T03 · Remote Payload Retrieval and Execution
Error
- Location
references/setup.md:27- Finding
Mutable Remote Installer Is Executed Directly Through a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Memoria
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent durable-memory skill, but its setup instructions include unsafe unverified remote execution and unpinned plugin/source installs.
Before installing, prefer a pinned package version or a signed, checksum-verified release. Avoid running the documented curl-to-bash local installer as written, and treat any Memoria API or embedding key as a secret. Also review what categories of information you want stored durably, because this skill is designed to remember user and project context across sessions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/setup.md:6- Finding
Plugin and Source Installation Use Unpinned Executable Dependencies
- Content
View full analysis
--api-key ``` From `references/setup.md:28`: ```bash openclaw plugins install @matrixorigin/thememoria ``` ### Technical Analysis The package installation commands do not pin `@matrixorigin/thememoria` to an exact reviewed version or state an expected integrity digest. Consequently, installation may resolve to whatever release is current when the command is run rather than the release reviewed with this Skill. The source fallback clones the repository's default branch without selecting a full immutable commit hash. It then links the cloned plugin directly into OpenClaw. This creates an executable supply-chain boundary: changes made to the upstream package or repository after the audit can become active plugin code in the local OpenClaw environment. The package namespace and GitHub organization are consistent with the declared Memoria project, and the audited files provide no evidence of typosquatting or a deliberately malicious dependency. The risk arises from trusting mutable upstream content rather than from a demonstrated malicious package. ### Attack Path 1. An attacker compromises the package registry account, upstream repository, maintainer credentials, or publication pipeline. 2. The attacker publishes a malicious package version or modifies the repository's default branch. 3. A user runs the unver ...[truncated 1079 chars]- Remediation
View remediation
`, using the package manager's supported syntax. 2. Enforce package integrity through a lockfile or an expected registry integrity hash. 3. For source installation, check out a full immutable commit hash rather than relying on the repository's default branch. 4. Prefer signed release tags and verify the signature before installation. 5. Record the expected package version, source commit, and checksum in the Skill documentation. 6. Review dependency lockfiles and installation lifecycle scripts for the pinned plugin release. 7. Disable unnecessary package lifecycle scripts where supported, or document why they are required. 8. Run OpenClaw and its plugins with least privilege, restricted filesystem access, and constrained network access. 9. Require explicit review and version updates when moving to a newer package or source revision. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to store durable user preferences, profile facts, project decisions, and learned facts, but it does not require any notice, consent, or confirmation that this information will persist across sessions. This creates a privacy and data-minimization risk because users may disclose sensitive personal or project information without understanding it is being retained long-term, and the broad categories encouraged by the skill increase the chance of over-collection.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
If the npm package is unavailable, install from source:
bash mkdir -p ~/.openclaw/plugins-src git clone https://github.com/matrixorigin/Memoria.git ~/.openclaw/plugins-src/Memoria openclaw plugins install --link ~/.openclaw/plugins-src/Memoria/plugins/openclaw openclaw memoria setup --mode cloud --api-url <MEMORIA_API_URL> --api-key <API_KEY>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions tell users to execute a remote script directly with
curl ... | bash, which is a dangerous software supply-chain pattern because the fetched content can change at any time and executes immediately without inspection or integrity verification. In a setup guide for a memory plugin, this is more dangerous because users are likely to run the command during installation with little scrutiny, potentially leading to arbitrary code execution on the host.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The setup guide instructs users to provide API keys but gives no guidance on safe credential handling, increasing the risk of users exposing secrets via shell history, screenshots, shared terminals, or committed config files. In this plugin context, those keys may grant access to long-term memory or backend services, so disclosure could expose stored data or allow unauthorized service use.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Fetching an external script from GitHub and piping it directly to
bashallows unreviewed remote content to execute immediately on the user's machine. The skill context makes this more dangerous because it is presented as routine installation guidance for a plugin, which creates a strong social-engineering path for users to run arbitrary code under their own account.- Content
Local Install (Embedded)
bash curl -sSL https://raw.githubusercontent.com/matrixorigin/Memoria/main/scripts/install.sh | bash -s -- -y -d ~/.local/bin openclaw plugins install @matrixorigin/thememoria openclaw memoria setup --mode local --install-memoria --embedding-api-key <EMBEDDING_API_KEY> openclaw memoria health