Security audit

Mem Plus

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned, but it can read, store, inject, and delete local memory/workspace data with weak user-facing scoping and safeguards.

Review before installing. Use this only with memory stores and workspace folders you are comfortable having searched, summarized, stored, and injected into agent prompts. Avoid broad workspace mining unless you have excluded secrets and private files, and inspect the ChromaDB stores periodically because sync and forget operations can permanently change stored memories.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The code claims to store content directly, but it first transmits the full content to a local HTTP embedding service. That mismatch is security-relevant because users may provide sensitive memory content under the assumption it remains only in the local database, while it is actually exposed to another service boundary.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The bridge sync helper is described as synchronization, but it also deletes existing destination records matching prior bridge IDs before reimport. Undisclosed deletion is dangerous because operators may run the command expecting additive sync behavior and unintentionally lose previously synced data.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script prepends a hard-coded user-controlled site-packages directory to sys.path, changing Python import precedence for the entire process. Even though this file currently does not import custom third-party modules after that line, this behavior creates an unnecessary code-loading foothold: if additional imports are added later or if the environment contains tampered packages in that path, the script may import untrusted code unexpectedly.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises automatic context recall triggered on every preprocessed message, but the documentation does not describe clear user notice, consent, scope limits, or what data may be searched and injected into the agent context. In a personal-memory system tied to identity, preferences, projects, and local stores, silent automatic recall can expose sensitive personal information to downstream model prompts without the user realizing it.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented `mine --path ~/.openclaw/workspace` command encourages scanning a local workspace to extract new memories, but the skill text does not provide an explicit warning that local files may be read, summarized, and persisted into memory stores. This creates a realistic risk of unintended collection of secrets, proprietary material, or personal data from the filesystem.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The CLI exposes deletion of stored memories by ID with no confirmation prompt, dry-run mode, or safety interlock. In an agent skill context, this increases the chance of accidental or induced destructive actions that remove data irreversibly.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The mine and bridge workflow can ingest a large workspace and then modify the shared collection, including deleting old bridge records, without prominent disclosure to the user. In a memory-management skill, that combination can unexpectedly expose and overwrite large amounts of data from the local workspace.

Static analysis

No suspicious patterns detected.