ClawHub
Back to skill

Security audit

Auto Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it stores user-selected agent memories or files on a permanent public storage network, which is sensitive but clearly disclosed and purpose-aligned.

Install only if you intentionally want permanent, public, CID-addressed memory. Do not upload secrets, API keys, private files, personal data, or regulated data unless you have encrypted and minimized it first. Protect and rotate the Auto Drive API key if the local ~/.openclaw files may be exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger guidance includes broad phrases like 'store permanently' and 'checkpoint' that could cause the skill to activate during normal conversation without sufficiently explicit user intent. In this skill's context, accidental activation is more dangerous because the resulting action stores data on a permanent, public network, creating irreversible disclosure risk if routine context or sensitive content is uploaded.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The document promotes irreversible permanent storage and use of an API-key-authenticated service without warning users not to store secrets, personal data, or other sensitive information. In the context of an agent memory skill, this is dangerous because agents may automatically persist prompts, decisions, credentials, or user data to immutable public or semi-public infrastructure, making mistakes difficult or impossible to remediate.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document explicitly encourages storing "anything worth keeping permanently" on immutable decentralized storage and emphasizes resurrection from a single CID, but it does not warn about sensitive data exposure, irreversibility, or data minimization. In an agent-memory skill, this is security-relevant because operators may persist secrets, personal data, tokens, internal prompts, or full file snapshots that cannot be deleted once published.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script uploads the provided memory content to a remote service via a helper upload script, but this file itself gives no runtime warning, confirmation, redaction step, or sensitivity check before transmitting potentially private agent/user data. In a memory skill, the payload may include identity, decisions, or conversation context, so silent exfiltration to a third party meaningfully increases privacy and data-handling risk.

Credential Access

High
Category
Privilege Escalation
Content
AD_BASE_URL="https://mainnet.auto-drive.autonomys.xyz/api"
AD_DOWNLOAD_URL="https://public.auto-drive.autonomys.xyz/api"
AM_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}"
AM_ENV_FILE="$AM_OPENCLAW_DIR/.env"
AM_CONFIG_FILE="$AM_OPENCLAW_DIR/openclaw.json"

GREEN='\033[0;32m'
Confidence
93% confidence
Finding
The library is explicitly designed to persist an API key in a plaintext .env file under the user's home directory. Even with chmod 600, plaintext local secret storage increases exposure to credential theft from local compromise, backups, accidental inclusion in archives, or later sourcing by other scripts.

Credential Access

High
Category
Privilege Escalation
Content
fi
  echo -e "${GREEN}✓ Saved to $AM_CONFIG_FILE${NC}"

  # --- .env ------------------------------------------------------------------
  # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates,
  # then append exactly one entry.
  if [[ -f "$AM_ENV_FILE" ]]; then
Confidence
94% confidence
Finding
The code path intentionally edits a .env file to insert a bearer credential, making secret persistence an actual behavior rather than a theoretical concern. In the context of an agent skill, this is more sensitive because the skill automates credential handling and may normalize storing reusable API keys on disk.

Credential Access

High
Category
Privilege Escalation
Content
sed '/^AUTO_DRIVE_API_KEY=/d' "$AM_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AM_ENV_FILE"
  fi
  # Single-quote the value so characters like #, $, and backticks are
  # preserved literally when the .env file is later sourced by bash.
  local safe_key="${key//\'/\'\\\'\'}"
  echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AM_ENV_FILE"
  chmod 600 "$AM_ENV_FILE"
Confidence
96% confidence
Finding
This line writes the API key directly into the .env file in plaintext. Although quoting reduces shell-injection risk when sourced, it does not mitigate the core credential exposure risk of storing reusable secrets on disk.

Session Persistence

Medium
Category
Rogue Agent
Content
license: Apache-2.0
description: Indestructible agent memory — permanently stored, never lost. Save decisions, identity, and context as a memory chain on the Autonomys Network. Rebuild your full history from a single CID, even after total state loss.
compatibility: Requires curl, jq, and the file utility, plus outbound HTTPS to the Autonomys Auto Drive API (ai3.storage) and public gateway. Stored data is permanent and public — do not store secrets. Works with OpenClaw and Hermes agents on macOS and Linux.
allowed-tools: Bash(curl:*) Bash(jq:*) Bash(file:*) Read Write
metadata:
  openclaw:
    emoji: "🧬"
Confidence
88% confidence
Finding
The skill is explicitly designed for session persistence: it writes memory/state locally and instructs agents to persist decisions, identity, and context to an immutable public storage network. Even though the documentation warns not to store secrets, the skill materially increases the chance that sensitive prompts, personal data, or internal reasoning artifacts are retained beyond the current session and exposed permanently.

External Script Fetching

High
Category
Supply Chain
Content
if [[ -n "$EXPERIENCE" ]] && echo "$EXPERIENCE" | jq empty 2>/dev/null; then
      echo "[$COUNT] Fetched $CID via gateway" >&2
    else
      # ZLIB compressed — pipe curl directly into decompressor (no intermediate variable)
      EXPERIENCE=""
      if command -v python3 &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \
Confidence
88% confidence
Finding
The script downloads untrusted content from a public gateway and immediately feeds it into a decompressor implemented in Python. Although it does not execute the decompressed output as code, this still processes attacker-controlled data and can expose the host to denial-of-service risks such as decompression bombs, excessive memory consumption, or parser/library bugs. In this skill's context, memories are expected to come from external CIDs, so handling hostile content is realistic and increases risk.

External Script Fetching

High
Category
Supply Chain
Content
| python3 -c "import sys,zlib;sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read()))" 2>/dev/null || true)
      fi
      if [[ -z "$EXPERIENCE" ]] && command -v perl &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \
          | perl -MCompress::Zlib -e 'undef $/;my $d=uncompress(<STDIN>);print $d if defined $d' 2>/dev/null || true)
      fi
      if [[ -n "$EXPERIENCE" ]]; then
Confidence
88% confidence
Finding
This fallback path pipes untrusted gateway data directly into Perl's zlib decompression, again processing attacker-controlled bytes without resource limits. As with the Python branch, the main concern is not code execution from the downloaded payload but resource exhaustion or exploitation of decompression/parsing components via malicious compressed input. Because the script is designed to recover arbitrary remote memory-chain objects, the exposure is meaningful rather than theoretical.

Static analysis

No suspicious patterns detected.