Security audit

Memoria

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a local memory tool, but it installs a persistent daemon and automatic conversation-capture hooks through a broad unpinned installer, so it should be reviewed carefully before use.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: packages/cli/src/commands/ui.ts:29

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: packages/cli/test/install-script.test.ts:22

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: packages/core/src/agents/register.ts:52

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: packages/core/src/llm/detect.ts:112

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: packages/core/src/secrets/keychain-macos.ts:13

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: packages/daemon/src/client.ts:190

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: packages/daemon/src/update.ts:105

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: packages/core/src/llm/anthropic.ts:23

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: packages/core/src/llm/detect.ts:330

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: packages/core/src/llm/openai.ts:41

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: packages/adapter-openclaw/test/adapter.test.ts:117

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: packages/core/src/llm/lmstudio.ts:134

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: packages/core/test/secrets.test.ts:228