Mindkeeper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:36 AM UTC
• Version: 1.2.4

Overview

Mindkeeper is a coherent version-history skill, but it asks to install an unpinned external plugin that will run in Gateway and watch sensitive agent context files.

Review this before installing. The skill itself is mostly guidance, but it bootstraps a persistent Gateway plugin that can watch and version sensitive agent context files. Prefer a pinned, reviewed plugin version or verify the plugin source/package before approving installation and Gateway restart.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned External Plugin Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-27; also documented in README.md:34-37 and SCREENSHOT_GUIDELINE.md:19-23
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Complete Code Snippets

SKILL.md:19-27:

markdown

2. **After user confirms** — Run this flow:
   - **Install the plugin** — Run via bash:
     ```bash
     openclaw plugins install mindkeeper-openclaw
     ```
   - **Restart Gateway if the runtime supports it** — Use the available runtime mechanism to restart Gateway. If restart is unavailable or fails, tell the user: "Plugin installed. Restart your Gateway manually to apply."
   - **Confirm** — If restart succeeded, tell the user: "Mindkeeper is ready. Restart complete — you can now ask about history, diffs, rollbacks, or snapshots." If restart did not happen, tell the user that the plugin is installed but Gateway must be restarted before the tools will appear.

README.md:34-37:

markdown

```bash
openclaw plugins install mindkeeper-openclaw
# Then restart your Gateway

text

`SCREENSHOT_GUIDELINE.md:19-23`:

```markdown
### 1.1 Install mindkeeper plugin

```bash
openclaw plugins install mindkeeper-openclaw

text

### Technical Analysis

The Skill instructs the agent or user to install `mindkeeper-openclaw` without specifying an exact version, package integrity hash, signature, or immutable source revision. Consequently, the code installed at execution time is not necessarily the same code that existed when this Skill was audited.

The installed component is not merely documentation: it is loaded into the OpenClaw Gateway after a restart and provides the `mind_*` tools and a background file watcher. According to the Skill, it operates on potentially sensitive agent context, including `AGENTS.md`, `SOUL.md`, `USER.md`, `IDENTITY.md`, `TOOLS.md`, `HEARTBEAT.md`, `MEMORY.md`, `memory/**/*.md`, and `skills/**/*.
...[truncated 2186 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to an explicitly reviewed version rather than resolving the latest release:

   bash

   openclaw plugins install mindkeeper-openclaw@<audited-version>
   

2. Verify a cryptographic integrity hash or trusted package signature before installation.
3. Document the expected package registry and reject resolution from alternate or user-controlled registries.
4. Link the pinned package release to an immutable source commit and reproducible build artifacts.
5. Audit the plugin and its complete transitive dependency tree before recommending installation.
6. Apply least privilege to the Gateway process and restrict plugin filesystem and network access to resources required for version-control operations.
7. Display the exact version, source, and integrity information in the confirmation prompt so the user can provide informed consent.
8. Maintain an allowlist of reviewed plugin versions and require a separate review before upgrades.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SCREENSHOT_GUIDELINE.md (reported line 38)May include surrounding context.

• SOUL.md
• AGENTS.md (optional but helpful)

If these files don't exist, create minimal placeholder content:

bash

# Example: create SOUL.md

Static analysis

No suspicious patterns detected.