Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real memory-management skill, but it needs Review because it includes unsafe install guidance, reachable shell-command injection, automatic memory capture and recall, and broad persistent/network-exposed memory controls.
Install only after reviewing this skill carefully. It can persist and inject memories automatically, expose memory data through local/network services, run git shell commands through MCP tools, load external plugin code, and store cloud backup credentials locally. Avoid the curl-to-shell install paths, do not enable cloud backup or HTTP/API features unless you understand the exposure, and treat git/plugin/sync tools as high-risk until command execution and permission scoping are fixed.
merged-docs.md:2169Recommended installation executes a mutable remote payload without verification
merged-src.js:21832MCP Git tools permit shell command injection through untrusted string parameters
merged-src.js:8304Cloud storage credentials are persisted in plaintext with unspecified file permissions
The auto-activation triggers include very common words such as "memory," "remember," and especially the Chinese phrase "我想知道" ("I want to know"), which are likely to appear in ordinary conversation. This can cause the skill to activate unexpectedly and perform retrieval or writes without clear user intent, increasing the chance of privacy leakage or unintended state changes.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `STORAGE_MODE` | `json` | Storage backend: `json` or `sqlite` |
| `OPENCLAW_WORKSPACE_DIR` | `~/.openclaw/workspace` | Workspace directory |
<!-- zh -->
| 变量 | 默认值 | 说明 |
|------|--------|------|
| `OLLAMA_HOST` | `http://localhost:11434` | Ollama API 地址 |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `memory_noise` | Filter noise — skip generic or meaningless queries. |
| `memory_intent` | Detect user intent and route to appropriate handler. |
<!-- zh -->
| 工具 | 说明 |
|------|------|
| `memory_search` | 混合搜索：BM25 + 向量检索，支持范围过滤，返回排序结果和摘要高亮。 |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `memory_noise` | Filter noise — skip generic or meaningless queries. |
| `memory_intent` | Detect user intent and route to appropriate handler. |
<!-- zh -->
| 工具 | 说明 |
|------|------|
| `memory_search` | 混合搜索:BM25 + 向量检索,支持范围过滤,返回排序结果和摘要高亮。 |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `memory_gitnotes_restore` | Restore git notes. |
| `memory_cloud_backup_api` | Cloud backup API management. |
<!-- zh -->
| 工具 | 说明 |
|------|------|
| `memory_stats` | 记忆统计：数量、分类、标签、分布。 |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `memory_gitnotes_restore` | Restore git notes. |
| `memory_cloud_backup_api` | Cloud backup API management. |
<!-- zh -->
| 工具 | 说明 |
|------|------|
| `memory_stats` | 记忆统计:数量、分类、标签、分布。 |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
mcporter call unified-memory memory_version '{"memoryId": "mem_xxx"}'
<!-- zh -->
```bash
# 健康检查
mcporter call unified-memory memory_health '{}'
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
getMemory(id) // Get by ID getAllMemories(options) // List with filters updateMemory(id, updates) // Update fields deleteMemory(id) // Delete memory saveMemories(memories) // Bulk save
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
getMemory(id) // Get by ID getAllMemories(options) // List with filters updateMemory(id, updates) // Update fields deleteMemory(id) // Delete memory saveMemories(memories) // Bulk save
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
getMemory(id) // Get by ID getAllMemories(options) // List with filters updateMemory(id, updates) // Update fields deleteMemory(id) // Delete memory saveMemories(memories) // Bulk save
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
rank_i = rank from algorithm i
## Delete Memory Flow
Client: memory_delete({ id })
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
rank_i = rank from algorithm i
## Delete Memory Flow
Client: memory_delete({ id })
Piping the Unified Memory install script directly from the network into bash creates a one-command arbitrary code execution path. Users are encouraged to trust and execute remote content without review.
# Install
curl -fsSL https://raw.githubusercontent.com/mouxangithub/unified-memory/main/install.sh | bash
# Store a memory
unified-memory add "Remember to review quarterly reports" --tags work,reminder
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /api/memories/:id
This quick install example chains network retrieval and shell execution, which is a classic unsafe pattern. If the source is compromised, copied users immediately execute attacker code.
Quick install:
curl -fsSL https://raw.githubusercontent.com/mouxangithub/unified-memory/main/install.sh | bash
Or via npm:
Piping Ollama's remote install script to sh executes unaudited network content immediately. A compromise of the hosting endpoint or upstream account would give attackers arbitrary code execution on the host.
Yes, but you'll only have BM25 search. Vector search requires Ollama:
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
# Pull embedding model
ollama pull nomic-embed-text
The Ollama installer example chains remote download into sh, enabling arbitrary code execution from a fetched script. Because it appears in setup guidance, users may run it with little scrutiny.
Yes, but you'll only have BM25 search. Vector search requires Ollama:
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
# Pull embedding model
ollama pull nomic-embed-text
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf ~/.unified-memory/vector.lance
unified-memory init
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)