Security audit

Jasper Recall

Security checks for vulnerabilities and agentic risk

Overview

Jasper Recall is a real memory-search skill, but it needs review because it can persist and inject private memories, send memory text to a remote embedding API, and contains command-injection risks.

Install only if you are comfortable with a memory tool that indexes local notes and session logs, persists them in ChromaDB, and sends text plus search queries to SkillBoss API Hub for embeddings. Review openclaw.json after setup, keep autoRecall disabled or set publicOnly true for untrusted/sandboxed workflows, do not run the HTTP server on a public interface, and do not index secrets or sensitive sessions until the shell-injection issues are fixed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file presents itself as a local memory/RAG CLI, but it also performs extra behaviors with security relevance: a background update check and modification of OpenClaw plugin/config files during setup. This mismatch reduces informed consent and can cause operators or downstream agents to run code that changes local configuration or performs network activity they did not expect.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The help text says setup only installs dependencies and CLI scripts, but setup() also copies a SKILL.md into the OpenClaw skills directory and edits ~/.openclaw/openclaw.json. Misleading setup documentation can trick users or automated systems into granting broader filesystem changes than intended.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The plugin expands from passive recall into active re-indexing via both a chat command and a gateway method, increasing its ability to alter or refresh the memory corpus. That broadens attack surface and can enable unauthorized or unexpected data processing if the surrounding platform does not strictly gate command and RPC access.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The module header advertises recall/search features but omits that the plugin also exposes write-capable indexing through `/index` and `recall.index`. That mismatch can mislead operators and reviewers about the skill's effective capabilities, reducing informed consent and making unauthorized or unexpected modification of the memory index more likely in deployment.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Labeling the legacy collection as 'backwards compatibility' is misleading because the code actively populates it with all indexed files. This creates a shadow datastore that undermines the documented security model and increases the chance that callers continue depending on the insecure, overbroad collection.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Labeling the legacy collection as 'backwards compatibility' is misleading because the code actively populates it with all indexed files. This creates a shadow datastore that undermines the documented security model and increases the chance that callers continue depending on the insecure, overbroad collection.

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The comments claim sandboxed agents are limited to shared content, but the enforcement is only via the optional --public-only flag. Any caller that can invoke this script without that flag can search private_memories, creating a privilege-boundary failure and possible disclosure of sensitive agent memory.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The `recall` function builds a shell command string and executes it with `execSync`, incorporating the untrusted `query` and option values directly into the command. Wrapping arguments in double quotes is not sufficient to prevent shell metacharacter expansion such as command substitution, so an attacker controlling `query` or `options.limit` could achieve command injection and arbitrary code execution.

