neural-memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:39 PM UTC
• Version: 4.62.0

Overview

This memory skill is purpose-aligned, but it enables broad automatic capture and reinjection of conversation data with limited consent and safety controls.

Review this carefully before installing. Use a dedicated brain per project, disable autoCapture and autoContext unless you explicitly want cross-session memory, avoid using it in conversations containing secrets or regulated data, and verify the exact pip/npm packages and versions before running the install or build commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26
• Finding: Unpinned Executable Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13`, `SKILL.md:26-38`, and `SKILL.md:73-77` **Vulnerability Type**: Unpinned third-party packages and package-controlled build execution **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"brain","primaryEnv":"NEURALMEMORY_BRAIN","requires":{"bins":["python3"],"env":["NEURALMEMORY_BRAIN"]},"os":["darwin","linux","win32"],"install":[{"id":"pip","kind":"node","package":"neural-memory","bins":["nmem"],"label":"pip install neural-memory"}]}} ``` ```bash pip install neural-memory ``` ```bash # Install from npm npm install -g neuralmemory ``` ```bash cd <path-to-installed-plugin> npm run build ``` ### Technical Analysis The installation instructions retrieve the latest available releases of `neural-memory` from the Python package registry and `neuralmemory` from the npm registry without specifying exact versions, integrity hashes, or a lockfile. The npm package is installed globally and its package-controlled build script is subsequently executed. Package installation and build operations can execute package lifecycle hooks or other package-supplied code with the privileges of the installing user. Because the dependency source is not included in the audited project, its effective behavior—including the claim that memory remains local—cannot be independently verified from this artifact. The metadata also contains an inconsistent installation declaration: the package is described with `"kind":"node"` while its label refers to `pip install neural-memory`. In addition, the Python and npm package names differ. These inconsistencies increase the possibility of installing an unintended package or obscuring which dependency is authoritative. ### Attack Path 1. An attacker compromises the relevant registry account, publishes a malicious update, or takes control of an ambiguously named package. 2. A user follows the Skill instructions and installs the unpinned current packa ...[truncated 904 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact, reviewed versions of both Python and npm dependencies. 2. Supply lockfiles and registry integrity hashes where supported. 3. Correct the metadata so that the package manager, installation kind, package name, and displayed command are consistent. 4. Avoid global installation; use an isolated virtual environment or project-local npm installation. 5. Publish or bundle the auditable plugin source and verify that generated build artifacts correspond to that source. 6. Review package lifecycle and build scripts before execution, and use installation options that suppress unnecessary scripts where feasible. 7. Run the plugin and MCP server as an unprivileged user with filesystem access limited to required OpenClaw and NeuralMemory directories. 8. Document the trusted publisher, expected package identifiers, supported versions, and integrity-verification process. ]]>

other

Warning

• Location: SKILL.md:66
• Finding: Automatic Persistent Capture and Reinjection of Conversation Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:66-70`, `SKILL.md:189-191`, and `SKILL.md:257-258` **Vulnerability Type**: Privacy exposure and persistent-context poisoning risk **Risk Level**: Medium ### Vulnerable Code ```markdown **Plugin features:** - 6 tools registered automatically (nmem_remember, nmem_recall, nmem_context, nmem_todo, nmem_stats, nmem_health) - `before_agent_start` hook: injects tool instructions + relevant memories as context (persists across `/new`) - `agent_end` hook: auto-extracts facts, decisions, and TODOs from the conversation - Configurable: `contextDepth` (0-3), `maxContextTokens` (100-10000) ``` ```markdown ### At Session End 7. Call `nmem_auto` with action="process" on important conversation segments 8. This auto-extracts facts, decisions, errors, and TODOs ``` ```markdown - Memories are stored locally in SQLite at `~/.neuralmemory/brains/<brain>.db` - No data is sent to external services (unless optional embedding provider is configured) ``` The documented memory types also include `instruction`, allowing instruction-like content to be retained alongside facts, preferences, and other memory records. ### Technical Analysis The plugin is configured to inspect conversation content at the end of an agent run, extract selected information, store it persistently in a local SQLite database, and reinject relevant memories before later agent runs. This behavior is central to the declared memory functionality, but automatic capture without a review or confirmation boundary can retain sensitive content that users did not intend to preserve. Persistent reinjection also creates a context-poisoning risk. If adversarial or untrusted conversation content is extracted as a memory—especially as an `instruction`—it may be presented again in future sessions and influence subsequent agent behavior. The audited document does not establish trust labels, instruction/data separation, secret filtering, or user approval before per ...[truncated 1895 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic capture by default and require explicit, informed opt-in. 2. Present extracted memories for user review before committing them to persistent storage. 3. Implement secret detection and exclusion for credentials, tokens, private keys, authentication headers, and other sensitive values. 4. Do not persist instruction-like content by default. Treat recalled memories as untrusted data rather than authoritative agent instructions. 5. Add provenance and trust labels to every memory, including its source conversation and whether it was user-approved. 6. Apply retention periods, deletion controls, per-project brain isolation, and an easy mechanism to inspect and purge stored records. 7. Encrypt the database at rest where appropriate and restrict its filesystem permissions to the owning user. 8. Prevent recalled data from being placed in privileged system-instruction channels. 9. Clearly disclose when optional embedding providers transmit data externally and require separate consent before enabling them. 10. Add adversarial tests covering prompt injection, poisoned memories, cross-session leakage, and accidental secret retention. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The plugin advertises automatic context injection before each run and automatic capture of memories after conversations, but the skill does not present a prominent consent, retention, or privacy warning alongside those defaults. This is dangerous because users may unknowingly have personal, confidential, or regulated data persisted and later resurfaced across sessions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells the agent to use memory proactively for many common situations, including starting new tasks and remembering facts across sessions. That broad trigger surface increases the chance of collecting or resurfacing user data when it is unnecessary, which can lead to over-retention and accidental disclosure of prior context.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill promotes broad proactive memory capture and reuse across sessions without clear limits on sensitive categories of information. In a memory skill this context makes the behavior functional, but it also makes privacy risk more acute because persistent recall is the core feature and can expose stale or sensitive user data in later interactions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Automatic post-conversation extraction normalizes logging and persistence of conversation content by default. If the conversation contains credentials, proprietary material, or personal data, the system may retain and later reveal it without the user's clear awareness or consent.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The workflow instructs the agent to process important conversation segments into persistent memory at session end, creating a routine path for storing user content. Without strict minimization and sensitivity checks, this can capture more information than necessary and preserve context that later becomes inappropriate to reveal.

Static analysis

No suspicious patterns detected.