ClawHub
Back to skill

Security audit

Engram Memory

Security checks for vulnerabilities and agentic risk

Overview

This local memory skill is mostly purpose-aligned, but it asks users to run an unverified remote installer that changes OpenClaw configuration and creates persistent background processing.

Install only if you are comfortable with a local long-term memory service that stores and resurfaces conversation/project context, runs background consolidation, and modifies OpenClaw MCP/skill configuration. Before running the installer, review or pin the install script yourself, avoid sudo, and look for clear commands to disable the LaunchAgent, stop the server, and delete stored memory data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:31
Finding

Unverified Mutable Remote Installer Executed Through Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31 and SKILL.md:74
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- openclaw
bash
curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- full

Technical Analysis

The installation instructions retrieve a shell script from the mutable main branch of a personal GitHub repository and pipe it directly into bash. The downloaded content is not saved for inspection or verified using an immutable version, cryptographic signature, or expected checksum.

This creates a remote code-execution channel whose effective payload can change after the Skill has been reviewed. HTTPS protects the network connection but does not protect against repository compromise, maintainer account compromise, malicious upstream changes, or later replacement of install.sh.

The full installation mode also delegates Docker-related setup to the unverified script. Depending on the invoking user's permissions and Docker access, this could expose a particularly powerful local control boundary.

Attack Path

  1. An attacker compromises the repository, maintainer credentials, release process, or mutable main branch.
  2. The attacker replaces or modifies scripts/install.sh with a malicious payload.
  3. A user or agent follows the documented installation command.
  4. curl retrieves the attacker-controlled script without integrity verification.
  5. The shell executes the response immediately with the invoking user's privileges.
  6. The payload can inspect local files, steal credentials, alter OpenClaw configuration, install additional software, or establish persistence.
  7. In Docker-capable environments, the payload may abuse access to the Docker daemon to control containers or p ...[truncated 729 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | bash installation patterns.
  2. Publish versioned installation artifacts associated with immutable release tags or commit hashes.
  3. Download the installer to a local file before execution so it can be reviewed:
    bash
    curl --fail --location --output install.sh \
  https://raw.githubusercontent.com/Moshik21/engram/<immutable-commit>/scripts/install.sh
  4. Publish an expected SHA-256 digest through a separately protected release channel and verify it before execution.
  5. Cryptographically sign releases and verify the signature against a documented maintainer key.
  6. Require explicit user confirmation after displaying the files, services, configuration changes, and dependencies that will be installed.
  7. Prefer a reputable package manager with locked versions and reproducible packages.
  8. Pin every installer dependency and prevent fallback to unreviewed or mutable sources.
  9. Keep Docker installation as a separately authorized action rather than allowing a general installer to configure it implicitly.
  10. Document that the installer must not be executed with sudo unless a narrowly scoped operation demonstrably requires elevation.

T06 · System Persistence

Error
Location
SKILL.md:295
Finding

Installer Establishes Cross-Session Services and Scheduled Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:33-36 and SKILL.md:295-306
Vulnerability Type: System persistence
Risk Level: High

Vulnerable Code

text
That one command installs Engram, adds the Helix native runtime to Engram's tool environment, starts the local server, installs this skill into OpenClaw's shared skill folder, writes OpenClaw MCP config, and runs readiness checks. Release wheels are preferred; if no compatible wheel is available, the installer builds `helix-native` from Engram's bundled source and reports Rust/Cargo as the only extra prerequisite. It does not silently switch to Docker.
text
Engram runs offline consolidation in a separate cold-brain process:
triage, merge, calibrate, infer, evidence_adjudication, edge_adjudication,
replay, prune, compact, reflect, reindex,
graph_embed, microglia, immunity, dream (15 phases). Consumer installs run a
bounded 2h "mop" (hygiene drains + adjudication + replay + prune) via the
`dev.engram.brain` LaunchAgent — consolidation never runs inside the hot
server process, and the REST trigger returns an error on shell-role installs.

Operators run cycles with `engram brain run` (never from an agent session
while the server is up).

Technical Analysis

The documented installer starts a local server, installs the Skill into a shared directory, modifies OpenClaw MCP configuration, and uses the dev.engram.brain LaunchAgent for recurring background processing. These changes survive the original Skill invocation and create cross-session execution.

