Security audit

Jasper Recall

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned overall, but it has under-disclosed privacy and execution risks that should be reviewed before installing.

Install only if you are comfortable with local memories, session summaries, and recall queries being processed by SkillBoss API Hub. Review ~/.openclaw/openclaw.json after setup, disable autoRecall unless you explicitly want automatic memory injection, set publicOnly true for sandboxed or untrusted agents, keep the HTTP server bound to localhost, and avoid using this version with untrusted prompts until the shell-command construction in the OpenClaw plugin is fixed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation makes materially inconsistent security and privacy claims: it says the system runs entirely locally/offline and implies no API dependency, while elsewhere it states embeddings are obtained through SkillBoss API Hub and require an API key. This can mislead operators into sending sensitive memory data to an external service under a false assumption of local-only processing, creating unanticipated data-exposure risk.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The setup/architecture text tells users no API is needed, but the current documented implementation requires `SKILLBOSS_API_KEY` and external embeddings. In a memory system that indexes conversations and notes, this discrepancy is security-relevant because users may ingest confidential material believing it never leaves the host.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The file is presented as a 'doctor' health-check utility, but when invoked with --fix it performs state-changing operations: creating directories and a virtual environment, installing Python packages, and launching indexing. That mismatch between descriptive header and actual behavior can mislead users or calling agents into treating it as a read-only diagnostic command, increasing the chance of unintended code execution, network/package installation, or modification of local data.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The CLI advertises itself as a local memory/RAG tool, yet it performs a background update check on startup via `checkInBackground()` without clear user disclosure or consent in this file. Silent network activity expands the trust boundary, can leak usage metadata, and is especially problematic for users expecting an offline/local-only tool.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The help text says setup only installs dependencies and CLI scripts, but `setup()` also copies a skill into `~/.openclaw/workspace/skills` and edits `~/.openclaw/openclaw.json`. That mismatch can mislead users into granting broader filesystem and agent-environment modifications than they intended.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The top-level usage comment describes setup as creating scripts but omits that it may also install integration files and modify OpenClaw configuration in the user's home directory. While this is primarily a transparency issue, hidden side effects in installer/setup paths are security-relevant because they reduce informed consent and auditability.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation claims agents have private memory with selective sharing, but the documented `--mesh` examples allow querying other agents' `agent_<name>` collections directly. This creates a confidentiality boundary mismatch: operators may store sensitive content assuming per-agent privacy, while the feature as documented permits broad cross-agent access and unintended data exposure.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The spec establishes a privacy boundary where private memories are main-agent only, but later preserves a recall mode whose default behavior searches all memories. That inconsistency can easily lead to sandboxed agents or future implementers querying private content unless access control is enforced server-side rather than by convention, causing unintended disclosure of secrets, personal data, or internal operations.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The plugin is presented as a recall/search capability, but it also exposes `/index` and `recall.index`, which trigger a state-changing re-index operation. This broadens the skill’s authority beyond read-only memory lookup and can let authenticated users or callers mutate the memory/search corpus indirectly, increasing the blast radius if the command is misused or the gateway is exposed.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation says sandboxed agents can access only shared memories, but the --public-only path also searches agent_learnings. If agent_learnings may contain non-public or more sensitive derived content, this mismatch can cause inadvertent data exposure because operators may rely on the documented boundary.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: A background update check is initiated at module load time, meaning simply invoking the CLI can trigger network activity before the user chooses a command. Undisclosed outbound requests can violate offline assumptions, leak environment metadata, and create surprising behavior in security-sensitive or sandboxed contexts.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The API response includes both parsed results and the full raw recall output, which can expose memory contents verbatim over HTTP to any caller that can reach the service. In this skill context, the service is intended for agent access and may be run with permissive CORS or broader host binding, making accidental data disclosure more dangerous.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The code automatically contacts the npm registry in the background to check for updates, which discloses package usage and the user's IP/addressing metadata without an explicit opt-in or clear notice. While this is common in CLI tooling and uses HTTPS to a legitimate registry, it still creates a privacy-relevant network side effect that users may not expect from a local command.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document encourages cross-agent sharing and mesh queries without clearly warning that information placed in shared or mesh-accessible collections may be exposed to other agents. In a multi-agent system, missing privacy guidance increases the likelihood that users will misclassify secrets and unintentionally disclose sensitive prompts, memory, or operational data.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The spec proposes logging Moltbook engagement data into shared memory accessible to multiple agents, but does not require notice, consent, minimization, or retention controls. Even if the data is not highly sensitive by design, aggregating interaction history in shared memory can expose user behavior, preferences, or third-party data more broadly than expected and increase privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documents automatic retrieval and injection of memory contents before every message, which can expose prior notes, private memories, or sensitive context to agent runs without an explicit per-use warning or consent step. This is especially risky because the feature operates implicitly at a lifecycle hook and the default example shows `publicOnly: false`, increasing the chance of oversharing into conversations triggered by untrusted or mixed-sensitivity inputs.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: When auto-recall is enabled, the full prompt is sent to the external `recall` subprocess and matching memory content is silently injected back into context. This can expose sensitive user inputs to the memory system without clear consent and may cause unintended disclosure of prior stored memories into conversations where they were not expected.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The plugin explicitly supports automatically injecting recalled memory into agent context, but the manifest text provides no user-facing warning that private or sensitive prior content may be surfaced unexpectedly. In a memory/RAG skill, this can cause privacy leakage, prompt contamination, or unintended disclosure across tasks, especially if users enable auto-recall without understanding its scope.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly states that when auto-recall is enabled it searches memory before every message and injects matching memories into the agent context. That creates a real privacy boundary risk: sensitive prior notes, private memories, or unrelated confidential context may be surfaced to the model or downstream processing without explicit user awareness or per-request consent, especially since the documented example configuration sets `publicOnly` to false.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Auto-recall sends raw conversation prompts to an external local subprocess (`recall`) before agent processing, without user disclosure, consent, or minimization. Even if the binary is local, this expands the trust boundary and can leak sensitive prompt contents into another component's logs, telemetry, caches, or downstream storage.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The plugin explicitly supports automatically injecting relevant memories into agent context, but the UI/help text does not warn users that prior stored data may be surfaced implicitly and influence later responses. In a memory/RAG plugin, this can expose sensitive prior context, create unintended cross-session data disclosure, and alter model behavior without clear user awareness or consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script writes digests derived from session logs into persistent markdown files without any explicit notice, consent flow, or minimization of copied content. Because session logs can contain sensitive prompts, secrets, or personal data, this creates a privacy and data-retention risk by duplicating conversation content into a second storage location that may be less expected or less protected.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script reads session data from user-controlled directories and persists extracted topics/tools into digest files, but gives no privacy notice and performs no sensitivity filtering. Even though it only stores a summary, that summary is still derived from potentially confidential conversations and can expose user activity, interests, or operational details if accessed later.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script sends chunks of local markdown content from memory, shared, logs, and related directories to an external embedding API. Because these sources may contain sensitive internal notes, session digests, or private memories, exporting them off-host without prominent disclosure, consent controls, or filtering can cause confidentiality breaches.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: User queries are sent to a third-party embedding API without any user-facing disclosure or consent mechanism. Queries to a memory-recall tool may contain sensitive prompts, secrets, internal project names, or personal data, so silent transmission expands the privacy and data-governance risk surface.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli/doctor.js:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli/jasper-recall.js:43

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli/server.js:33

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: extensions/jasper-recall/index.ts:58

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: extensions/openclaw-plugin/index.ts:58

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/index.js:28

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL.md:425