Openclaw Memory Toolkit

• Outcome: Review
• Latest audit: Aug 22, 2026 · 6:02 PM UTC
• Version: 2.1.1

Overview

The skill is mostly a disclosed local memory-management tool, but its search indexing can recursively ingest arbitrary directories despite claiming tighter memory-only scope.

Install only if you are comfortable with a local memory tool that can move and rewrite memory files and build a persistent search database. Keep Ollama bound to localhost, avoid using hybrid_search.py index --dir on broad or sensitive directories, and do not use --force or --yes in automation unless the workspace and backups are tightly controlled.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The docstring and usage text say dry-run is the default, but the implementation writes consolidation_report.json unless --dry-run is explicitly set. In a security-sensitive memory workflow, misleading users about write behavior can cause unintended persistence of potentially sensitive analysis data, especially when users expect read-only execution.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The initial workspace-boundary validation occurs before CLI processing, but a later --workspace override recomputes MEMORY_DIR, MEMORY_FILE, and related paths without repeating that validation. This allows the tool to read from and write to arbitrary filesystem locations chosen at runtime, undermining the stated workspace confinement and increasing the risk of unintended file modification or sensitive file exposure through analysis and report generation.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module-level comments and constants state that scanning is restricted to the memory directory, but `cmd_index` accepts `--dir` and then recursively indexes any supplied path with `glob(..., recursive=True)`. In this skill context, that means an operator or upstream agent can cause arbitrary workspace files to be embedded and sent to the Ollama embedding endpoint, defeating the documented privacy boundary and enabling unintended data exposure.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The security comment says skill enumeration was removed, but the unrestricted `--dir` path in batch indexing still allows recursive traversal of `skills/` and indexing of arbitrary skill files. In this context, skill files may contain prompts, secrets, operational instructions, or other sensitive agent data that would then be stored and embedded, undermining the intended isolation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

if not force:
        print("\n⚠️  Fix mode will:\n  - Move daily notes >14 days old to archive/\n  - Clean and deduplicate ontology entries\n")
        if not sys.stdin.isatty():
            print("❌ Non-interactive mode detected. Use --force to apply without confirmation.")
            return ["Aborted: non-interactive mode without --force"]
        response = input("Proceed? (y/n): ").strip().lower()
        if response not in ("y", "yes"):

• Confidence: 91% confidence
• Finding: The skill includes a destructive fix mode that can modify and move user files, and the --force flag explicitly enables non-interactive execution. In an agent setting, this can lead to autonomous state-changing behavior on local memory data without a robust external authorization gate, increasing the risk of unintended data loss or integrity changes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.