ClawHub
Back to skill

Security audit

Engram Memory

Security checks across malware telemetry and agentic risk

Overview

This is a real local memory integration, but it asks for broad persistent memory, background services, and an unpinned remote installer that changes local OpenClaw configuration.

Review this before installing. It is intended to store and reuse local conversation and project memory, start local services, write OpenClaw MCP configuration, and run background memory hygiene. Install only if you trust the publisher and installer source, are comfortable with durable local memory of sensitive conversations/project data, and know how to stop the service and delete stored memories.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill directs users to execute a remote shell script via curl-pipe-bash that installs software, modifies OpenClaw configuration, and starts local services. This is dangerous because it combines unreviewed code execution with persistent system changes, and the skill does not prominently warn users about the trust and supply-chain implications before encouraging execution.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill is explicitly designed to persist conversation content into long-term local memory, but it does not provide a strong user-facing warning about retention, sensitivity of captured content, or when storage should be avoided. This is risky because users may unknowingly cause personal, confidential, or regulated data to be stored and later surfaced without informed consent or retention controls.

Session Persistence

Medium
Category
Rogue Agent
Content
At session end (or before compaction), invoke skill **`engram-session-promote`**
to propose ≤5 durable facts — never session recaps. See
`skills/engram-session-promote/SKILL.md`. SessionEnd can write a nudge file at
`~/.engram/session-promote-nudge.md`.

### Loop Steward (silent harness subconscious)
Confidence
75% confidence
Finding
The skill instructs the system to write a session-persistence nudge file under the user's home directory, creating durable state across sessions. This is dangerous because it introduces undeclared filesystem persistence that can influence future agent behavior and may store sensitive workflow signals without an explicit user warning or consent model.

External Script Fetching

Low
Category
Supply Chain
Content
version: 0.3.5
homepage: https://github.com/Moshik21/engram
user-invocable: true
metadata: {"openclaw":{"requires":{"anyBins":["curl"]},"envVars":[{"name":"ANTHROPIC_API_KEY","required":false,"description":"Optional richer entity extraction; deterministic extraction works without it."},{"name":"ENGRAM_GROUP_ID","required":false,"description":"Optional brain namespace for multi-brain setups."}],"emoji":"\ud83e\udde0","homepage":"https://github.com/Moshik21/engram","install":[{"kind":"shell","command":"curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- openclaw","bins":["engram","engramctl"]}],"tags":["memory","knowledge-graph","mcp","recall","long-term-memory","cognitive-architecture"]}}
---

# Engram Memory
Confidence
95% confidence
Finding
The metadata includes an installation command that fetches a shell script from a remote GitHub URL and pipes it directly to bash. This is a classic supply-chain and arbitrary code execution risk because the fetched content is not pinned, reviewed, or integrity-verified before execution, and skill metadata may enable streamlined execution by users or tooling.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.