Memory Palace

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 1.8.5

Overview

This memory skill mostly does what it says, but it needs review because it persistently stores personal data and can send raw memories to configured LLM providers without clear consent or privacy controls.

Install only if you want an agent to keep long-lived local memories about you and your projects. Review or disable the LLM-enhanced features unless you are comfortable with stored memory content being sent to your configured model provider. Do not store secrets or regulated personal data, audit the memory files periodically, and require a fix for memory ID path validation before using this in a setting where tool arguments may be influenced by untrusted input.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares installation and operation of a Node-based CLI and documents optional Python-based semantic search/model downloads, which implies environment access and likely network access, yet no explicit permissions or user-facing disclosure are declared. This creates a transparency and policy gap: users and platforms cannot clearly evaluate what runtime capabilities the skill may exercise, especially during install-time package fetches and model downloads.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The CLI derives a workspace path from environment variables and also accepts an arbitrary --db-path, allowing the caller to redirect reads and writes to unexpected filesystem locations. In a memory-management skill, filesystem-backed persistence is expected, but unrestricted path selection expands the trust boundary and can expose or overwrite unrelated local data if the surrounding agent passes attacker-influenced arguments or environment values.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The service will automatically fall back to a remote HuggingFace model name and even sets a mirror endpoint when no local model is present. In a memory-management skill, unexpected network retrieval expands the trust boundary, introduces supply-chain and data-egress risk, and enables behavior not clearly necessary for local persistence/search.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This code implements a general-purpose remote LLM client that can transmit arbitrary task content to external providers, which exceeds a narrowly described memory persistence/search function. In a memory skill, task content is likely to contain sensitive user memories, preferences, or project state, so sending it to third-party endpoints creates a real data-exposure and scope-expansion risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill reads environment variables and local OpenClaw configuration files to discover provider endpoints and API keys from the host environment. For a memory-management skill, this broad host integration is risky because it expands access to sensitive local configuration and enables silent use of credentials the user did not expect this skill to consume.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This is a true path traversal issue. Memory IDs are interpolated directly into filesystem paths via `path.join(this.storagePath, `${id}.md`)` and the same pattern is used for trash paths, so an attacker-controlled ID containing `../` or absolute-path tricks can escape the intended storage directory and cause read, write, restore, or delete operations on unintended files. In a persistence/memory skill, IDs may be influenced by upstream inputs or imported records, which makes this especially risky because the component performs privileged filesystem operations repeatedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly promotes persistent storage of user memories and even gives examples involving user preferences, project state, and reusable experiences, but it does not warn that this data is written to disk in plain Markdown under the workspace. For a memory skill, the stored content is likely to include sensitive personal data, behavioral preferences, and operational context, so omission of privacy and local data-handling warnings can lead to unsafe deployment and accidental retention of confidential information.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README advertises AI-powered summarization, experience extraction, LLM-based parsing, and optional model download/setup steps, but it does not clearly disclose whether memory content may be sent to external services or that enabling vector features triggers network activity and dependency downloads. Because this skill operates on persistent user memories, any undisclosed outbound transmission or remote model access materially increases privacy and supply-chain risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to persist personal information, preferences, habits, project state, and prior conversation content, and it also exposes delete/update/list/search operations, but provides no visible privacy notice, retention guidance, consent flow, or warning about storing sensitive data. This is dangerous because it normalizes long-lived storage of user data without informed consent or minimization, increasing privacy, compliance, and accidental over-collection risks.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The delete action invokes manager.delete directly with user-supplied arguments and no confirmation, dry-run, or safety interlock. In an agent setting, a malformed tool call, prompt injection, or operator mistake could permanently remove stored memories, causing integrity and availability loss of user data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples encourage persistent storage of user preferences, personal information, project state, and reusable experiences without any notice about retention, consent, minimization, or sensitive-data handling. In a memory-management skill, this omission is more dangerous because the feature is explicitly designed to retain data across sessions, increasing privacy and compliance risk if operators or users assume all content is safe to store indefinitely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This test script embeds realistic personal and work-related memory content, including schedule details, contact information, internal hostnames, project metadata, and then prints query results and a full JSON summary to stdout. In a memory-management skill, that is more sensitive than in a generic test because the component is explicitly designed to persist and retrieve user memories, so test fixtures and logs can normalize unsafe handling and leak sensitive data into CI logs, developer consoles, or shared environments.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code can download model assets over the network without any user-visible warning, consent, or operational disclosure. While this is primarily a transparency and policy issue, it also matters for security because operators may unknowingly allow outbound network access and third-party dependency retrieval at runtime.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The prune path directly rewrites stored memory content in place, permanently removing words and phrases without any confirmation, preview, rollback, or audit safeguard. In a persistent memory-management skill, this is security-relevant because user data and prior decisions can be silently altered, causing integrity loss, inaccurate future retrieval, and potential corruption of user preferences or project history.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends the raw search query directly to an external/subagent LLM client for concept expansion. In a memory-management skill, queries are especially likely to contain sensitive personal data, preferences, project state, or other persistent context, so forwarding them without visible minimization, consent, or policy gating creates a real privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The compressor sends raw memory contents, summaries, tags, and dates to an external LLM for processing, and this file provides no consent gate, redaction step, or disclosure mechanism before that transfer. In a memory-management skill, those memories are likely to contain personal preferences, project history, or other sensitive data, so silent transmission to a model backend creates a meaningful privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The OpenAI-compatible request sends the full task content to an external API without any visible disclosure, consent, or redaction step. Because this skill is designed to handle persistent memory and personal information, undisclosed outbound transmission can leak highly sensitive user data to third parties.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The Anthropic API path also transmits task content externally without any user-facing warning or privacy control. In the context of a memory skill, the content may include personal histories, preferences, and prior conversation data, making silent exfiltration particularly dangerous.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends raw memory content to `this.client.callJSONWithFallback(...)` for LLM processing with no visible consent gate, redaction step, or policy check. In a memory-management skill, the content is especially likely to include sensitive personal data, project details, preferences, or secrets, so external transmission creates a real privacy and data-handling risk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The description instructs the agent to proactively remember and retrieve user preferences, personal information, project status, reusable experiences, and prior conversation content, but shows no consent gate or minimization safeguards. In context, this is more dangerous because the skill’s stated purpose is persistent memory, so the privacy risk is not incidental—it is the core workflow, making unauthorized profiling or retention of sensitive data more likely.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The usage guidance directly tells the agent to use the skill when users reveal personal information, preferences, habits, or when prior conversation content should be recalled, again without visible restrictions on sensitive data or consent collection. Because these instructions operationalize routine capture of personal details, they materially increase the chance of persistent storage beyond user expectations and of later retrieval in inappropriate contexts.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: This code concatenates raw memory contents, including arbitrary user-provided text and tags, directly into an LLM prompt and sends it to a subagent client. In a memory-management skill, those memories are likely to contain personal data, secrets, project details, or prior conversation content, so this creates a direct data-exposure path to the model/provider and also enables prompt-injection influence from stored memories.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: User-supplied memory content is interpolated directly into the prompt body, so the full plaintext memory is exposed to the LLM during summarization. Because this skill is explicitly for persistent memory management, the embedded content may contain highly sensitive long-lived personal or organizational information, increasing the severity of confidentiality loss if the model endpoint is external, logged, retained, or inspected.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-vector-deps.cjs:30

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/background/vector-search.ts:132

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/background/vector-search.ts:127

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/llm/subagent-client.ts:92

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/llm/subagent-client.ts:388