Openclaw Auto Memory Skill

• Outcome: Review
• Latest audit: Jul 14, 2026 · 8:06 PM UTC
• Version: 3.0.2

Overview

This is a local memory skill, but it asks agents to silently retain and reuse conversation data and creates some unclear background and policy-control behavior that users should review carefully.

Install only if you are comfortable with a skill that persistently stores and reuses conversation-derived personal and project context. Review and disable automatic cron jobs unless you explicitly want background capture, avoid running memory.py from untrusted repositories, prefer environment-managed secrets over project .env files, and inspect stored memories regularly for sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and instructs capabilities that read environment/configuration, read and write files, and interact with networked/local services, but it does not declare corresponding permissions. Hidden capability expansion weakens informed consent and prevents hosts from applying least-privilege controls before installation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose centers on memory, but the skill also introduces a governance/enforcement layer that inspects and influences tool usage, loads policies from skill metadata, and affects runtime behavior across agents. That is a materially different and more powerful function than a memory plugin, increasing the chance users install it without understanding its control surface.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The privacy section claims only structured facts are stored, yet other sections direct migration of existing sessions and full chat/session backup. This contradiction can mislead users about the amount and sensitivity of data retained, causing them to expose far more conversation content than expected.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document says cron jobs are only created on explicit request, but the install flow later instructs automatic cron creation. This undermines user consent and can enable ongoing background processing of conversations without a clear, contemporaneous confirmation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that the agent will silently load and automatically capture user facts and project details across sessions without foregrounding consent, notice, retention, or review controls at the point of collection. Even if processing is local, silent persistence of personal and work-related data creates a real privacy and security risk because users may disclose sensitive information without understanding it is being stored and replayed later.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs automatic creation of recurring background capture tasks that run silently and continue processing conversation-derived data after setup. Even if local-only, this creates persistent surveillance-like behavior unless users are clearly warned and allowed to decline before activation.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: Silently loading prior memories at the start of each chat is a privacy-sensitive behavior because it reuses stored personal/project data without a nearby user-facing disclosure. In a memory skill this is expected functionality, but the lack of runtime notice and controls still makes it risky.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer recursively copies all files from the current directory into the user's plugin-skills directory with `-Force`, which can overwrite existing files without confirmation or validation. This is dangerous because it can unintentionally replace prior skill contents or copy unintended local files from the working directory, leading to configuration corruption, persistence of unexpected code, or accidental data exposure within the skill directory.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: This section instructs behavior that silently retains and reuses conversational data, including personal and project context, across sessions. That creates a confidentiality risk because sensitive details can be stored unexpectedly and later exposed in a different context, especially on shared machines or multi-user agent environments.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The example workflow normalizes covert collection of identity and work information and then has the agent proactively reveal it later, which demonstrates an unsafe privacy pattern rather than a harmless example. This can leak personal identity, employer/project names, or operational details to anyone who opens a later session or views agent output.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The deterministic triggers direct the agent to persist identity, preferences, project details, decisions, corrections, and blockers/errors, which can include sensitive personal data, internal architecture, credentials-adjacent operational details, and security-relevant failure information. In a memory skill, these broad capture rules materially increase the chance of over-collection and unintended disclosure because the entire purpose of the skill is persistent cross-session retention.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill tells the agent to retain and reuse conversation-derived data across sessions automatically, without per-item confirmation or granular controls. Persistent cross-session profiling can expose sensitive preferences, identities, or project context to later interactions in ways users may not expect.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Broad automatic capture of facts, preferences, corrections, and project details creates a large persistent profile of the user and their work. Because capture is deterministic and immediate, sensitive information may be stored before the user understands the retention model or has a chance to exclude it.

Ssd 4

Medium

• Confidence: 92% confidence
• Finding: The one-click installation narrative bundles migration of old sessions, dashboard exposure, and automatic capture into a convenience flow. Packaging privacy-sensitive persistence and background collection as routine setup increases the chance users consent without appreciating the long-term data effects.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

priority: critical
    rule: "Agent MUSS alle enforce-Regeln befolgen; sie stehen über Memory."
    policy:
      tool: "*"
      pattern: "*"
      action: allow
      reason: "Foundation rule — enables all other policies."

• Confidence: 79% confidence
• Finding: A foundation rule with tool '*' and pattern '*' action allow establishes a broad allow baseline. In an enforcement system, such a universal allow can weaken least-privilege guarantees and make policy resolution error-prone, especially if precedence or matcher bugs cause deny rules to be bypassed.

Credential Access

High

• Category: Privilege Escalation

Content

- http
    justification: "Required to capture/search/autosave memories via Sidecar API"

  # Filesystem access to .env config
  - id: env-read
    description: "Read .env files for API_KEY and MEM_PUBLIC_URL configuration"
    type: filesystem

• Confidence: 95% confidence
• Finding: The skill explicitly requests read access to a local .env file in order to load API_KEY and related configuration. .env files commonly contain secrets, and granting a skill direct filesystem access to them creates a credential-exposure path if the skill is compromised, overly permissive, or logs/transmits the values elsewhere.

Credential Access

High

• Category: Privilege Escalation

Content

# Filesystem access to .env config
  - id: env-read
    description: "Read .env files for API_KEY and MEM_PUBLIC_URL configuration"
    type: filesystem
    access: read
    paths:

• Confidence: 95% confidence
• Finding: This finding reflects the same permission block granting filesystem read access for secret-bearing configuration. Even though access is read-only, reading .env is sufficient to exfiltrate credentials such as API keys, which can then be reused outside the skill's intended scope.

Credential Access

High

• Category: Privilege Escalation

Content

type: filesystem
    access: read
    paths:
      - ".env"
    justification: "Required to load API credentials from project or script directory"

  # Background cron jobs (user must explicitly opt in)

• Confidence: 97% confidence
• Finding: The justification confirms that the purpose of reading .env is to obtain API credentials, making this a direct credential-access pattern rather than incidental file access. In a multi-agent memory platform with cross-skill sharing and networked sidecar interaction, exposed credentials could enable unauthorized access to memory data or connected services.

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_config() -> tuple[str, str]:
    """Resolve API base URL and key from env vars or .env files."""
    env_vars = {**os.environ}
    env_script = _load_dotenv(os.path.join(SCRIPT_DIR, ".env"))
    env_cwd = _load_dotenv(os.path.join(os.getcwd(), ".env"))

    api_base = (

• Confidence: 84% confidence
• Finding: The code loads .env from the current working directory, which may be attacker-controlled if the CLI is invoked inside an untrusted repository or workspace. That allows configuration injection: an attacker can supply a malicious MEM_PUBLIC_URL and API_KEY so future memory contents and search queries are silently sent to an attacker-chosen service.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

reason: "Foundation rule — enables all other policies."
  - id: deny-destructive-git-docker
    priority: critical
    rule: "Terminal: git push, merge, reset, destructive rm, and Docker prune/rm are blocked."
    policy:
      tool: terminal
      pattern: "git push*|git merge*|git reset*|rm -*|docker system prune*|docker volume rm*|docker image rm*"

• Confidence: 88% confidence
• Finding: The policy relies on brittle pattern matching to block dangerous terminal commands such as rm, git reset, and Docker prune/rm. Attackers or even normal command variations can evade simplistic patterns with alternate flags, paths, shells, quoting, subcommands, or equivalent destructive commands, creating a false sense of safety around hazardous tool execution.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.