Security audit

Memory Manager

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real memory manager, but it handles private memories, credentials, shell startup files, and Git sync in ways that need review before installation.

Install only if you are comfortable with this skill reading and writing your memory repository, sending selected memory text to the configured embedding provider, and using GitHub sync. Prefer a local reviewed install over curl|bash or irm|iex, use --no-shell-rc, avoid storing API keys or GitHub tokens in shell startup files or plaintext git credentials, use narrowly scoped tokens, and review exactly what files will be committed before syncing.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:74
Finding: Mutable Remote Installation Scripts Are Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: install.sh:318
Finding: API Keys Are Written to Executable Shell Startup Files Without Safe Escaping
Content: View full analysis
/dev/null; then echo "" >> "$shell_rc" echo "# Memory Manager API Key - $(date)" >> "$shell_rc" echo "export ${env_var}='${api_key}'" >> "$shell_rc" fi fi ``` ### Technical Analysis The installer persists an embedding-provider API key directly in `.zshrc` or `.bashrc`. These files are executable shell configuration, are commonly included in backups and diagnostic archives, and may be readable by unrelated local tooling. The value is interpolated inside a single-quoted shell assignment without validating or escaping embedded quotes or newline characters. A crafted value can terminate the quoted assignment and append arbitrary shell commands. Those commands will execute whenever the affected shell startup file is sourced. Although `--no-shell-rc` is supported, it is not the default. Persistently modifying an executable startup file and placing secrets in it exceeds the minimum privileges needed to configure an embedding client. ### Attack Path 1. A malicious or compromised setup process supplies an API-key value containing a single quote, newline, or shell syntax. 2. The installer interpolates the value directly into an `export` statement. 3. The resulting statement is appended to `.bashrc` or `.zshrc`. 4. The user opens a new shell or manually sources the startup file. 5. The injected shell commands execute under the user's account. A separate disclosure path exists when a local process, backup service, support bundle, or accidental repository commit obtains the plaintext startup file. ### Impac ...[truncated 317 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/memory_init.py:481
Finding: GitHub Tokens Are Stored in Plaintext and Embedded in Git Clone Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/embed_backends.py:103
Finding: Cross-Provider API-Key Fallback Can Disclose an Unrelated Anthropic Credential
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/embed_backends.py:162
Finding: Private Memory Content Is Sent to External Embedding Providers Without Scope-Level Controls
Content: View full analysis
0: vec = vec / norm all_embeddings.append(vec) ``` ### Technical Analysis The function sends each supplied text batch to the configured OpenAI, SiliconFlow, or Zhipu endpoint. The broader Skill processes user profiles, habits, daily records, long-term records, and permanent memories. No filtering, redaction, destination confirmation, or private-scope exclusion is applied at this transmission boundary. External processing is necessary for hosted embedding providers, but uploading all selected memory text is not the least-privilege design. Users need explicit control over which scopes may leave the device, and a local-only option should be available for private content. ### Attack Path 1. A user creates private memory records containing personal, organizational, or otherwise sensitive information. 2. The user rebuilds or updates the semantic index. 3. Memory content is passed to `get_embeddings`. 4. The function batches the raw text and transmits it to the configured external API. 5. The provider receives and processes the private content under its own retention and logging policies. ### Impact Assessment The affected data can include private profiles, habits, daily activities, decisions, project information, and other memory t ...[truncated 260 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/memory_sync.py:247
Finding: Synchronization Indiscriminately Stages and Uploads All Repository Files
Content: View full analysis
Remediation: View remediation
/...` - Shared scope: only `shared/...` - All scope: the union of approved memory paths 3. Validate the UID before using it to construct a path. 4. Add a defensive `.gitignore` for: - Credential files - Environment files - SQLite databases and WAL files - Conflict backups - Temporary files - Local configuration containing secrets 5. Scan staged files for secret patterns before committing. 6. Show the exact staged path list and require confirmation for newly added or suspicious files. 7. Abort synchronization if staged content falls outside the approved scope. ]]>

