ClawHub
Back to skill

Security audit

OpenClaw: memory optimizer

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill is narrowly focused on tuning local OpenClaw memory settings, but users should review any persistent config changes before applying them.

Before using it, back up ~/.openclaw/openclaw.json, ask to see the exact diff or openclaw config commands, and approve any gateway restart only when an interruption is acceptable.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to directly modify `~/.openclaw/openclaw.json`, apply configuration changes, and restart the gateway, but it provides no safety guidance such as backing up the existing config, validating changes before restart, or warning that these actions alter persistent user/system state. In an agent-skill context, this increases the chance of unintended service disruption, degraded memory behavior, or irreversible misconfiguration if the instructions are applied automatically or by a user without review.

Static analysis

No suspicious patterns detected.