Security audit

Memory TencentDB

Security checks across malware telemetry and agentic risk

Overview

This is a real memory plugin, but it also patches host software/configuration and has under-disclosed remote/offload behaviors that warrant manual review before installation.

Install only if you intentionally want a high-privilege memory/offload system that can capture conversations, modify OpenClaw configuration/runtime files, start a sidecar process, and optionally send data to remote model, database, tracing, or offload services. Review and disable postinstall/patch scripts if possible, keep offload and tracing off unless needed, avoid trust_remote_code visualizer use in sensitive environments, and use explicit scoped credentials and identifiers.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (124)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: stdout_target = subprocess.DEVNULL stderr_target = subprocess.DEVNULL self._process = subprocess.Popen( shlex.split(self._gateway_cmd), env=env, stdout=stdout_target,
Confidence: 89% confidence
Finding: self._process = subprocess.Popen( shlex.split(self._gateway_cmd), env=env, stdout=stdout_target, stderr=stderr_target,

Lp3

Medium

Category: MCP Least Privilege
Confidence: 76% confidence
Finding: The skill advertises substantial capabilities such as environment access, file read/write, networking, and shell execution, but the manifest text shown here does not declare permissions or clearly constrain them. In a plugin that records conversations and interacts with local and remote storage, undocumented powerful capabilities reduce transparency and make abuse or unsafe deployment more likely.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose is a memory plugin, but the referenced behavior includes process management, HTTP service exposure, host configuration changes, symlink/profile modification, migration/export tooling, patching host code, and telemetry-like reporting. This mismatch is dangerous because operators may grant trust based on the benign description while the package performs materially broader and more security-sensitive actions.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The code can generate and write new skill files from conversation-derived data, which creates a persistent code/content generation path outside the stated memory-plugin purpose. In a plugin ecosystem, turning user/tool conversation data into executable or semi-executable skills can become a persistence and prompt-injection propagation vector, especially if generated skills are later trusted or loaded automatically.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The plugin description emphasizes local SQLite and Tencent VectorDB storage, but the code also sends data to arbitrary offload backends, local/remote LLM endpoints, and tracing services. This mismatch is security-relevant because users may consent to local storage while unknowingly exposing conversation and tool data to external systems.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Deriving a stable user identifier from the host's non-loopback IPv4 address creates covert host fingerprinting that is unrelated to core memory storage. This identifier is then used for backend reporting, enabling cross-session or cross-plugin correlation without clear user consent.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: A comment claims zero external API dependencies while the code performs extensive outbound HTTP requests to OpenAI-compatible APIs, offload backends, tracing systems, and Tencent services. This is dangerous because it undermines informed consent and may cause operators to deploy the plugin under false assumptions about data locality and exfiltration risk.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The environment-access layer explicitly says it exists to avoid security scanner detection, which is a strong red flag. Obfuscating access to sensitive environment variables in order to evade static analysis indicates concealment of credential access behavior and materially increases the risk of stealthy secret harvesting or misuse.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The provider auto-discovers a local TypeScript gateway and returns a shell-based launch command (`sh -c ... && exec pnpm exec tsx ...`) that will later be executed by the supervisor. Even though paths are shell-quoted and `shell=True` is avoided at the final `Popen` layer, this still expands the plugin's privileges from memory access into local process execution based on filesystem discovery under the plugin tree or `$HOME`, which can be abused if an attacker can place or replace the discovered checkout.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The config schema exposes independent LLM credentials and a base URL for gateway-side model calls, meaning the memory plugin can cause conversation-derived data to be sent to a separate model endpoint outside the host agent's normal control plane. In a memory plugin, this broadens trust boundaries and can enable unexpected exfiltration or policy bypass if operators assume the plugin only stores/searches memory locally.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: This memory plugin goes beyond passive data handling and manages a sidecar process, expanding the trust boundary significantly. In a plugin ecosystem, silently starting external software increases attack surface and can lead to code execution, persistence, or unexpected system behavior, especially when combined with environment-configured commands.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file header explicitly claims 'zero external API dependencies', but later code conditionally registers a remote offload backend. That mismatch can mislead deployers into enabling the plugin under a false assumption that no data may leave the local environment, weakening informed consent and security review.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata emphasizes local SQLite and Tencent vector DB memory, but this code also supports a separate remote offload subsystem via configurable backendUrl. Hidden or under-disclosed outbound transfer paths are dangerous because users may expose conversation data to infrastructure they did not intend to trust.