T08 · Insecure Dependencies

Warning

Location: install.sh:236
Finding: Installer Uses Unpinned Dependencies Without Integrity Hashes
Content: View full analysis
=1.0.0" "numpy>=1.20.0" --quiet --disable-pip-version-check ``` ```bash pip_run install "lancedb>=0.5.0" --quiet --disable-pip-version-check ``` The requirements file similarly uses broad lower bounds: ```text openai>=1.0.0 numpy>=1.20.0 python-dotenv>=1.0.0 PyYAML>=6.0.1 lancedb>=0.5.0 colorama>=0.4.0 pytest>=7.0.0 pytest-cov>=4.0.0 mypy>=1.0.0 black>=23.0.0 isort>=5.12.0 ``` ### Technical Analysis Lower-bound-only constraints permit any later package release satisfying the version expression. Installation is therefore not reproducible and can retrieve code that did not exist when the Skill was reviewed. No package hashes or signed lock file are enforced. The requirements file also mixes runtime, optional, and development packages. This unnecessarily expands the installation attack surface and grants additional third-party packages execution opportunities during installation and import. No specific dependency in the audited files was proven malicious. The vulnerability is the unsafe dependency-resolution and integrity model. ### Attack Path 1. A dependency maintainer account or package release channel is compromised, or a future release becomes malicious. 2. The attacker publishes a version satisfying the project's broad `>=` constraint. 3. A user runs the installer or installs from `requirements.txt`. 4. `pip` resolves the attacker-controlled release. 5. Package build or installation code executes under the installing user's account. 6. The malicious dependency can access the same local files, credentials, and network resources as the installer process. ### Impact Assessment A compromised dependency can achieve arbitrary code execution with the installer's privil ...[truncated 239 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (144)

Tainted flow: 'uid' from input (line 577, user input) → subprocess.run (code execution)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.
Content: Scanner excerpt · scripts/memory_init.py (reported line 516)May include surrounding context.
python
cwd=repo_dir, capture_output=True, ) if result.returncode != 0: subprocess.run( ["git", "commit", "-m", f"memory(init): 初始化记忆系统 — 用户 {uid}"], cwd=repo_dir, check=True, )

