Install memex for OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:21 AM UTC
• Version: 3.0.0

Overview

The skill is openly trying to install local memory for OpenClaw, but it also creates a persistent session-capture service and installs mutable third-party code with limited user control.

Install only if you are comfortable with a user-level background service continuously indexing OpenClaw conversations into ~/.memex/data/memex.db. Prefer a pinned, verified memex-mvp version, review the service file before enabling it, confirm any shell rc PATH changes, and make sure you have clear disable, uninstall, and data-deletion steps.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:179

Finding

Persistent Background Session-Capture Service

Content

View full analysis

/tmp/memex.log 2>&1 &` — works but won't auto-restart on reboot. | If `loginctl enable-linger` needs sudo, the install output prints the exact command. **Tell the user that line verbatim** — don't try to sudo yourself. ``` ### Technical Analysis The Skill instructs the agent to register `memex-sync` as a macOS LaunchAgent or an enabled systemd user service. On Linux, it also attempts to enable user lingering so the service continues running after SSH logout. These actions establish deliberate cross-session persistence. A continuously running watcher is related to the advertised automatic session-capture functionality. However, service registration, automatic startup, and login lingering exceed the privileges and lifetime needed for one-time installation, session backfill, or on-demand search. The instructions do not require separate, explicit consent immediately before persistence is enabled. The daemon continuously reads OpenClaw session files and writes them into `~/.memex/data/memex.db`. Consequently, any compromise of the installed package would inherit recurring access to future OpenClaw conversations. ### Attack Path 1. A user invokes the Skill to configure memex for OpenClaw. 2. The Skill installs or locates t ...[truncated 1175 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:154

Finding

Mutable Global npm Dependency Installed Without Integrity Verification

Content

View full analysis

> ~/.zshrc 2>/dev/null echo 'export PATH=$HOME/.npm-global/bin:$PATH' >> ~/.bashrc 2>/dev/null export PATH=$HOME/.npm-global/bin:$PATH npm install -g memex-mvp@latest ``` ### Technical Analysis The Skill installs `memex-mvp@latest`, a mutable npm release identifier, without an exact version, lockfile, integrity digest, signature verification, or bundled reviewed source. The effective code installed during execution can therefore differ from the code available when the Skill was audited. npm installation can execute package lifecycle scripts with the invoking user's permissions. The package is installed globally, or into a user-controlled global prefix that is then added to shell startup files. This makes its executables broadly available in later shell sessions. The audit only included `SKILL.md`; the implementation of `memex-mvp` was not present. As a result, the Skill's assertion that the runtime performs no outbound network traffic cannot be independently verified from the reviewed artifact. ### Attack Path 1. The user invokes the Skill when memex is absent or considered outdated. 2. npm resolves the mutable `latest` tag at execution time. 3. A compromised registry account, maintainer account, package release, or upstream dependency supplies malicious code. 4. npm downloads and installs that code, potentially executing lifecycle scripts under the user's account. 5. The installed executable is placed in the global npm prefix or `~/.npm-global/bin`. 6. In the fallback path, that directory is appended to `.zshrc` and `.bashrc`, exposing the executable in subsequent shells. 7. The Skill then regis ...[truncated 775 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

plugin detected — will uninstall first"

---

Step 2 — Install memex-mvp (skip if already at ≥ 0.11.6)

sh

npm install -g memex-mvp@latest

If EACCES (no permission to write to npm global prefix), apply the standard fix — never use sudo:

sh

mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
echo 'export PATH=$HOME/.npm-global/bin:$PATH' >> ~/.zshrc 2>/dev/null
echo 'export PATH=$HOME/.npm-global/bin:$PATH' >> ~/.bashrc 2>/dev/null
export PATH=$HOME/.npm-global/bin:$PATH
npm install -g memex-mvp@latest

Verify:

sh

memex --version    # must print 0.11.6 or later

---

Step 3 — Install the auto-capture daemon (skip if already running)

sh

memex-sync install

Platform-specific behavior (handled automatically by memex-sync):

