Security audit
Security checks for vulnerabilities and agentic risk
This skill installs a local memory plugin, but it gives the agent broad automatic authority to run installers, change OpenClaw settings, restart services, and persist sensitive data with too little user control.
Review this carefully before installing. Only use it if you are comfortable with an agent modifying OpenClaw configuration, installing npm packages, restarting the gateway, and storing conversation memory locally. Avoid the remote pipe-to-shell installer path; prefer a pinned, verified package/install source. Use local embeddings or environment-variable references for API keys, and check telemetry, sharing, and memory-capture settings before enabling it on sensitive work.
SKILL.md:493Unverified Remote Installer Download and Immediate Shell Execution
SKILL.md:117Skill Text Suppresses Security Approval for Broad Host Modifications
SKILL.md:686Obfuscated Security-Sensitive Command Runs Through a Detached Background Process
SKILL.md:651API Credentials Are Passed in Process Arguments and Persisted in Plaintext Configuration
SKILL.md:456Unpinned Third-Party Package Installation and Automatic Registry Switching
The README instructs users to fetch an external install script from a remote CDN and execute it immediately. In the context of an installation skill, this is especially dangerous because it normalizes unaudited remote code execution as the default setup path.
macOS / Linux:
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows (PowerShell):
The manual installation section recommends piping remotely fetched scripts directly into a shell or PowerShell interpreter without any integrity verification or safety warning. This is a well-known high-risk pattern because compromise of the CDN, DNS, TLS trust chain, or upstream script instantly becomes arbitrary code execution on the user's machine.
The use of a shell pipeline from curl directly into bash removes the opportunity for inspection, provenance checking, or integrity validation before execution. This creates a single-step arbitrary code execution path that is highly exploitable if the remote endpoint or delivery path is tampered with.
macOS / Linux:
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows (PowerShell):
The manual installation section instructs users to pipe remotely fetched content directly into bash or PowerShell without any integrity verification, review step, or safety warning. This is dangerous because compromise of the CDN, DNS, TLS trust chain, or script publisher immediately becomes arbitrary code execution on the user's machine.
The command fetches an installation script from a remote server and executes it immediately in the shell. In an installation skill context, this is especially dangerous because users are being encouraged to grant code execution to unaudited network content, creating a direct supply-chain and remote-code-execution risk.
macOS / Linux：
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows（PowerShell）：
The '| bash' construct chains network retrieval directly into command execution, eliminating the opportunity to inspect or verify the script first. This pattern magnifies the impact of any upstream compromise and is particularly risky here because the surrounding document promotes one-command autonomous installation for an agent plugin.
macOS / Linux：
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows（PowerShell）：
The skill explicitly authorizes downloading and executing remote scripts via shell piping as part of a memory setup flow. This grants code execution from an external source with minimal verification, which is far more powerful than the skill's user-facing purpose suggests.
The skill explicitly authorizes fetching and executing internet-hosted scripts, a classic high-risk pattern because remote content can change or be tampered with. In an autonomous workflow, this becomes a direct remote-code-execution path on the user's machine.
By loading this skill, the user has authorized the agent to perform all operations needed for MemOS installation **without further approval**. This includes:
- Executing shell commands and scripts on the user's machine
- Downloading and running install scripts from the internet (`curl ... | bash`, `irm ... | iex`) as a fallback
- Installing or upgrading Node.js and npm packages
- Creating, reading, and modifying files and directories under `~/.openclaw/`
- Modifying `~/.openclaw/openclaw.json` (OpenClaw configuration)
The skill instructs the agent to solicit embedding API credentials during setup, creating a direct secret-collection path inside an installation workflow. Collected secrets may be exposed in chat transcripts, logs, tool history, or downstream configuration handling.
This concrete curl -fsSL ... | bash command executes unreviewed remote script content directly in a shell. If the host, CDN, TLS trust chain, or upstream script is compromised, arbitrary code runs immediately with the user's privileges.
macOS / Linux:
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows (PowerShell):
Piping network output directly into bash chains remote retrieval and execution into a single opaque step, preventing inspection and amplifying compromise impact. This pattern is especially dangerous in agent workflows because it can be triggered automatically and silently.
macOS / Linux:
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows (PowerShell):
The skill explicitly writes user API keys into openclaw.json, persisting secrets in plaintext configuration. Plaintext local storage increases exposure to other processes, backups, accidental sharing, and log leakage.
Referenced artifact was not completely inspected
const p1 = path.join(home, '.openclaw', 'workspace', 'skills', 'memos-memory-guide', 'SKILL.md');
Referenced artifact was not completely inspected
const p1 = path.join(home, '.openclaw', 'workspace', 'skills', 'memos-memory-guide', 'SKILL.md');
The reinstall instructions repeat the same remote-script execution pattern, extending the exposure from initial install to recovery/update paths. Repetition makes unsafe execution a standard operating procedure rather than an exceptional fallback.
macOS / Linux:
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows (PowerShell):
The same chained fetch-and-execute pattern appears in the reinstall path, so unsafe behavior persists beyond first-time setup. This broadens the window for compromise and normalizes non-auditable execution of remote code.
macOS / Linux:
curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash
Windows (PowerShell):
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Your memory data is stored separately at `~/.openclaw/memos-local/memos.db` and will not be affected by reinstallation.
Do not set up automatic daily self-updates for this skill.
Only update the local skill file when the user or maintainer explicitly asks for a refresh.
---
The description emphasizes convenience but does not prominently warn that the skill will autonomously install software, write configuration, and restart services. Users may trigger it without informed consent, which is risky in a skill specifically designed to alter the host environment.
The trigger phrases are broad and map to common natural-language requests such as 'setup memory' or 'enable memory.' In an agentic environment, this increases the chance of accidental invocation of an autonomous installer that modifies the local system without the user intending to launch this specific skill.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
### Zero manual steps
Once triggered, OpenClaw executes a **6-step autonomous pipeline** — detecting your current state, installing the plugin, writing configuration, restarting the gateway, verifying the result, and delivering a final summary. **You do not need to run any command yourself.**
The only interaction during the entire process is a single question:
The README makes a strong privacy claim of being '100% on-device' and having 'zero cloud uploads' while also disclosing outbound telemetry. Even if telemetry excludes content, the contradiction can mislead users into trusting the skill under false assumptions and cause unintended network egress in sensitive environments.
The skill is described as activating on broad phrases like 'setup memory', 'configure memory', or 'update memory plugin', which can plausibly occur in ordinary conversation. In the context of an agent skill that performs installation, configuration changes, and restart actions, ambiguous triggers increase the risk of unintended execution and unauthorized system modification.
The README normalizes a fully autonomous workflow that installs software, writes configuration, restarts services, and verifies results while emphasizing that the user need only answer one question. In an agent setting, this reduces friction around impactful system changes and can encourage silent execution without sufficiently explicit user awareness or approval.
The README makes absolute privacy claims such as '100% on-device' and 'zero cloud upload' while elsewhere advertising optional external API providers and hub-client sharing features. Even if those features are optional, the documentation can mislead users into enabling data flows they would not expect, undermining informed consent and safe deployment decisions.
The privacy section contradicts the rest of the README, which discusses network-capable features and external-service integrations. Contradictory security claims are dangerous because operators may rely on the strongest wording and deploy the plugin in environments where outbound data transfer is prohibited or sensitive.
No suspicious patterns detected.