TotalReclaw

• Outcome: Review
• Latest audit: Jul 30, 2026 · 11:29 AM UTC
• Version: 3.4.1

Overview

This memory skill has a coherent main purpose, but it needs review because it deliberately works around scanner rules and handles sensitive local data in ways the listing does not clearly explain.

Install only if you are comfortable with a memory provider that reads local OpenClaw/LLM credentials, sends requests to TotalReclaw and configured model providers, can export decrypted memories, writes several local state files, and may autonomously restart the gateway. Review the scanner-evasion comments and the plaintext local logs before trusting it with sensitive memories or shared-agent deployments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (262)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no required permissions, yet its instructions clearly rely on shell execution, localhost network access, and environment/path discovery. This mismatch can bypass user/operator expectations and permission review, especially because the skill performs installation, restart, and pairing actions that meaningfully affect the host and agent runtime.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The client exposes bulk export and deletion primitives that go beyond the skill’s stated automatic recall/capture behavior, creating hidden capabilities to enumerate and remove a user’s entire memory corpus. In a memory plugin triggered by highly sensitive phrases such as recovery-phrase restoration and recall requests, undisclosed export/delete functionality materially increases the risk of privacy abuse or destructive misuse if invoked by other parts of the skill.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The comments explicitly state that code was extracted so a file performing local file reads does not also contain outbound-request markers, with the stated goal of avoiding a potential-exfiltration scanner. Even though this file itself only does cache I/O, documenting and implementing scanner-evasion around sensitive reads is a strong indicator of deliberate concealment and makes it easier for adjacent code to exfiltrate data without triggering simple per-file heuristics.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module implements persistent inbound-user tracking for restart-auth heuristics, which is materially unrelated to the declared purpose of an end-to-end encrypted, decentralized memory/recall provider. The mismatch increases supply-chain risk because the skill introduces user surveillance and authentication-state logic outside user expectations, creating a covert data-collection capability that could be abused or retained indefinitely.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The code stores raw sender identifiers and timestamps in a local plaintext JSON file, which conflicts with the manifest's claim of end-to-end encrypted, decentralized memory behavior. This is dangerous because users and operators may trust the skill with sensitive interactions under false assumptions, while the implementation creates a centralized local identity log that can be exfiltrated, backed up, or inspected.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Persistent gateway-wide tracking of distinct user identities is not justified by the stated recall/memory functionality and introduces unnecessary collection of user-identifying metadata. Even without outbound exfiltration in this file, long-lived identity tracking expands privacy exposure and can support profiling or unauthorized access-control decisions elsewhere in the system.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The comments frame the storage as a simple counter, but the implementation actually persists identifiable sender IDs mapped to last-seen timestamps. This understatement is dangerous because it obscures the true sensitivity of the stored data, increasing the chance that reviewers, operators, and users underestimate privacy and compliance risks.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The comments explicitly state that the code was reorganized so a scanner rule 'can never trip' by separating environment-variable access from outbound network usage across files. That is a deliberate scanner-evasion strategy, which undermines security review and can conceal sensitive-data exfiltration paths in a plugin that performs background memory capture and network transmission.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The comment explicitly states the file was split out to avoid triggering the scanner's exfiltration rule when combining local credential reads with outbound HTTP. Even though this module claims not to touch the recovery phrase directly, structuring code to evade security detection is a strong indicator of unsafe design because it enables decrypted user memory to be sent over the network under scanner blind spots. In a memory provider skill handling sensitive personal data, this substantially increases the risk of covert data export or future misuse.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The CLI exposes `tr export`, which decrypts and prints the user's full memory vault to stdout. In a memory-provider skill, this materially expands the data exposure surface beyond native recall APIs and makes bulk exfiltration easier if the CLI is invoked by an agent, wrapper, or local process without explicit user understanding.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: The CLI includes pairing/onboarding flows and reads recovery-related state, which extends the skill beyond a narrow memory-provider role into credential-handling and account bootstrapping. Combining secret material access with memory operations increases the blast radius of any misuse or compromise, especially in an agent-integrated environment.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This memory-provider config also exposes configuration for a QA bug-reporting capability, including a GitHub personal access token and target repository override. That is outside the stated purpose of a memory provider and expands the plugin’s authority into source-control operations; if paired with a tool path that uses these values, the skill could exfiltrate sensitive memory-derived content into GitHub issues or abuse a shared CI token.