Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent OpenClaw memory-plugin setup guide, with expected persistent memory behavior that users should understand before enabling.
Before installing, decide whether automatic long-term memory is appropriate for your environment. Review autoCapture, autoRecall, userId scoping, storage location, deletion via memory_forget, and whether to use Mem0 platform mode or local Ollama/Qdrant. For tighter supply-chain control, pin the Qdrant image version or digest instead of using the implicit latest tag.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Check: Confirm Qdrant collection exists and has vectors:
curl -s http://localhost:6333/collections/hoai_an_memories | python3 -m json.tool
If the collection doesn't exist, mem0 creates it on first write. If it exists but vectors_count is 0, check Qdrant and Ollama connectivity above.
The skill describes a long-term memory plugin that 'extracts and injects memories automatically around each agent turn,' but it does not present a clear, prominent warning that user content may be automatically captured, stored, and later recalled across turns. In a memory plugin context, this raises privacy and consent risks because operators may enable persistent storage without fully understanding that potentially sensitive user data will be retained and searchable.
The Docker command references qdrant/qdrant without a version tag or digest, so users will pull whatever image is current at execution time. This creates a supply-chain and reproducibility risk: a future upstream image change, compromised tag, or breaking update could silently alter behavior or introduce malicious code when operators follow the skill instructions.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Verify fix:
ls -la ~/.openclaw/memory/history.db # should exist after first message
grep "SQLITE_CANTOPEN" ~/.openclaw/logs/gateway.err.log | tail -1 # should be old timestamp
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
launchctl bootout gui/$UID/ai.openclaw.gateway
launchctl bootstrap gui/$UID ~/Library/LaunchAgents/ai.openclaw.gateway.plist
---
No suspicious patterns detected.