Cogmem Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 2.5.1

Overview

This skill has a coherent memory-backend purpose, but it asks users to install mutable remote code and enable automatic long-term capture of conversation and memory data without enough containment guidance.

Review before installing. Prefer a pinned, reviewed commit instead of the main branch; run the installer in a low-privilege workspace; decide which profile, memory, and conversation files should be imported; avoid importing secrets or regulated data; and confirm how to disable the hooks, background queue, service, and retained memory files before enabling automatic memory for future turns.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Mutable GitHub Dependency Is Installed and Executed Without Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-29
Vulnerability Type: Supply-chain risk from an unpinned remote dependency
Risk Level: Medium

bash

bun add "github:liuqin164/Cogmem#main"
./node_modules/.bin/cogmem-init --agent openclaw --scope project
./node_modules/.bin/cogmem-doctor

Technical Analysis

The default installation procedure retrieves Cogmem directly from the mutable main branch of a remote GitHub repository. A branch name is not an immutable version identifier: its target commit can change after this Skill has been reviewed.

The instructions then immediately execute cogmem-init and cogmem-doctor, binaries supplied by the downloaded dependency. Package installation may also invoke package lifecycle behavior, depending on the package and package-manager configuration. Consequently, the effective code executed by these instructions is not fully represented by the reviewed project and can change without any modification to SKILL.md.

Although the document separately shows that a specific commit can be selected, secure pinning is optional rather than the default. No checksum, lockfile, signature, trusted release, or reviewed commit is required by the documented installation path.

Attack Path

1. An attacker compromises the referenced upstream repository, a maintainer account, or another mechanism capable of updating the main branch.
2. The attacker adds malicious code to package installation behavior or to one of the documented executables.
3. A user follows the default command and Bun resolves github:liuqin164/Cogmem#main to the attacker-controlled revision.
4. The dependency is installed and its supplied cogmem-init and cogmem-doctor binaries are executed.
5. The malicious code runs with the invoking user's permissions and can act on resources available to that account.

Impact Assessment

Successful exploitation would provide code execution under the account performing the installati ...[truncated 499 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable branch reference with an immutable, reviewed commit hash or a trusted versioned release:

   bash

   bun add "github:liuqin164/Cogmem#<reviewed-full-commit-hash>"
   

2. Commit and enforce the package-manager lockfile so dependency resolution remains reproducible.
3. Verify the release or commit provenance using signed tags, repository attestations, or another trusted verification mechanism.
4. Where available, verify downloaded artifacts against a trusted checksum or integrity metadata.
5. Review package lifecycle scripts and the source of cogmem-init and cogmem-doctor before executing them.
6. Perform installation and initial validation in an isolated environment with minimal permissions and no unnecessary secrets.
7. Make immutable pinning the documented default rather than presenting it only as an optional alternative.
8. Establish a controlled dependency-update process that reviews and tests each new pinned revision before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs bulk import of USER.md, persona files, memory files, and session/conversation logs into the durable memory backend, which can centralize large amounts of sensitive historical content. This is dangerous because it broadens the accessible memory corpus beyond immediate task needs and may ingest confidential, stale, or policy-restricted data without any screening, consent, or exclusion workflow.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The runtime wiring stores full user and assistant turns durably via rememberTurn, which can capture sensitive prompts, credentials, personal data, or regulated content without any built-in minimization guidance in the skill. Durable retention of conversational transcripts increases confidentiality and compliance risk, especially if the backing database, queue, or logs are later accessed by other tools, plugins, or users on the same host.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

## OpenClaw Host Integration Notes

`cogmem-connect openclaw` installs this file into `<workspace>/skills/cogmem-memory/SKILL.md`, which is OpenClaw's workspace skill location. That makes the procedure discoverable without changing OpenClaw host config.

Current OpenClaw memory config is OpenClaw-owned. Its documented backend selector is `memory.backend` with values such as `"builtin"` and `"qmd"`, and the built-in memory surface exposes tools such as `memory_search` and `memory_get`. Do not write `plugins.slots.memory` or other unknown OpenClaw config fields for cogmem; OpenClaw uses strict config validation and unknown fields can prevent the Gateway from starting.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs enabling hooks.allowPromptInjection=true and hooks.allowConversationAccess=true for an automatic memory wrapper, but does not require any user-facing notice, consent, or data-minimization controls. That creates a real privacy and prompt-surface risk because full conversation content can be intercepted and reused by the plugin, increasing exposure of sensitive user data and expanding the blast radius of any plugin compromise or misconfiguration.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The wrapper is configured for conversation access and queued durable logging of turn data into JSONL jobs and background drain processes, creating multiple persistence points for sensitive content. Even if intended for performance and resilience, this increases the number of artifacts containing user data and raises the risk of unintended disclosure through local files, retries, dead-letter queues, or debugging activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.