ClawHub
Back to skill

Security audit

Mem0 Config

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw memory-plugin setup guide, with expected persistent memory behavior that users should understand before enabling.

Before installing, decide whether automatic long-term memory is appropriate for your environment. Review autoCapture, autoRecall, userId scoping, storage location, deletion via memory_forget, and whether to use Mem0 platform mode or local Ollama/Qdrant. For tighter supply-chain control, pin the Qdrant image version or digest instead of using the implicit latest tag.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Script Fetching

High
Category
Supply Chain
Content
**Check:** Confirm Qdrant collection exists and has vectors:
```bash
curl -s http://localhost:6333/collections/hoai_an_memories | python3 -m json.tool
```

If the collection doesn't exist, mem0 creates it on first write. If it exists but `vectors_count` is 0, check Qdrant and Ollama connectivity above.
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill describes a long-term memory plugin that 'extracts and injects memories automatically around each agent turn,' but it does not present a clear, prominent warning that user content may be automatically captured, stored, and later recalled across turns. In a memory plugin context, this raises privacy and consent risks because operators may enable persistent storage without fully understanding that potentially sensitive user data will be retained and searchable.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding
The Docker command references `qdrant/qdrant` without a version tag or digest, so users will pull whatever image is current at execution time. This creates a supply-chain and reproducibility risk: a future upstream image change, compromised tag, or breaking update could silently alter behavior or introduce malicious code when operators follow the skill instructions.

File System Enumeration

Medium
Category
Data Exfiltration
Content
**Verify fix:**
```bash
ls -la ~/.openclaw/memory/history.db   # should exist after first message
grep "SQLITE_CANTOPEN" ~/.openclaw/logs/gateway.err.log | tail -1  # should be old timestamp
```
Confidence
60% confidence
Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Session Persistence

Medium
Category
Rogue Agent
Content
# if still stuck:
launchctl bootout gui/$UID/ai.openclaw.gateway
# then:
launchctl bootstrap gui/$UID ~/Library/LaunchAgents/ai.openclaw.gateway.plist
```

---
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.