Back to plugin

Security audit

Recall by Polign

Security checks for vulnerabilities and agentic risk

Overview

This plugin is a disclosed long-term memory integration that stores and retrieves conversation-derived memories through a configured Recall server.

Install only if you want OpenClaw conversations and selected memories sent to your configured Recall server and retained as long-term history. Review the server URL, API key namespace, autoCapture setting, and storage backend before enabling it, especially if the Recall server uses cloud object storage or a shared namespace.

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
openclaw.plugin.json:35
Evidence
"placeholder": "http://127.0.0.1:8080",