Back to skill
Skillv1.2.6
VirusTotal security
MemSync Dual Memory System · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 4:15 AM
- Hash
- c438c9b4c4f4cd6a6f1a8eaa02955b63d543e4b883fd50646faf22ca736f4a8c
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: openclaw-memvid-logger Version: 1.2.6 The skill is classified as suspicious due to its inherent high-risk capabilities, specifically logging 'everything' (user messages, assistant responses, sub-agent conversations, tool outputs, system events) and executing an external binary (`memvid`) via `subprocess.run`. While the project is exceptionally transparent about these behaviors, explicitly warning users in `SKILL.md`, `README.md`, and `claw.json` about broad data capture, sensitive data risk, and optional cloud data transfer to `memvid.com` (if `MEMVID_API_KEY` is set), the core functionality involves handling and potentially transmitting highly sensitive information. The `install.sh` script also performs significant actions like global `npm install` and modifying `~/.bashrc`, albeit with user prompts. There is no evidence of malicious intent, hidden exfiltration to unauthorized endpoints, or deceptive prompt injection; all risky actions are clearly documented as part of the skill's purpose. The primary concern is the inherent risk of logging all agent interactions and the reliance on an external binary, which could be a vulnerability point if the `memvid` CLI itself were compromised or exploited.
- External report
- View on VirusTotal