Intent-Code Divergence

Low

Confidence: 92% confidence
Finding: The `digestSessions` function concatenates option values into a shell command and runs it with `execSync`. If `options.recent` or other fields are attacker-controlled, shell metacharacters can alter command execution and lead to arbitrary command execution under the current user's privileges.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: A background update check is triggered on startup without user-facing disclosure in this file, which means the CLI initiates network activity even for local-only usage expectations. While likely intended for version awareness, undisclosed outbound requests can leak metadata and violate restricted or sandboxed environments.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The endpoint returns the full raw recall output in addition to parsed results, which can expose more data than intended, including unparsed private or sensitive content if the backend returns it. Combined with permissive CORS and the option to bind to non-local interfaces, this increases the chance of unintended data disclosure to browser-based or remote clients.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation promotes cross-agent memory sharing and mesh queries across multiple private collections, but it does not warn that using `--mesh` can expose one agent's private memory to another if the caller includes that agent in the query. In a multi-agent system, this is a real privacy and data-separation risk because operators may assume per-agent isolation while the feature explicitly enables aggregation of otherwise separate memories.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The classification rules automatically place content into `shared_memories` when a path contains `shared/` or content includes a `[public]` tag, but the docs do not warn that this makes data accessible to all agents. Automatic visibility changes based on filename/path conventions are error-prone and can cause unintended disclosure of sensitive information through misplacement or casual tagging.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The spec proposes automatic bidirectional sharing of agent memory, including learnings and product context, but does not require explicit user notice, consent, or approval at the point of synchronization. Even with [public]/[private] tags and pattern-based filtering, misclassification, incomplete regex coverage, or author error can cause sensitive information to be propagated into shared storage or exposed to sandboxed agents.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents that it automatically searches memory and prepends retrieved content before every message is processed, which can expose sensitive prior notes, internal procedures, or private user data to later prompts without explicit per-use consent or clear warning. This is especially risky because retrieval is triggered broadly on normal conversation flow and the default example configuration sets `publicOnly` to `false`, increasing the chance of cross-context privacy leakage.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Auto-recall sends the entire prompt to an external local subprocess and then injects retrieved memory content back into agent context without user disclosure or granular filtering. This can expose sensitive prompt contents to the recall backend and cause private or unrelated memories to be surfaced into later model processing, creating confidentiality and context-integrity risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The plugin explicitly supports automatically injecting recalled memories into agent context, but the configuration text and UI hints do not warn users about privacy leakage, prompt-context contamination, or the possibility of surfacing sensitive prior data without explicit confirmation. In a memory/RAG skill, this is contextually more dangerous because the feature is core behavior and can expose private or irrelevant memories to downstream prompts, tools, or model outputs.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents an auto-recall feature that searches stored memory before every message and prepends matching content into the agent context. Even though the behavior is described, the default flow can expose prior stored data to processing of unrelated or untrusted prompts, and the documentation does not present a clear privacy warning, consent model, or strong default safeguards around this injection behavior.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: When autoRecall is enabled, arbitrary user prompts are automatically searched against memory and matching memory content is silently prepended to the agent context. This creates a data-exposure channel where users can trigger retrieval of sensitive prior content, and the injected memories may influence model behavior without disclosure or user awareness.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The plugin explicitly supports automatically injecting retrieved memories into agent context, but the manifest does not define meaningful trigger constraints, exclusions, or consent boundaries for when that behavior occurs. In a memory/RAG plugin, broad auto-recall can expose unrelated or sensitive stored content to downstream agent processing, especially if agents operate across tasks or user contexts.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The manifest describes semantic search over indexed memory with auto-recall and includes a configuration where autoRecall injects relevant memories before agent processing, but it does not present a clear privacy warning or explicit opt-in UX around that behavior. Because recalled memories may contain prior conversation data or sensitive information, silent context injection can create confidentiality and data-minimization risks even if the feature defaults to false.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script persists derived conversation content to disk automatically under the user's workspace without any explicit consent, warning, retention notice, or access control checks. Because session logs may contain sensitive prompts, secrets, or personal data, this creates an avoidable privacy and data-retention risk if the workspace is shared, backed up, synced, or later accessed by other tools/users.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This indexer reads memory, session digests, founder logs, SOPs, and repo notes, then sends chunked plaintext to an external embedding API. In this context, those sources are likely to contain sensitive internal or personal data, so undisclosed third-party transmission materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: User-supplied query text is sent to an external API to generate embeddings, but the tool gives no warning or consent mechanism before transmitting potentially sensitive search terms off-host. In a memory-recall tool, queries may contain secrets, internal project names, or private prompts, which makes silent third-party transmission materially risky.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The script extracts user message text from session JSONL files and copies it into human-readable markdown summaries, increasing the chance that sensitive content is retained, exposed, indexed, or casually viewed. Converting raw session content into concise plain-language digests can amplify leakage because the data becomes easier to browse and may persist beyond the original operational need.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli/doctor.js:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli/jasper-recall.js:43

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli/server.js:33

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: extensions/jasper-recall/index.ts:58

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: extensions/openclaw-plugin/index.ts:58

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/index.js:28

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL.md:425