Platform	What memex-sync install does
macOS (uname -s = Darwin)	Writes ~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist, runs launchctl load. Daemon auto-starts on ever

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 418)May include surrounding context.

md

## What this skill explicitly does NOT do

- ❌ Install Node.js (manual step if needed — print instructions, don't auto-install)
- ❌ Use sudo. Ever. If permissions block something, surface the manual fix and stop.
- ❌ Install the deprecated `@parallelclaw/memex-openclaw` plugin. The daemon path supersedes it.
- ❌ Overwrite existing `mcp.servers` entries. Merge.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The skill explicitly installs a background daemon that continuously captures every OpenClaw session into a local SQLite corpus and wires retrieval tools into the agent. This creates durable session persistence containing potentially sensitive prompts, outputs, and context, and materially changes the host's privacy and retention posture.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: install-memex-claw
description: Wire memex (the local-first MCP memory server) into an OpenClaw gateway — works wherever OpenClaw runs (Linux or macOS, VPS or workstation, self-hosted OpenClaw or Moonshot Kimi-Claw). Installs the memex-mvp daemon that auto-captures every OpenClaw session in ~/.openclaw/agents/main/sessions/ into a single SQLite + FTS5 corpus, and merges memex into the gateway's MCP-server config so the LLM gets 11 search/retrieval tools (memex_search, memex_recent, memex_overview, etc.). Auto-detects whether memex-mvp is already installed (e.g. via the generic install-memex skill for Claude Code) — if yes, skips install and just wires OpenClaw + back-fills past sessions; if no, does the full platform-aware install (Linux → systemd user-service, macOS → LaunchAgent). Zero questions to the user — discovery → actions → verification. Use when the user says "set up memex for OpenClaw", "wire memex into my OpenClaw", "make OpenClaw remember its sessions", "поставь memex здесь", or similar. PAIRS with the generic install-memex skill — if the user ALSO uses Claude Code, Cursor, Cline, Continue, or Zed on the same machine, recommend they run install-memex separately for those flows.
version: 3.0.0
metadata:
  openclaw:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description lists several specific phrases but then adds 'or similar,' which leaves the activation boundary undefined. In a markdown skill description, this kind of open-ended trigger scope can cause unintended invocation from loosely related user requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

Installing a LaunchAgent on macOS establishes automatic execution on login and continuous session monitoring. This is a legitimate persistence mechanism for the advertised feature, but it is still security-relevant because it affects ongoing execution and data retention.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

| Action | Why | Source |
|---|---|---|
| `npm install -g memex-mvp@latest` | Install the MCP server + the auto-capture daemon. Open-source MIT. **Skipped if already installed.** | [npmjs.com/package/memex-mvp](https://www.npmjs.com/package/memex-mvp), source: [github.com/parallelclaw/memex-mvp](https://github.com/parallelclaw/memex-mvp) |
| `memex-sync install` | Register the auto-capture daemon — systemd user-service on Linux, LaunchAgent on macOS. The daemon watches `~/.openclaw/agents/main/sessions/` and writes to `~/.memex/data/memex.db`. **Zero outbound network traffic.** **Skipped if daemon already running.** | LaunchAgent at `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist` or systemd unit at `~/.config/systemd/user/memex-sync.service` — both human-readable |
| `loginctl enable-linger $USER` (Linux only) | Without linger, user-systemd dies on SSH logout — daemon would stop between SSH sessions on a VPS. Skill tries this; if sudo needed, prints command and continues. | Standard systemd-user practice |
| Edit OpenClaw config at `~/.openclaw/openclaw.json` | Add a single `memex` entry under `mcp.servers`. **Merge, never overwrite** other entries. | The OpenClaw gateway reads this file at startup |
| `memex-sync scan` | One-shot back-fill of past OpenClaw sessions. Walks the sessions dir, parses each `<uuid>.jsonl`, writes to memex.db with `source='openclaw'`. Filters internal-state noise files (`.checkpoint.`, `.trajectory.`, `.reset.`). | `lib/ingest-file.js` in the source — open-source |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

