Openclaw Memory Toolkit

• Outcome: Review
• Latest audit: Oct 14, 2026 · 7:22 PM UTC
• Version: 4.0.6

Overview

This memory-management skill is mostly purpose-aligned, but it needs review because it handles sensitive memory/session data and includes an additional cloud-capable helper that the main skill description does not disclose.

Review before installing if your OpenClaw memory contains private, business, health, credential-adjacent, or session transcript content. Set TRACE_LLM_LOCAL_ONLY=1 for privacy-sensitive use, and do not set TRACE_LLM_ALLOW_CLOUD=1 or provide Ollama cloud credentials unless you accept sanitized memory/ontology excerpts leaving the machine. Review any cron, --force, --apply, --fix, indexing, and ontology backfill commands before using them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (108)

Tainted flow: 'req' from os.environ.get (line 336, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · consolidate_advisor.py (reported line 342)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        )
        # SECURITY: urlopen sends to OLLAMA_URL (default localhost:11434) — keep local for privacy
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read().decode())
            return result.get("response", "").strip()[:100]
    except Exception as e:

Tainted flow: 'GEN_TIMEOUT' from os.environ.get (line 84, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · hybrid-search/auto_capture.py (reported line 343)May include surrounding context.

python

headers={"Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=GEN_TIMEOUT) as resp:
            data = json.loads(resp.read().decode("utf-8"))
        content = data.get("message", {}).get("content", "")
        facts = json.loads(content)

Tainted flow: 'req' from os.environ.get (line 310, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · hybrid-search/conflict_resolver.py (reported line 314)May include surrounding context.

python

OLLAMA_GEN_URL, data=payload,
                headers={"Content-Type": "application/json"}, method="POST",
            )
            with urllib.request.urlopen(req, timeout=60) as resp:
                body = json.loads(resp.read()).get("response", "")
            m = _JSON_RE.search(body)
            if m:

Tainted flow: 'req' from os.environ.get (line 526, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · trace_extractor.py (reported line 509)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"},
        )
        timeout = 120 + (attempt * 30)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            result = json.loads(resp.read().decode('utf-8'))
            content = result.get("message", {}).get("content", "")
            done_reason = result.get("done_reason", "")

Tainted flow: 'req' from os.environ.get (line 526, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · trace_extractor.py (reported line 532)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"},
        )
        timeout = 120 + (attempt * 30)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            result = json.loads(resp.read().decode('utf-8'))
            content = result.get("message", {}).get("content", "")
            done_reason = result.get("done_reason", "")

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · CHANGELOG.md (reported line 715)May include surrounding context.

md

- `pending` — surfaces unresolved `disputed` facts cheaply and deterministically
    (`--json` for programmatic use), so an agent can raise the queue at the next
    relevant turn without a runtime hook. This is the tool half of "resolve at the
    next pertinent turn": the skill cannot decide relevance, but it can always
    answer "what is waiting for a human?".
  - `resolve <id> --confirm` — restores the wording to `active` **and supersedes
    any rival claim on the same subject**, so a contested pair can never both stay

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This is a substantive transparency failure: the skill is presented as a broad local-first toolkit, but the noted behavior includes optional cloud transmission of sanitized memory/session content and targeted writes to notes, ontology, and timelines. In a memory-management context, data sensitivity is high, so incomplete disclosure of outbound transfer and mutation paths meaningfully raises the risk of confidentiality breaches and unsafe automation.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

### 7. `hybrid_search.py` — Hybrid search (FTS5 + sqlite-vec + RRF)

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: hybrid-search/test_ontology_key_parity.py:67

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: hybrid-search/test_orphan_link.py:43

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: ontology_backfill_llm.py:51

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: ontology_backfill_orphans.py:66