Persistent background operation is related to the declared long-term-memory functionality. However, it is not the minimum privilege necessary merely to install or expose the Skill, and the documentation does not show a separate consent boundary for startup persistence. The risk is amplified because creation of the persistent components is delegated to the unverified remote installer ident ...[truncated 1889 chars]

Remediation
View remediation

Remediation Suggestions

  1. Separate package installation, OpenClaw configuration, server startup, and LaunchAgent creation into distinct commands.
  2. Require explicit user approval before creating any startup service or scheduled task.
  3. Default to foreground or manually started execution; make cross-session persistence opt-in.
  4. Display the exact LaunchAgent file, executable path, arguments, schedule, data directories, and log destinations before installation.
  5. Install the service under a dedicated least-privileged identity where supported.
  6. Restrict service files and memory databases using owner-only filesystem permissions.
  7. Bind the API exclusively to loopback and require authentication where local multi-user or untrusted-process threats are relevant.
  8. Ensure service executables and configuration are not writable by less-trusted users or processes.
  9. Provide documented commands that completely stop, disable, and uninstall the LaunchAgent, server, MCP configuration, shared Skill files, and stored data.
  10. Use pinned, signed, integrity-verified binaries for every persistent component.
  11. Record installation and update events in user-visible logs.
  12. Require separate authorization before ingesting project artifacts or enabling recurring consolidation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to execute a remote script directly via curl piped to bash, but does not present an explicit security warning or verification step. This creates a supply-chain execution risk because any compromise of the upstream repository, hosting, or network path could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
At session end (or before compaction), invoke skill **`engram-session-promote`**
to propose ≤5 durable facts — never session recaps. See
`skills/engram-session-promote/SKILL.md`. SessionEnd can write a nudge file at
`~/.engram/session-promote-nudge.md`.

### Loop Steward (silent harness subconscious)

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill describes writing a session-end nudge file under the user's home directory, which introduces cross-session persistence outside the immediate conversation context. This can create privacy and integrity risks if users are not informed that behavioral prompts or memory-related artifacts persist on disk between sessions.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
At session end (or before compaction), invoke skill **`engram-session-promote`**
to propose ≤5 durable facts — never session recaps. See
`skills/engram-session-promote/SKILL.md`. SessionEnd can write a nudge file at
`~/.engram/session-promote-nudge.md`.

### Loop Steward (silent harness subconscious)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

engram loop steward-once --format json

text

Skill: `skills/engram-loop-steward/SKILL.md`. Do **not** narrate to the user.
Public MCP stays golden-loop only.

Open adjudication / open_work counts are **graph hygiene**, not product success.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill repeatedly instructs the agent to persist conversation content, personal facts, decisions, and intentions into long-term local memory without a clear, user-facing consent or retention warning. This is dangerous because users may disclose sensitive personal or project information without understanding it will be stored and resurfaced later.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The metadata includes an installation command that executes a remote script directly from GitHub via bash. Because skill metadata may be surfaced or executed by tooling with minimal scrutiny, embedding curl|bash here increases the risk of arbitrary code execution through a compromised upstream install script.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
version: 0.3.5
homepage: https://github.com/Moshik21/engram
user-invocable: true
metadata: {"openclaw":{"requires":{"anyBins":["curl"]},"envVars":[{"name":"ANTHROPIC_API_KEY","required":false,"description":"Optional richer entity extraction; deterministic extraction works without it."},{"name":"ENGRAM_GROUP_ID","required":false,"description":"Optional brain namespace for multi-brain setups."}],"emoji":"\ud83e\udde0","homepage":"https://github.com/Moshik21/engram","install":[{"kind":"shell","command":"curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- openclaw","bins":["engram","engramctl"]}],"tags":["memory","knowledge-graph","mcp","recall","long-term-memory","cognitive-architecture"]}}
---

# Engram Memory

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

This install step tells the user to run a remote script fetched over HTTPS and piped directly to a shell, which is a classic supply-chain risk. The skill context makes it more dangerous because the command performs multiple privileged setup actions automatically, expanding the blast radius if the script is malicious or compromised.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Then start the native Engram runtime and connect it to OpenClaw:

bash
curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- openclaw

That one command installs Engram, adds the Helix native runtime to Engram's tool environment, starts the local server, installs this skill into OpenClaw's shared skill folder, writes OpenClaw MCP config, and runs readiness checks. Release wheels are preferred; if no compatible wheel is available, the installer builds helix-native from Engram's bundled source and reports Rust/Cargo as the only extra prerequisite. It does not silently switch to Docker.

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The Docker fallback repeats the same unsafe remote-script execution pattern, so users who choose an alternate mode remain exposed to arbitrary code execution risk. The fact that this path may install and configure containerized components further increases the operational impact of compromise.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Explicit Docker fallback

bash
curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- full

Use Docker only when the user explicitly asks for full Docker mode.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill enables automatic polling and surfacing of memory-derived notifications, including proactive discoveries and reminders, without a clear upfront warning to the user. While lower severity than code execution, it can surprise users by resurfacing retained information automatically, increasing privacy and trust risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.