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description claims a full three-layer AI memory management system with semantic search, automatic compression, user identity recognition, and cross-device sync. However, this code chunk is primarily an installer/bootstrap script, not the memory manager implementation itself. It creates directories and config files, installs dependencies, optionally sets up git, and may save API keys and aliases into shell config files—capabilities not declared in the description. While some declared features are referenced via configuration or optional external scripts, they are not actually implemented here. Therefore the supplied code chunk does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The code substantially matches a memory-management CLI with layered memory handling (L1/L2/L3), semantic search, vector index generation, and OpenClaw-oriented user/path configuration. However, two notable declared capabilities are not evidenced here: automatic compression and cross-device synchronization. The OpenClaw-specific identity/config integration is partially supported through environment/config loading and onboard setup, but actual sync behavior is absent. Additionally, the code includes extra operational capabilities not mentioned in the description—file linting, creating new memory templates, and cleanup/archive/purge of files. Those are meaningful capabilities, though still related to memory management rather than unrelated behavior. Overall, the description overstates some core features and omits several implemented management functions, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a full AI memory management system with layered memory handling, semantic search, compression, identity recognition, and sync. The supplied code chunk does not implement a memory system at all; it only provides an embedding backend abstraction for generating text embeddings via OpenAI-compatible APIs. While embeddings could support a larger memory/search system elsewhere, this chunk itself only resolves backend configuration, reads a local config file, fetches API keys from environment variables, makes remote embedding requests, normalizes vectors, and lists backend metadata. This is a materially different and much narrower function than the declared purpose, and it also performs undeclared external API access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a full OpenClaw-specific three-tier memory management system with identity recognition and sync features. The supplied code chunk is much narrower: it provides optional LanceDB connectivity, HNSW indexing, record insertion, vector search, SQLite cache storage for query results, parallel embedding execution, and helper constructors. Although it includes fields like uid, scope, and level and supports semantic vector search, those are metadata/filtering concerns rather than comprehensive L1/L2/L3 memory management. There is no code for temporary/long-term/permanent retention policies, promotion/demotion, memory compression, device sync, or user identification. Therefore the description materially overstates and mischaracterizes what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description claims a comprehensive three-layer memory management system with semantic vector search, compression, identity recognition, and sync. This code chunk only implements a local access log and importance scoring component using SQLite, with CLI operations for recording access, printing reports, and setting/getting importance. It does reference a local .memory_vectors.db to read a stored memory level when computing scores, but it does not perform vector search or broader memory management itself. Therefore the declared description materially overstates and misrepresents the functionality present in this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code does implement part of the declared description: automatic compression of memory files, some handling of L1/L2 structures, theme promotion, and rollback snapshots. However, several key advertised capabilities are absent. There is no vector storage, embedding generation, semantic similarity search, network sync, or device synchronization logic. 'User identity recognition' is only a basic uid argument/environment variable, not OpenClaw identity handling. L3 is not meaningfully managed as a separate storage layer; the script only uses regex tags such as upgrade markers and mostly operates on daily (L1) and weekly (L2) markdown files plus archives. Therefore the declared description materially overstates and misrepresents the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The code does support part of the declared description: it processes three memory levels (L1/L2/L3), creates semantic embeddings, and stores them for later search. However, the declared purpose describes a broader 'three-layer AI memory management system' with automatic compression, OpenClaw user identity recognition, and cross-device sync. None of those capabilities appear in this code chunk. Instead, the chunk is specifically an embedding/indexing utility for markdown memory entries backed by SQLite, plus related-memory and importance-score updates. That is a narrower and materially different scope than the full declared system, so this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code's real function is to read markdown files under a memory repository, extract headings/tags/todos/summaries, and write INDEX.md files for private and shared memory areas. While it does reference L1/L2/L3 concepts and generates 'semantic key' fields, these are just short title truncations rather than vector or embedding-based semantic search. There is no code for synchronization, device communication, identity recognition beyond selecting a user ID, or automatic compression of memories. Thus the declared description materially overstates and misrepresents the implemented capabilities and primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a full-featured three-layer AI memory system with semantic vector search, automatic compression, identity recognition, and cross-device synchronization. The supplied code chunk does not implement those runtime memory features; instead, it primarily initializes repository folders and markdown templates for shared and per-user memory, plus supporting metadata. While the created structure reflects L1/L2/L3 memory concepts and includes files hinting at sync/compression features, the actual code only scaffolds them. It also includes substantial Git/GitHub automation: initializing a git repo, configuring username/email, optionally cloning from GitHub, storing a GitHub token in a git credential helper file, adding remotes, committing, and pushing. Cross-device sync is only indirectly supported via Git setup rather than an explicit memory sync engine. Therefore the declared description materially overstates implemented capabilities and omits important actual behavior, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a comprehensive OpenClaw memory management system with L1/L2/L3 management, semantic vector search, compression, identity recognition, and synchronization. The supplied code chunk is instead a standalone analytics tool (memory_insight.py) that reads from .memory_vectors.db and .memory_access_log.db, analyzes topics/access patterns/recency, generates textual reports, finds knowledge