Memori

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:18 PM UTC
• Version: 1.0.10

Overview

This skill clearly describes a cloud-backed long-term memory plugin, with some credential and data-handling cautions users should understand before enabling it.

Install only if you want OpenClaw session content, tool-use history, and related memory data stored by Memori after configuration. Prefer pinning the plugin to a reviewed version, keep projectId/entityId scopes narrow, avoid printing MEMORI_API_KEY, and review Memori's privacy and retention controls before enabling automatic memory capture.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62
• Finding: Unpinned Third-Party Plugin Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 62-66 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ```bash ## Installation ```bash openclaw plugins install @memorilabs/openclaw-memori ``` ``` ### Technical Analysis The documented installation command references an npm package without an exact version or integrity digest. Consequently, the package registry can resolve the command to a release that differs from the version originally reviewed. The actual plugin source is not included in the audited project, so its behavior cannot be verified from this artifact. This does not establish that the current package is malicious. However, a compromised publisher account, package registry, or future release could change the effective plugin payload after this skill has been reviewed. Because an OpenClaw plugin executes as code rather than passive content, a compromised release could perform operations available to the OpenClaw process. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, or a future package release. 2. The attacker publishes a modified version of `@memorilabs/openclaw-memori`. 3. A user follows the skill documentation and executes the unpinned installation command. 4. The package manager resolves the package name to the attacker-controlled release. 5. OpenClaw installs and loads the modified plugin. 6. The malicious plugin executes with the filesystem, environment, network, and application privileges granted to the OpenClaw process. ### Impact Assessment Successful exploitation could permit arbitrary behavior within the privileges of the OpenClaw process. Depending on the host configuration, this may include reading accessible configuration and environment variables, accessing conversation data, making outbound network requests, modifying user-accessible files, or interfering with agent operations. The issue doe ...[truncated 116 chars]
• Remediation: ## Remediation Suggestions - Pin the plugin to an exact, reviewed version rather than installing the mutable latest release: ```bash openclaw plugins install @memorilabs/openclaw-memori@<exact-reviewed-version> ``` - Publish and verify the expected package integrity digest before installation. - Ensure the package contents correspond to a reviewed source commit and signed release. - Use lockfiles or equivalent dependency controls where supported. - Monitor the package for ownership changes, unexpected releases, and registry compromise. - Run the plugin with least privilege, restricting filesystem access, environment-variable access, and outbound network destinations where the platform supports sandboxing.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:184
• Finding: API Key Exposure Through Troubleshooting Command## Vulnerability Details **File Location**: `SKILL.md`, lines 184-188 **Vulnerability Type**: Plaintext secret disclosure **Risk Level**: Low ```bash **Plugin not loading:** - Verify `enabled: true` in openclaw.json - Check API key: `echo $MEMORI_API_KEY` - Restart gateway: `openclaw gateway restart` ``` ### Technical Analysis The troubleshooting guidance instructs users to print the complete `MEMORI_API_KEY` value to the terminal. Verifying whether an environment variable is configured does not require revealing its value. Terminal output may be retained in session recordings, CI logs, diagnostic captures, screen-sharing sessions, copied support transcripts, or other monitoring systems. The shell command itself does not transmit the key to an attacker. Exploitation requires another party to obtain the resulting terminal output. Nevertheless, unnecessarily rendering a credential in plaintext increases the likelihood of accidental disclosure. ### Attack Path 1. A user encounters a plugin-loading problem and follows the troubleshooting instructions. 2. The user executes `echo $MEMORI_API_KEY`. 3. The complete API key is displayed in plaintext. 4. The terminal output is captured by logging or recording software, exposed during screen sharing, copied into a support request, or observed by another person. 5. An unauthorized party extracts the API key from that output. 6. The party uses the credential against the Memori service, subject to the permissions and controls associated with that key. ### Impact Assessment An exposed key may allow unauthorized use of the associated Memori service account or project within the key's granted permissions. Potential consequences include quota consumption and unauthorized access to service operations or data available to that credential. Exact privileges cannot be determined from `SKILL.md` and depend on the provider's API authorization model. This finding does not imply local pri ...[truncated 18 chars]
• Remediation: ## Remediation Suggestions Replace the secret-printing command with a presence-only check: ```bash if [ -n "$MEMORI_API_KEY" ]; then echo "MEMORI_API_KEY is set" else echo "MEMORI_API_KEY is not set" fi ``` Additional hardening measures: - Never request complete API keys in support tickets, logs, screenshots, or diagnostic bundles. - If identification is necessary, display only a small masked suffix after confirming that the provider considers this safe. - Redact credentials from terminal recordings and automated diagnostics. - Document immediate key revocation and rotation procedures for suspected exposure. - Prefer a dedicated CLI status command that validates authentication without displaying the credential.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest presents the plugin as a memory structuring/recall skill, but the documentation also grants capabilities for account signup and quota management. Understating the functional scope of an agent skill is dangerous because users and reviewers may authorize or install it without understanding that it can initiate account-related or service-management actions.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: An account-creation capability is not necessary for the core purpose of a memory skill and expands the plugin's effective authority into external account lifecycle actions. This can be abused for social engineering or unintended registration flows, especially in agentic contexts where users may not expect a memory plugin to request identity information like email addresses.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The skill claims that no data is captured or transmitted unless the user provides credentials, yet elsewhere documents agent-accessible signup and quota tools that extend beyond memory recall. This creates a capability/consent mismatch that can mislead users and integrators about what the agent may do, increasing the risk of unintended external actions or data exposure workflows.

Static analysis

No suspicious patterns detected.