Security audit

Context Clear

Security checks across malware telemetry and agentic risk

Overview

This is a coherent memory-management skill, but it automatically reuses stored conversation history and can delete old memory files, so users should review it before installing.

Install only if you want OpenClaw to keep a local persistent memory store and automatically add recent memory files into future prompts. Avoid storing secrets in ~/.openclaw/memory_fs, review or back up that folder before running /refresh, and be aware that old forgotten files may be permanently deleted after the retention window.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The top-level description says to use the skill broadly for managing conversation memory, retrieval, promotion, and cleanup, which is expansive enough to activate during many ordinary conversations. Overbroad triggering increases the chance the agent will read or persist prior context when it is unnecessary, exposing historical user data beyond user intent.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The retrieval protocol allows activation whenever the agent merely believes information is missing from current context, including self-assessed cues. That subjective standard can trigger background searching of stored conversation history without explicit user authorization, increasing unintended data access and cross-session leakage.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The plugin automatically reads files from ~/.openclaw/memory_fs/hot and prepends their contents to every prompt without user disclosure, consent, or per-session scoping. This can unintentionally expose sensitive data from prior sessions into unrelated conversations or to downstream models/tools, creating a cross-session data leakage risk that is especially relevant for a memory-management plugin.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The /refresh command runs local scripts and then resets the active session, but the code provides no explicit confirmation or warning before performing those side effects. A user invoking what sounds like a benign memory refresh could unexpectedly trigger local code execution and lose current conversational context, which is a trust and safety problem even if the command is intentional.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script permanently deletes files from `forgotten/` after 30 days with no confirmation, dry-run mode, trash/quarantine step, or explicit user-visible warning at deletion time. In a memory-management skill, this can cause silent irreversible data loss, especially because retention is driven automatically by timestamps and refcount state rather than an explicit current user action.

Ssd 3

Medium

Confidence: 96% confidence
Finding: This skill is expressly designed to retain and later surface prior user conversations, checkpoints, and related content across sessions. Persisting raw or derived conversational data creates a substantial risk of storing sensitive information and reintroducing it in later contexts where it may be irrelevant, unexpected, or exposed to the wrong task.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs storing raw dialogue, tool output, and checkpoint contents in hot/warm layers and automatically injecting recent memory into sessions. Automatic reinjection of unfiltered historical content can expose secrets, credentials, personal data, or prior-task artifacts to future prompts and tools without contextual need or renewed consent.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The promotion mechanism moves repeatedly retrieved memory into durable files like MEMORY.md and skill retrospectives, making persistence broader and harder to audit or delete. Popularity of retrieval is not a safe proxy for appropriateness, so sensitive or context-specific user data may become long-term knowledge simply because it was accessed multiple times.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The retrieval protocol directs the agent to search stored memory, read matching files, update recall counts, and revive older content into hotter tiers, including forgotten material. This creates an active mechanism for resurfacing historical data into current operations, which raises the likelihood of privacy violations, inappropriate context mixing, and persistence of stale or sensitive information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.