ClawHub
Back to skill

Security audit

Memory Memoria

Security checks for vulnerabilities and agentic risk

Overview

This durable memory skill is mostly coherent, but it asks users to install and enable an unpinned third-party plugin and includes an executable setup example with weak root database credentials.

Review before installing. Use a pinned and verified plugin version if possible, avoid copying the root:111 database example, create a dedicated least-privilege database account with a strong secret, and do not store credentials or other sensitive data in durable memory unless you deliberately accept the persistence risk. For forget, purge, rollback, and merge operations, ask the agent to preview the target records and confirm before applying changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/setup.md:8
Finding

Unpinned Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:56-59; references/setup.md:8-9
Vulnerability Type: Supply-chain risk from an unpinned external dependency
Risk Level: Medium

Complete Code Snippet (SKILL.md:56-59):

bash
openclaw plugins install @matrixorigin/memory-memoria
openclaw plugins enable memory-memoria
openclaw memoria install
openclaw memoria verify

Complete Code Snippet (references/setup.md:8-9):

bash
openclaw plugins install @matrixorigin/memory-memoria
openclaw plugins enable memory-memoria

Technical Analysis

The installation instructions identify the external package only by name and do not specify an exact audited version, integrity hash, lockfile, or trusted registry endpoint. Consequently, the installed artifact can change without any corresponding modification to this Skill.

The package scope is consistent with the declared MatrixOrigin project, and the reviewed files contain no evidence of dependency confusion or typosquatting. Nevertheless, resolving an unpinned package makes the effective code dependent on the package registry's state at installation time. A compromised publisher account, registry incident, or unsafe future release could therefore introduce code that was not part of this audit.

Because the instructions immediately enable the installed plugin, any malicious package behavior could execute in the OpenClaw environment with the plugin process's permissions.

Attack Path

  1. An attacker compromises the package publisher, registry account, distribution channel, or upstream release process.
  2. The attacker publishes a malicious version under @matrixorigin/memory-memoria.
  3. A user follows the documented unversioned installation command.
  4. The package manager resolves and installs the attacker-controlled release.
  5. The user enables the plugin as instructed.
  6. Malicious plugin code executes with the privileges and data acc ...[truncated 664 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an exact version that has been independently reviewed, rather than resolving the latest available release.
  2. Document the expected package integrity hash and require verification before installation and enablement.
  3. Use an explicit trusted registry and reject unexpected registry overrides.
  4. Maintain a lockfile or equivalent immutable dependency manifest where supported.
  5. Separate installation from enablement so administrators can inspect the resolved artifact before execution.
  6. Verify package provenance through signed releases, registry provenance attestations, or a software bill of materials.
  7. Run the plugin with least privilege and restrict its filesystem, credential, database, and network access to reduce the impact of a compromised release.

T09 · Insecure Skill Coding Practices

Warning
Location
references/setup.md:11
Finding

Weak Privileged Database Credential in Executable Setup Example

Content
View full analysis

Vulnerability Details

File Location: references/setup.md:11
Vulnerability Type: Weak hardcoded example credential and excessive database privilege
Risk Level: Medium

Complete Code Snippet (references/setup.md:11-16):

bash
MEMORIA_DB_URL='mysql://root:111@127.0.0.1:6001/memoria' \
MEMORIA_EMBEDDING_PROVIDER='openai' \
MEMORIA_EMBEDDING_MODEL='text-embedding-3-small' \
MEMORIA_EMBEDDING_API_KEY='sk-...' \
MEMORIA_EMBEDDING_DIM='1536' \
openclaw memoria install

Technical Analysis

The documented command uses the privileged MySQL root account with the literal password 111. Although the value appears in setup documentation rather than application source code, the block is presented as an executable command and may be copied without modification.

This configuration violates two security principles:

  • The password is trivially guessable and unsuitable for protecting a database account.
  • The database root account grants substantially more authority than a memory plugin normally requires, violating least privilege.

The host is configured as 127.0.0.1, which reduces direct remote exposure if the database remains bound exclusively to the loopback interface. It does not protect against local users, compromised local services, container-network exposure, configuration changes, credential disclosure through process environments, or users reusing the example in a remotely accessible deployment.

Attack Path

  1. An administrator copies the setup example without replacing the database username and password.
  2. Memoria is configured to authenticate as database root using the password 111.
  3. An attacker obtains connectivity to port 6001, compromises another local process, or otherwise reaches the database endpoint.
  4. The attacker authenticates using the documented credentials.
  5. The attacker exercises root-level database privileges to read, alter, or delete memory data and any ...[truncated 1120 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the literal credential with explicit placeholders that cannot be mistaken for production-ready values, such as MEMORIA_DB_USER and MEMORIA_DB_PASSWORD.
  2. Instruct administrators to generate a cryptographically random, unique password with sufficient entropy.
  3. Create a dedicated Memoria database account instead of using root.
  4. Grant that account access only to the required schema and only the specific operations needed for installation and normal runtime.
  5. Separate migration privileges from runtime privileges if schema creation or migration requires elevated access.
  6. Supply credentials through a protected secret manager or restricted configuration file rather than embedding them in reusable shell commands.
  7. Prevent secrets from being written to shell history, logs, diagnostics, or process listings.
  8. Keep the database bound to a trusted interface, enforce firewall restrictions, and use encrypted authenticated connections where traffic can cross a trust boundary.
  9. Add setup validation that rejects default, weak, or known example credentials and warns when an administrative database account is configured.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very common conversational phrases such as "remember this," "what do you remember," and "continue from last time," which can cause the skill to activate during ordinary discussion rather than only when the user explicitly intends to use the memory system. In a durable-memory skill, unintended activation is more dangerous than usual because it can lead to unplanned storage, retrieval, correction, or deletion of persistent data across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guidance explicitly permits storing secrets in durable memory if the user asks, but it does not require a privacy warning, data minimization, retention limit, or confirmation that long-term storage is appropriate. Because this skill is specifically designed for cross-session memory, storing secrets can create unnecessary persistence of sensitive data and increase exposure if memory is later retrieved, searched, or accessed in unrelated contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The pattern guidance recommends destructive memory operations such as memory_forget, memory_purge, memory_correct, rollback, merge, and cleanup without explicitly warning about irreversibility, confirmation requirements, or the risk of deleting still-useful durable context. In a long-term memory skill, unclear safeguards around mutation/deletion increase the chance of accidental data loss or integrity damage from user misunderstanding, prompt ambiguity, or unsafe automation.

Content

No source excerpt is available for this finding.