|---|---|---|
| `npm install -g memex-mvp@latest` | Install the MCP server + the auto-capture daemon. Open-source MIT. **Skipped if already installed.** | [npmjs.com/package/memex-mvp](https://www.npmjs.com/package/memex-mvp), source: [github.com/parallelclaw/memex-mvp](https://github.com/parallelclaw/memex-mvp) |
| `memex-sync install` | Register the auto-capture daemon — systemd user-service on Linux, LaunchAgent on macOS. The daemon watches `~/.openclaw/agents/main/sessions/` and writes to `~/.memex/data/memex.db`. **Zero outbound network traffic.** **Skipped if daemon already running.** | LaunchAgent at `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist` or systemd unit at `~/.config/systemd/user/memex-sync.service` — both human-readable |
| `loginctl enable-linger $USER` (Linux only) | Without linger, user-systemd dies on SSH logout — daemon would stop between SSH sessions on a VPS. Skill tries this; if sudo needed, prints command and continues. | Standard systemd-user practice |
| Edit OpenClaw config at `~/.openclaw/openclaw.json` | Add a single `memex` entry under `mcp.servers`. **Merge, never overwrite** other entries. | The OpenClaw gateway reads this file at startup |
| `memex-sync scan` | One-shot back-fill of past OpenClaw sessions. Walks the sessions dir, parses each `<uuid>.jsonl`, writes to memex.db with `source='openclaw'`. Filters internal-state noise files (`.checkpoint.`, `.trajectory.`, `.reset.`). | `lib/ingest-file.js` in the source — open-source |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

|---|---|---|
| `npm install -g memex-mvp@latest` | Install the MCP server + the auto-capture daemon. Open-source MIT. **Skipped if already installed.** | [npmjs.com/package/memex-mvp](https://www.npmjs.com/package/memex-mvp), source: [github.com/parallelclaw/memex-mvp](https://github.com/parallelclaw/memex-mvp) |
| `memex-sync install` | Register the auto-capture daemon — systemd user-service on Linux, LaunchAgent on macOS. The daemon watches `~/.openclaw/agents/main/sessions/` and writes to `~/.memex/data/memex.db`. **Zero outbound network traffic.** **Skipped if daemon already running.** | LaunchAgent at `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist` or systemd unit at `~/.config/systemd/user/memex-sync.service` — both human-readable |
| `loginctl enable-linger $USER` (Linux only) | Without linger, user-systemd dies on SSH logout — daemon would stop between SSH sessions on a VPS. Skill tries this; if sudo needed, prints command and continues. | Standard systemd-user practice |
| Edit OpenClaw config at `~/.openclaw/openclaw.json` | Add a single `memex` entry under `mcp.servers`. **Merge, never overwrite** other entries. | The OpenClaw gateway reads this file at startup |
| `memex-sync scan` | One-shot back-fill of past OpenClaw sessions. Walks the sessions dir, parses each `<uuid>.jsonl`, writes to memex.db with `source='openclaw'`. Filters internal-state noise files (`.checkpoint.`, `.trajectory.`, `.reset.`). | `lib/ingest-file.js` in the source — open-source |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 433)May include surrounding context.

