Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- plugin.mjs:100
- Evidence
if ((env || process.env).AGENTMEMORY_REQUIRE_HTTPS === "1") throw new Error(message);
Security audit
agentmemory
Security checks across malware telemetry and agentic risk
Overview
This plugin is a disclosed long-term memory integration that stores recent conversation turns in a configured agentmemory server, with no hidden install script or unrelated behavior found.
Install only if you want OpenClaw conversations to be saved into agentmemory for later recall. Keep the default localhost server unless you intentionally trust a remote memory endpoint, and use HTTPS or a tunnel if AGENTMEMORY_SECRET or private conversation content will cross a network.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access