gaps, and can auto-adjust importance_score in the database. While it is related to a memory system and references L1/L2/L3 levels, it does not implement the major declared capabilities. This is a material description-behavior mismatch, with the actual behavior being narrower and different in primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a full AI memory management system with advanced runtime capabilities (three-tier memory management, vector semantic search, auto-compression, OpenClaw identity recognition, and cross-device sync). The supplied code does not implement those features; it only performs initial setup. It creates directories corresponding to layered memory storage and saves configuration, which partially aligns with the memory-system concept, but the primary purpose of this chunk is onboarding. It also includes optional GitHub sync configuration input, yet does not actually perform synchronization. Therefore the description does not accurately represent what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The declared description presents a broad three-layer memory management system with compression, user identity recognition, and cross-device sync. The supplied code chunk only implements search-related functionality over an existing memory vector store: semantic search via embeddings, keyword fallback, statistics display, optional LanceDB index usage/rebuild, backend listing, and access logging. It does support vector semantic search and can filter by memory levels L1/L3, which partially aligns with the description. However, key declared capabilities—automatic compression, user identity recognition, and cross-device synchronization—are not present in this code. Additionally, the code has several actual behaviors not mentioned in the description, such as cache stats, index rebuild, and logging access. Therefore the description does not accurately represent what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive AI memory management system with advanced capabilities such as semantic vector search, automatic compression, identity recognition, and sync. The supplied code only implements a reporting utility: it reads markdown files from expected L1/L2/L3-style folders, computes counts and freshness metrics, formats reports, and optionally writes STATS.md outputs. While it does relate to a three-layer memory directory structure and supports per-user/shared scopes, its actual purpose is narrow statistics generation, not full memory management. Therefore the description materially overstates the behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full memory management system with layered memory storage and higher-level AI features such as semantic vector search, compression, and identity recognition. The supplied code chunk does not implement those functions. Instead, it is specifically a GitHub-based cross-device sync script for a repository: it executes git commands, fetches/pulls/rebases/merges, commits and pushes local changes, prints repo status, and handles merge conflicts. Cross-device sync is one overlapping feature, but it is only a subset of the declared purpose. The primary behavior of this code is repository synchronization, not memory management across L1/L2/L3 or semantic retrieval/compression. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a substantial memory-management system with multiple advanced capabilities. However, the provided code chunk is only a minimal tests/init.py file containing a comment and no executable logic. Based on this supplied chunk, none of the declared capabilities are represented. This is therefore a material mismatch between the declared purpose and the actual code shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code does not implement the declared memory-management system features. Instead, it is a test suite for a narrower access-log subsystem: database initialization, access counting, manual importance assignment, and importance score calculation. While this may relate to memory management support infrastructure, the actual code chunk neither manages L1/L2/L3 memory stores directly nor shows vector search, compression, user identity recognition, or cross-device sync. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full-featured OpenClaw memory management system. However, the supplied code is only a test module. Its actual function is to run unit tests for cosine similarity and database connection helpers in another module. While cosine similarity testing loosely relates to vector search and database checks may support persistence, this chunk itself does not implement the described memory layers, semantic search system, compression, identity recognition, or synchronization. The primary purpose is materially different from the declared purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a production memory-management skill with multiple memory tiers and advanced capabilities. The supplied code chunk does not implement any of those behaviors. Instead, it is a standalone test orchestrator that executes test files and summarizes results. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L003 的技能描述明确限定为“OpenClaw专用”，且全文自然语言说明与命令触发均固定为中文，没有提供语言切换、用户偏好选择或地区合规理由。根据规则，强制单一语言而无用户 opt-in 属于自然语言/locale 政策问题。
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The help text includes a curl ... | bash installation example that encourages unsafe execution of unaudited remote code. Because this installer persists configuration and can store secrets, normalizing this pattern increases the likelihood of users exposing themselves to a high-impact supply-chain attack.
Content: Scanner excerpt · install.sh (reported line 88)May include surrounding context.
sh
${BOLD}示例:${NC} $0 -u john -b siliconflow curl -fsSL https://.../install.sh | bash EOF }

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The explicit | bash chaining pattern is dangerous because it executes network-fetched content immediately in a shell, bypassing inspection and making compromise of the hosting source instantly exploitable. This is more concerning here because the installer performs persistent system changes and interacts with credentials, amplifying the consequences of a malicious or tampered payload.
Content: Scanner excerpt · install.sh (reported line 88)May include surrounding context.
sh
${BOLD}示例:${NC} $0 -u john -b siliconflow curl -fsSL https://.../install.sh | bash EOF }

Lp1

High

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The script reads sensitive environment variables, including model API keys and user/path settings, but the finding indicates this capability is not declared in permissions. In an agent-skill ecosystem, undeclared environment access weakens transparency and can expose secrets or expand the skill's effective privileges beyond what users expect.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The search method constructs uid/scope/level filter conditions but never applies them to the LanceDB query, so searches may return records outside the caller's intended user or scope boundaries. In a memory-management system handling per-user and cross-device data, this can cause unauthorized disclosure of another user's memories or data from the wrong isolation scope.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memory_init.py (reported line 375)May include surrounding context.
python
__pycache__/ *.pyc *.pyo .env # 编辑器 .vscode/