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The header explicitly describes centralizing `process.env` reads to avoid scanner findings in files that also perform network calls. That is a red flag because it frames code organization around bypassing detection heuristics rather than reducing privilege, and it can make risky data flows harder to audit across module boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module writes sensitive data to plaintext local state files under ~/.totalreclaw, including decision logs and, for superseded claims, loser_claim_json containing full decrypted claim JSON. It also records user feedback/behavioral events in feedback.jsonl, which undermines the stated end-to-end encrypted memory model by creating an unencrypted local side channel that could be read by other local processes, backup tools, or anyone with filesystem access.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The file implements a feedback and weight-tuning loop based on pin/unpin behavior, building a local behavioral profile and adapting model weights from user actions. In a memory provider whose description emphasizes encrypted storage and recall, this materially expands data collection and processing beyond user expectation, increasing privacy risk and making sensitive preference inference possible if the local state is accessed.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The module comment explicitly states the file was extracted so `fs.readFileSync` would not appear in the same file as outbound-request markers, with the stated goal of avoiding the `potential-exfiltration` scanner rule. Deliberately restructuring code to defeat a security detector is itself a serious trust and supply-chain risk, especially in a memory provider skill that handles persistent user data and recovery-related flows.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements per-channel inbound-user tracking for auth/billing restart heuristics, which is materially outside the declared purpose of an end-to-end encrypted decentralized memory provider. Hidden or unjustified functionality increases the risk of unauthorized data collection and trust-boundary violations, especially when the skill is triggered broadly and could observe many user interactions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code stores raw per-channel sender identifiers and timestamps for authentication heuristics, but that capability is not justified by the skill's advertised memory/recall role. In this context, retaining user-identifying metadata creates unnecessary privacy exposure and enables cross-session behavioral tracking unrelated to the stated feature set.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module comments explicitly state that the network code was consolidated to avoid triggering the skill scanner's env/network detection rule. That is a direct admission of security-scanner evasion, which is dangerous because it preserves outbound network capability while intentionally reducing visibility to reviewers and automated controls. In a memory-provider skill that may handle sensitive user data, concealment of network behavior materially increases the risk of covert exfiltration or unauthorized remote interaction.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: This file implements generic outbound HTTP and JSON-RPC transport primitives that can send arbitrary caller-supplied URLs, headers, methods, and bodies. For a skill presented as an end-to-end encrypted memory provider, such broad transport capability is higher risk than necessary because it can be reused to contact unexpected services or transmit sensitive memory contents if upstream callers are compromised or overly permissive.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module comment explicitly states the file was split out to avoid triggering the skill scanner's exfiltration rule, which is a strong indicator of scanner-evasion-aware design. Even if the code path serves a legitimate export feature, structuring code to bypass detection materially increases risk because it reduces security visibility around a component that performs outbound HTTP and handles sensitive decrypted memory data.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The CLI exposes `tr export`, which decrypts and emits the user's full memory corpus to stdout as JSON or Markdown. In a memory-provider skill whose described purpose is automatic recall/remember, a bulk export surface materially expands data exposure and can be abused by any caller with local CLI access or by an agent instructed to invoke it, turning scoped recall into wholesale disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This memory-provider config reads a broad set of third-party LLM API keys plus GitHub/QA tokens that exceed the narrow, disclosed purpose of automatic encrypted memory and recall. In an agent skill context, expanding secret access beyond the stated capability increases blast radius if other modules misuse these values or if the skill later adds outbound calls using them without clear user consent.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The config includes pairing/session transport settings and relay URL controls that are not reflected in the public description, which presents the skill primarily as automatic memory/recall. Undisclosed communication capabilities are risky in agent extensions because they broaden the operational surface and can surprise operators about what remote interactions the skill may perform.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file explicitly adds ERC-4337 UserOp signing functionality even though the skill is presented as an end-to-end encrypted memory provider. Hidden signing capability materially expands the trust boundary: if any caller can route attacker-controlled hashes and keys into this function, the plugin can be used to authorize blockchain actions unrelated to memory storage. The mismatch between manifest intent and implemented capability is especially concerning in a memory skill, where users would not reasonably expect wallet-signing behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: dist-esm-smoke.test.ts:94

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: postinstall-validate.test.ts:138

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: CHANGELOG.md:48

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:58

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: llm/llm-client-retry.test.ts:1

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: import-upgrade-cli.test.ts:178

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: llm/llm-client.test.ts:255

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: llm/llm-profile-reader.test.ts:276

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: setup/qa-bug-report.test.ts:78

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: pairing/pair-e2e-leak-audit.test.ts:196