md

|---|---|---|
| `npm install -g memex-mvp@latest` | Install the MCP server + the auto-capture daemon. Open-source MIT. **Skipped if already installed.** | [npmjs.com/package/memex-mvp](https://www.npmjs.com/package/memex-mvp), source: [github.com/parallelclaw/memex-mvp](https://github.com/parallelclaw/memex-mvp) |
| `memex-sync install` | Register the auto-capture daemon — systemd user-service on Linux, LaunchAgent on macOS. The daemon watches `~/.openclaw/agents/main/sessions/` and writes to `~/.memex/data/memex.db`. **Zero outbound network traffic.** **Skipped if daemon already running.** | LaunchAgent at `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist` or systemd unit at `~/.config/systemd/user/memex-sync.service` — both human-readable |
| `loginctl enable-linger $USER` (Linux only) | Without linger, user-systemd dies on SSH logout — daemon would stop between SSH sessions on a VPS. Skill tries this; if sudo needed, prints command and continues. | Standard systemd-user practice |
| Edit OpenClaw config at `~/.openclaw/openclaw.json` | Add a single `memex` entry under `mcp.servers`. **Merge, never overwrite** other entries. | The OpenClaw gateway reads this file at startup |
| `memex-sync scan` | One-shot back-fill of past OpenClaw sessions. Walks the sessions dir, parses each `<uuid>.jsonl`, writes to memex.db with `source='openclaw'`. Filters internal-state noise files (`.checkpoint.`, `.trajectory.`, `.reset.`). | `lib/ingest-file.js` in the source — open-source |

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

Listing the OpenClaw gateway config path reveals the presence, metadata, and potentially permissions of sensitive local configuration files. In combination with other discovery steps, this contributes to environment reconnaissance beyond strict necessity and may leak operational details to the agent or logs.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

|| echo "macOS or no-systemd"

# 8. OpenClaw gateway config
ls -la ~/.openclaw/openclaw.json 2>&1

# 9. Was the deprecated memex-openclaw plugin previously installed?
ls -la ~/.openclaw/npm/node_modules/@parallelclaw/memex-openclaw 2>/dev/null \

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

Enumerating whether a deprecated plugin exists under the user's OpenClaw npm tree discloses installed components and filesystem structure. While scoped to the user's home directory, it still expands host fingerprinting and should be minimized in an agent skill that already intends to modify configuration.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

ls -la ~/.openclaw/openclaw.json 2>&1

9. Was the deprecated memex-openclaw plugin previously installed?

ls -la ~/.openclaw/npm/node_modules/@parallelclaw/memex-openclaw 2>/dev/null
|| echo "no old plugin"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The fallback to 'nohup memex-sync &' starts a long-lived background process detached from the current shell. This is a persistence mechanism that continues data capture without an active user session and should be treated as security-sensitive even if intended for convenience.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

| **memex installed but < 0.11.6** | Upgrade in-place: `npm install -g memex-mvp@latest`. Continue (daemon auto-restarts if running). |
| **memex installed, daemon not running** | Run `memex-sync install` (Step 3). Skip the npm install. |
| **memex not installed** | Full path: Step 2 (install) → Step 3 (daemon) → Step 4 (back-fill) → Step 5 (wire) → Step 6 (restart). |
| **Linux without systemd** (e.g. minimal container) | Fall back to `nohup memex-sync &`. Tell user the auto-restart limitation. |
| **No openclaw.json** | Ask the user (ONE question allowed): "Where does your OpenClaw gateway store its config?" — proceed with their answer. |

Report each result back as **facts, not questions**:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

Appending a new npm-global bin path to ~/.zshrc and ~/.bashrc persists environment changes across future shells. Persistence in shell startup files can alter command resolution and user environment long after the skill finishes, so it should not occur silently in a 'zero questions' flow.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

