Security audit

ocmemog-installer

Security checks for vulnerabilities and agentic risk

Overview

This installer is purpose-aligned for setting up a memory sidecar, but it executes mutable remote code, installs unpinned dependencies, and starts persistent/background components with limited user gating.

Review before installing. Prefer a pinned, versioned package or audited commit; avoid running the GitHub fallback unless you trust the upstream repository and dependencies. Ask the agent to show the exact files, services, config changes, and stop/uninstall steps before it starts the sidecar or loads LaunchAgents.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install-ocmemog.sh:18
Finding: Execution of Unverified Code from a Mutable Remote Repository
Content: View full analysis
/dev/null "$REPO_DIR/.venv/bin/pip" install -r "$REPO_DIR/requirements.txt" if [ "$(uname -s)" = "Darwin" ]; then "$REPO_DIR/scripts/ocmemog-install.sh" else nohup "$REPO_DIR/scripts/ocmemog-sidecar.sh" >"$REPO_DIR/.ocmemog-sidecar.log" 2>&1 & ``` ### Technical Analysis The installer clones or updates `https://github.com/simbimbo/ocmemog.git` and then directly executes shell scripts obtained from that checkout. The retrieved repository is not pinned to a reviewed commit, release artifact, or immutable content digest. The installer also performs no cryptographic signature or checksum verification before execution. The `--ff-only` option prevents a non-fast-forward merge, but it does not establish authenticity or prevent a malicious fast-forward update. Consequently, the effective executable payload can change after this Skill has been reviewed. An attacker who compromises the upstream repository, its maintainer account, or the relevant distribution infrastructure could modify either `scripts/ocmemog-install.sh` or `scripts/ocmemog-sidecar.sh`. The modified commands would then run with the privileges of the user invoking this installer. ### Attack Path 1. An attacker compromises the upstream repository or an authorized maintainer account. 2. The attacker commits malicious commands to one of the scripts executed by the installer. 3. A user invokes `install-ocmemog.sh`. 4. The installer clones the current repository state or fast-forwards an existing checkout to the malicious commit. 5. The installer executes the downloaded script without integrity or signature verification. 6. ...[truncated 777 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/install-ocmemog.sh:23
Finding: Installation of Unpinned and Unverified Third-Party Dependencies
Content: View full analysis
/dev/null "$REPO_DIR/.venv/bin/pip" install -r "$REPO_DIR/requirements.txt" ``` The package-based workflow is also documented without a fixed package version at `SKILL.md:23-24`: ```text 1. If OpenClaw package install is available, prefer: - `openclaw plugins install @openclaw/memory-ocmemog` ``` ### Technical Analysis The Python requirements file is obtained from the mutable remote checkout and installed without any locally enforced lockfile or package hashes. This permits the upstream requirements list and its resolved package contents to change independently of the audited Skill. Python package installation can execute package build backends or setup logic during installation. Therefore, a malicious or compromised dependency can cause code execution before the sidecar itself is started. Unconditionally upgrading `pip` introduces another mutable package retrieval step that is unnecessary for every installation. The preferred OpenClaw package command similarly omits an exact package version and integrity value, allowing later package releases to be installed without being covered by this audit. ### Attack Path 1. An attacker compromises a named dependency, its publishing account, the upstream requirements file, or the plugin package distribution account. 2. The attacker publishes or references a malicious package version containing installation-time or runtime code. 3. The user runs the documented installation workflow. 4. `pip` resolves and installs the compromised dependency, or OpenClaw installs the mutable package release. 5. Package lifecycle, build, plugin-loading, or runtime code executes under the installing user's account. 6. The attacker gains access to files, configuration, and appli ...[truncated 641 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: scripts/install-ocmemog.sh:27
Finding: Installation or Launch of Persistent Background Components
Content: View full analysis
"$REPO_DIR/.ocmemog-sidecar.log" 2>&1 & echo "Started sidecar in background; log: $REPO_DIR/.ocmemog-sidecar.log" fi ``` The persistence behavior is explicitly documented at `SKILL.md:27`: ```text - this path creates `.venv`, installs Python requirements, attempts plugin install/enable, loads LaunchAgents, and pulls local Ollama models when Ollama is available ``` ### Technical Analysis On macOS, the installer invokes a remotely retrieved installer that is documented as loading LaunchAgents. LaunchAgents are cross-session startup mechanisms that can cause code to execute automatically in future login sessions. On non-macOS systems, the sidecar is launched through `nohup` and detached into the background. Although this process is not necessarily configured to survive a reboot, it continues running independently after the installer exits. Both paths execute code sourced from the mutable remote checkout. A persistent sidecar may be functionally appropriate for a memory plugin, and the behavior is disclosed. However, automatically establishing long-lived execution without displaying and validating the exact service definition increases the security impact of any upstream compromise. ### Attack Path 1. An attacker compromises the upstream repository or one of the installed dependencies. 2. The user runs the installer and retrieves the compromised code. 3. On macOS, the downloaded installer registers or loads a LaunchAgent; on other systems, the compromised sidecar is detached with `nohup`. 4. The malicious component continues executing after the installation command finishes and, for a LaunchAgent, can execute again in later sessions. 5. The ...[truncated 672 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill directs network-reliant actions such as installing from npm/GitHub and validating remote/public resources, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, missing scope increases the chance the skill is invoked with broader-than-expected capabilities and performs networked system changes without clear operator review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The activation text is broad enough to match generic requests like improving memory, continuity, or troubleshooting, which can cause the installer skill to trigger in contexts where the user did not explicitly ask for software installation or configuration changes. That misfire can lead to unintended package installs, config rewrites, or sidecar setup on the user's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill encourages automatic config patching and execution of an installer script that can create virtual environments, install dependencies, load LaunchAgents, and even install additional software, but it does not prominently require informed consent before making those system changes. In practice, this creates a significant risk of unauthorized persistence, package installation, and configuration drift from an overly eager agent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: Using nohup to start ocmemog-sidecar.sh causes the process to survive the installer session and continue running after the user disconnects. In the context of a memory plugin/sidecar installer, this persistence is somewhat expected, but it is still security-relevant because it establishes an ongoing local endpoint and background execution without stronger lifecycle controls or explicit authorization.
Content: Scanner excerpt · scripts/install-ocmemog.sh (reported line 32)May include surrounding context.
sh
if [ "$(uname -s)" = "Darwin" ]; then "$REPO_DIR/scripts/ocmemog-install.sh" else nohup "$REPO_DIR/scripts/ocmemog-sidecar.sh" >"$REPO_DIR/.ocmemog-sidecar.log" 2>&1 & echo "Started sidecar in background; log: $REPO_DIR/.ocmemog-sidecar.log" fi

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script launches the sidecar as a detached background process with nohup and does so automatically during installation, without interactive consent or a clear opt-in flag. This creates a persistence-like behavior and may leave a long-running local service active unexpectedly, increasing attack surface and making the install perform more than a typical one-shot setup action.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.