ocmemog-installer
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: ocmemog-installer Version: 0.1.8 The skill bundle automates the installation of the ocmemog plugin by cloning a GitHub repository (https://github.com/simbimbo/ocmemog.git), installing Python dependencies, and executing shell scripts (ocmemog-install.sh) from the cloned repository. It also instructs the AI agent to automatically patch the OpenClaw configuration and manage background processes (sidecar). While these actions are aligned with the stated purpose of a software installer, the execution of remote code and modification of system configurations are high-risk behaviors that meet the threshold for a suspicious classification. No evidence of intentional malice, such as data exfiltration or backdoors, was found in the provided files.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A later change in the upstream repository or its dependencies could change what runs on the user's machine without being reflected in this skill's reviewed files.
The installer pulls the current repository state and installs dependencies from it without pinning a specific release, tag, commit, or checksum.
REPO_URL="https://github.com/simbimbo/ocmemog.git" ... git -C "$REPO_DIR" pull --ff-only ... git clone "$REPO_URL" "$REPO_DIR" ... "$REPO_DIR/.venv/bin/pip" install -r "$REPO_DIR/requirements.txt"
Pin the fallback install to a reviewed tag or commit, verify checksums or signatures where possible, and prefer the public package path unless the user explicitly wants a source checkout.
The install can execute code that is not included in the supplied skill artifacts and can leave a background service running under the user's account.
After cloning the external repository, the script executes repository-provided scripts and starts the sidecar process.
if [ "$(uname -s)" = "Darwin" ]; then "$REPO_DIR/scripts/ocmemog-install.sh" else nohup "$REPO_DIR/scripts/ocmemog-sidecar.sh" >"$REPO_DIR/.ocmemog-sidecar.log" 2>&1 &
Ask for clear user confirmation before running the repo installer, show the exact source version being used, and provide a safe way to inspect, stop, and remove the sidecar.
The user's OpenClaw memory slot may be changed to use this plugin, affecting future agent memory behavior.
The skill directs the agent to modify OpenClaw configuration automatically.
If config patch tooling is available, patch config automatically instead of asking the user to hand-edit files.
Show the configuration diff or final config values to the user, and preserve unrelated plugin settings as the skill already instructs.
Conversation-derived information may be stored and reused later, which can be useful but may also retain sensitive or incorrect context.
The plugin is intended to provide durable memory and retrieve stored memory across tasks.
enable transcript-backed continuity ... Validate /healthz and a memory search/get smoke test.
Review the plugin's storage location, retention controls, and deletion process before storing sensitive conversations.
A local memory sidecar may keep running after installation and may start automatically on macOS.
The repo installer path is described as loading a persistent LaunchAgent-style sidecar.
this path creates `.venv`, installs Python requirements, attempts plugin install/enable, loads LaunchAgents, and pulls local Ollama models when Ollama is available
Document how to stop, disable, and uninstall the sidecar, and keep it bound to 127.0.0.1 as the skill recommends.