npm install -g memex-mvp@latest

text

If `EACCES` (no permission to write to npm global prefix), apply the standard fix — **never use sudo**:

```sh
mkdir -p ~/.npm-global

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

Writing a plist into ~/Library/LaunchAgents is itself a persistence action. In context, it is not malware-like, but it still creates a durable autostart mechanism for a data-capturing process.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

| Platform | What `memex-sync install` does |
|---|---|
| **macOS** (`uname -s` = Darwin) | Writes `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist`, runs `launchctl load`. Daemon auto-starts on every login. |
| **Linux + systemd-user** | Writes `~/.config/systemd/user/memex-sync.service`, runs `systemctl --user daemon-reload && enable && start`. Tries `loginctl enable-linger $USER` so daemon survives SSH logout. |
| **Linux without systemd** | Exits with "systemctl --user not available". Fall back: `nohup memex-sync > /tmp/memex.log 2>&1 &` — works but won't auto-restart on reboot. |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

Writing a plist into ~/Library/LaunchAgents is itself a persistence action. In context, it is not malware-like, but it still creates a durable autostart mechanism for a data-capturing process.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

| Platform | What `memex-sync install` does |
|---|---|
| **macOS** (`uname -s` = Darwin) | Writes `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist`, runs `launchctl load`. Daemon auto-starts on every login. |
| **Linux + systemd-user** | Writes `~/.config/systemd/user/memex-sync.service`, runs `systemctl --user daemon-reload && enable && start`. Tries `loginctl enable-linger $USER` so daemon survives SSH logout. |
| **Linux without systemd** | Exits with "systemctl --user not available". Fall back: `nohup memex-sync > /tmp/memex.log 2>&1 &` — works but won't auto-restart on reboot. |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

Creating and enabling a user-level systemd service establishes persistence across sessions and potentially across reboots. Even if intended for legitimate functionality, persistence mechanisms are security-relevant because they keep software running continuously and can expand the window for data collection or misuse.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

| Platform | What `memex-sync install` does |
|---|---|
| **macOS** (`uname -s` = Darwin) | Writes `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist`, runs `launchctl load`. Daemon auto-starts on every login. |
| **Linux + systemd-user** | Writes `~/.config/systemd/user/memex-sync.service`, runs `systemctl --user daemon-reload && enable && start`. Tries `loginctl enable-linger $USER` so daemon survives SSH logout. |
| **Linux without systemd** | Exits with "systemctl --user not available". Fall back: `nohup memex-sync > /tmp/memex.log 2>&1 &` — works but won't auto-restart on reboot. |

If `loginctl enable-linger` needs sudo, the install output prints the exact command. **Tell the user that line verbatim** — don't try to sudo yourself.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The nohup fallback is again an explicit persistence path. Backgrounding a monitoring daemon outside a service manager reduces visibility and control while still enabling continuous capture of future sessions.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

|---|---|
| **macOS** (`uname -s` = Darwin) | Writes `~/Library/LaunchAgents/com.parallelclaw.memex.sync.plist`, runs `launchctl load`. Daemon auto-starts on every login. |
| **Linux + systemd-user** | Writes `~/.config/systemd/user/memex-sync.service`, runs `systemctl --user daemon-reload && enable && start`. Tries `loginctl enable-linger $USER` so daemon survives SSH logout. |
| **Linux without systemd** | Exits with "systemctl --user not available". Fall back: `nohup memex-sync > /tmp/memex.log 2>&1 &` — works but won't auto-restart on reboot. |

If `loginctl enable-linger` needs sudo, the install output prints the exact command. **Tell the user that line verbatim** — don't try to sudo yourself.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 442)May include surrounding context.

md

## Safety rules — read before starting

- Never sudo. Never edit system files. Never modify `$PATH` outside `~/.zshrc` / `~/.bashrc` with the user's consent.
- Always confirm before deleting anything from the user's machine.
- Always preserve existing config keys when editing JSON.
- Print every shell command to the user before running it.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says 'Zero questions to the user — discovery → actions → verification.' Later operational instructions permit asking the user for the config location when openclaw.json is missing. This is an active contradiction between the skill's stated behavior and its later instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The trigger list includes a Russian phrase alongside English phrases, but the skill does not state whether multilingual triggering is optional, user-selected, or limited to specific locales. This can conflict with language/locale policy expectations when a skill implicitly broadens supported languages without clear user opt-in or documentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation establishes a clear contract of 'zero questions to the user' during execution. However, later branches explicitly allow asking the user where openclaw.json is stored if it is not found, which directly contradicts that stated contract.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The discovery step performs a broad filesystem search from '/' to locate OpenClaw before establishing that the environment is appropriate. In an agent context, indiscriminate filesystem enumeration can expose system layout and unrelated paths, exceeding the minimum necessary access for the requested task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.