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The plugin includes logic to auto-patch host hook policy by calling ensurePluginHookPolicy against root/runtime config. A plugin that mutates host configuration expands its privileges and can surprise operators, especially when the plugin is presented as a memory component rather than a host-config modifying extension.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The package markets itself as a local memory plugin, but the manifest clearly includes Tencent vector database migration/export tooling and a TencentDB-specific dependency. This kind of capability mismatch can mislead operators about where conversational data may flow, increasing the risk of unintended remote data transfer for sensitive memory contents.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The postinstall script executes a shell patch against another tool during installation, which is a high-risk behavior because it modifies host software outside the package boundary without interactive approval. In a memory plugin context, this expands trust scope and creates a supply-chain style attack surface where installation triggers code changes on the user's system.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code intentionally renders absolute local filesystem paths into persona/navigation content so an agent can call read_file directly. Exposing host paths broadens the agent's visibility beyond memory retrieval, leaks environment structure, and can enable unauthorized file access attempts or path-based reconnaissance if an agent or downstream prompt is manipulated.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The debug log includes a serialized slice of the request body, which may contain conversation content, extracted memories, embeddings metadata, or user-profile information. In a memory system, those payloads are especially sensitive, and logging them can create secondary exposure through log aggregation, support access, retention, or compromise of observability systems.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script loads a Hugging Face model with trust_remote_code=True, which permits execution of model-supplied Python code during initialization. Because the script states the model may be downloaded on first run, this creates a supply-chain/code-execution risk from external content in a local-memory tool that users would reasonably expect to be offline and data-local.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The visualizer performs implicit external model retrieval/loading despite being presented as a local memory visualization workflow backed by SQLite and Tencent vector storage. This mismatch matters because it can introduce undisclosed network access, dependency trust, and unexpected code paths in a component handling sensitive local memory data.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script modifies the host OpenClaw runtime configuration and reserves the global `plugins.slots.contextEngine` slot, which affects behavior outside the plugin's own storage scope. In a security-sensitive agent environment, host-level config mutation is risky because it changes execution/data-flow semantics for the whole runtime and can redirect context handling to this plugin without an interactive confirmation boundary.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The enable flow executes a separate patch script to alter external OpenClaw behavior so `after_tool_call` messages become available, expanding what the plugin can observe beyond ordinary memory persistence. Patching the host runtime to expose additional message/session data materially increases collection capability and attack surface, especially for a memory/offload plugin that already handles sensitive conversation content.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The runner exposes generic local file read/write/edit tools to the LLM, even though this skill's stated purpose is memory capture and storage rather than arbitrary workspace manipulation. In an LLM-integrated context, this materially expands the attack surface: prompt injection or model misbehavior could cause unintended reads of local files or destructive writes within the workspace.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The configuration adds a generic remote offload pathway (`backendUrl`, `backendApiKey`, backend mode) that can send memory-processing data to arbitrary external services, which materially expands the trust boundary beyond the stated local SQLite + Tencent VectorDB scope. In a memory plugin that captures conversations and user profile data, undocumented remote egress meaningfully increases privacy and exfiltration risk even though the file only defines config and does not itself transmit data.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The offload settings explicitly support sending per-user state to an arbitrary backend and document fallback identification using the machine's primary non-loopback IPv4 address. For a plugin that stores conversations, memories, and persona data, combining remote state sync with an implicit network-derived identifier creates a significant privacy risk and can leak host-identifying information without clear user intent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-after-tool-call-messages.patch.sh:58

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/index.mjs:12967

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/migrate-sqlite-to-tcvdb/dist/scripts/migrate-sqlite-to-tcvdb/sqlite-to-tcvdb.js:199

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/adapters/standalone/llm-runner.ts:196

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/core/store/factory.ts:98

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/gateway/server.ts:388

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: dist/index.mjs:3484

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: src/offload/backend-client.ts:312