_API_KEY"] install: - id: curl-brew

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.