ClawMem Pro

• Outcome: Review
• Latest audit: May 28, 2026 · 10:04 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent local memory system, but it asks agents to create durable personal/work memory and optional background jobs with too little scoping and consent.

Install only if you intentionally want a local persistent memory system. Before enabling cron or scheduled tasks, review the files it will create, avoid storing secrets, tokens, personal data, or exact secret locations, and treat MEMORY.md and daily notes as sensitive workspace data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The top-level description is broad enough to trigger on many generic setup, help, or memory-related requests, which can cause the agent to invoke a skill that creates persistent files and recommends automation when the user did not clearly ask for that behavior. In a skill that changes workspace state and may configure cron jobs, overbroad activation increases the chance of unintended persistence and privacy-impacting actions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The when-to-trigger conditions are ambiguous and include common phrases like setting up a workspace or asking how to make an agent remember, which may match normal advisory conversations rather than a request to modify the environment. Because the skill instructs the agent to run installers, seed memory, and optionally configure scheduled tasks, ambiguous activation can lead to unauthorized file creation, persistence, and collection of sensitive operator context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installation section directs the agent to run scripts, create multiple persistent files, seed them with operator-specific information, and configure recurring cron jobs, but it does not present an upfront warning or require explicit consent before these state-changing actions. This is dangerous because it can establish long-lived data retention and automated processing of sensitive context without the user fully understanding the privacy, persistence, and operational consequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The routine explicitly instructs the agent to write notable inbox entries to daily notes and update MEMORY.md, but it provides no requirement to notify the user, request consent, or distinguish transient content from durable memory. In a persistent-memory skill, silent promotion of session content into long-term storage can retain sensitive or inaccurate information across runs, creating privacy, integrity, and surprise-retention risks.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script deletes any existing scheduled tasks matching the OpenClaw prefix and does so with `-Confirm:$false`, providing no user confirmation or backup path. Because the script must be run as Administrator, this can silently remove prior tasks and cause denial of service or unexpected task replacement if the prefix matches tasks the user wanted to keep.

Vague Triggers

Medium

• Confidence: 72% confidence
• Finding: The catch-all item 'Any other periodic monitoring' is overly open-ended and can expand the agent's recurring behavior beyond clearly defined tasks. In a persistent-memory skill, this is more dangerous because it normalizes autonomous background checks and could be interpreted to monitor additional sources without clear scope, consent, or data-handling boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template explicitly suggests storing 'infrastructure details' and 'API keys location' in long-term memory, which normalizes placing sensitive operational information into a broadly reused context file. Even if it does not ask for raw secrets directly, centralizing secret locations and infrastructure context in persistent memory increases the chance of accidental disclosure, prompt leakage, or exposure in shared/less-secure contexts.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly promotes persistent retention of agent session context across runs, which can cause sensitive prompts, secrets, personal data, or operational details to be written into local files without meaningful minimization. Because the design goal is to preserve context broadly, users may inadvertently create a durable transcript that can later be exposed to other sessions, sub-agents, backups, or local attackers.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Telling the agent to 'remember everything' and begin each session with 'full context' encourages indiscriminate replay of prior information, including data that should not persist or be reintroduced into future sessions. In a memory skill, this context increases risk because the whole purpose is cross-session persistence and reuse, amplifying accidental disclosure and over-retention.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The workflow directs the agent to write everything to daily notes and have sub-agents or cron jobs exchange and consume that context through shared files, creating a broad natural-language data propagation channel. This is dangerous because sensitive content can spread across components and sessions without access controls, sanitization, or purpose limitation, increasing the chance of leakage, prompt cross-contamination, and unauthorized reuse.

Ssd 3

Medium

• Confidence: 83% confidence
• Finding: The script is explicitly designed to persist and republish content from daily notes into a consolidated MEMORY.md file, which increases retention and visibility of potentially sensitive user information. In a memory-management skill this is contextually expected, but without minimization, consent, or sensitivity filtering it can cause unintended long-term storage of secrets, personal data, or confidential project details.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The significance-keyword logic copies entries based on broad semantic cues like 'approved', 'failed', 'error', and 'created' without checking whether the matched content contains secrets or sensitive operational details. This can sweep up incident notes, internal decisions, or credential-bearing troubleshooting text into durable memory, expanding exposure beyond the original daily note context.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: This code republishes the body of extracted user notes into MEMORY.md verbatim, creating a second persistent copy that may be broader in scope and easier to consume by later tools or agents. If sensitive content is captured once, this duplication increases the chance of unintended disclosure, propagation, and long-term retention.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.