Install Powermem Memory

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:45 AM UTC
• Version: 0.3.0

Overview

This is a coherent PowerMem memory setup guide, but it needs Review because it documents persistent automatic conversation memory and an HTTP server mode that can listen on all network interfaces without requiring authentication.

Install only if you understand that conversation content may be stored and later reinserted into prompts. Prefer local CLI mode in a dedicated virtualenv, avoid storing secrets or regulated data, and do not expose HTTP mode beyond localhost unless you require authentication, TLS, and network allowlisting. Review any remote installer before running it and consider pinning package versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Packages Create a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:35
• SKILL.md:50
• SKILL.md:62
• config-reference.md:8
• config-reference.md:35-36
• powermem-intro.md:33

Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:35:

bash

npm install -g openclaw

SKILL.md:50 and SKILL.md:62:

bash

pip install powermem

config-reference.md:8:

markdown

- **Install** — `pip install powermem` (virtualenv recommended).

config-reference.md:35-36:

markdown

- **Install**: `pip install powermem` (prefer inside a virtualenv).
- **HTTP mode**: Create a `.env` (copy from [PowerMem .env.example](https://github.com/oceanbase/powermem/blob/master/.env.example)), set at least database + LLM + Embedding. Start server in that directory: `powermem-server --port 8000`.

powermem-intro.md:33:

markdown

**Typical personal setup:** `pip install powermem`, ensure **`agents.defaults.model`** and provider keys are set in OpenClaw, install the plugin, use **CLI mode** with defaults (`useOpenClawModel: true`, no `envFile`).

Technical Analysis

The installation instructions do not pin reviewed package versions or verify package integrity. Commands such as pip install powermem and npm install -g openclaw resolve the package release available from the configured registry at installation time. The effective code executed by users can therefore change after this skill has been reviewed.

A Python or npm package can execute code during installation or later at runtime. In this deployment, the installed components can process persistent conversation data, access the OpenClaw environment, and interact with provider authentication configuration. Consequently, compromise of a package, maintainer account, registry, or dependency could introduce code with access to sensitive local resources.

T ...[truncated 1901 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each package to a reviewed, known-good version, for example by using an exact Python version specifier and an exact npm package version.
2. For Python, publish a locked requirements file with cryptographic hashes and install it using hash enforcement, such as pip install --require-hashes -r requirements.txt.
3. For npm, document an exact package version and use a lockfile where the installation model permits it.
4. Verify package provenance and signatures where supported, and explicitly document the expected package registry.
5. Install Python dependencies inside a dedicated virtual environment under a non-privileged service account.
6. Avoid global npm installation where possible; otherwise, ensure the global package prefix does not require administrator privileges.
7. Pin external documentation and configuration references to immutable commit identifiers rather than mutable branches such as main or master.
8. Download and inspect any external installer before execution. Publish a checksum or signature for the reviewed installer and plugin release.
9. Add an upgrade procedure that requires security review before changing pinned versions.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:62

Finding

PowerMem Server Is Bound to All Network Interfaces Without Mandatory Authentication

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:62-63
• SKILL.md:98-105
• config-reference.md:44-46

Vulnerability Type: Insecure network-service configuration
Risk Level: High

Vulnerable Code

SKILL.md:62-63:

markdown

- Same **Python 3.10+** requirement as CLI; then `pip install powermem`, `.env` in server working directory, `powermem-server --host 0.0.0.0 --port 8000`.
- Check: `curl -s http://localhost:8000/api/v1/system/health`.

SKILL.md:98-105:

bash

openclaw config set plugins.entries.memory-powermem.config.mode http
openclaw config set plugins.entries.memory-powermem.config.baseUrl http://localhost:8000

markdown

Optional: `apiKey` if the server uses auth.

config-reference.md:44-46:

markdown

| `mode` | `cli` | `cli` (local `pmem`) or `http` (`powermem-server`). |
| `baseUrl` | — | Required when `mode` is `http` (or omit `mode` and set non-empty `baseUrl` → HTTP). |
| `apiKey` | — | HTTP: optional PowerMem server API key. |

Technical Analysis

The documented server command binds PowerMem to 0.0.0.0, causing it to listen on every available IPv4 network interface. At the same time, API-key authentication is presented as optional rather than as a prerequisite for non-local exposure.

PowerMem stores and retrieves persistent conversation-derived memories. If the service endpoints do not independently enforce authentication, any host capable of reaching port 8000 may be able to invoke available API operations. Depending on the server API, this may include searching, adding, changing, or deleting memory records.

The localhost health check only confirms that the service responds locally. It does not demonstrate that remote access is blocked, that authentication is enabled, or that transport encryption protects credentials and memory contents. The documented http:// base URL also provides no transport confidentiality if used across a ...[truncated 1703 chars]

Remediation

View remediation

Remediation Suggestions

1. Make loopback binding the default:

   bash

   powermem-server --host 127.0.0.1 --port 8000
   

2. Require a strong API key or another authenticated access mechanism before documenting any 0.0.0.0 deployment.
3. Fail closed when HTTP mode targets a non-loopback address without authentication.
4. Use TLS for all traffic that crosses a host boundary. Prefer a secured reverse proxy or a private service mesh rather than exposing the application server directly.
5. Restrict ingress with host firewalls, cloud security groups, container-network policy, or VPN allowlists.
6. Use a dedicated non-privileged service account and limit access to the database and .env file.
7. Keep the service private to the gateway unless a shared deployment is explicitly required.
8. Add a verification step that tests remote reachability, confirms authentication rejection for unauthenticated requests, and verifies HTTPS certificate validation.
9. Document namespace authorization requirements for shared deployments so one user or agent cannot access another namespace merely by changing request parameters.
10. Avoid logging API keys, conversation text, or memory records, and rotate any key suspected of network exposure.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly enables automatic capture and recall of conversation content but does not provide a prominent privacy warning, consent step, retention explanation, or guidance on sensitive data handling. Because this is a memory plugin, users may unknowingly persist personal, confidential, or regulated information to local or shared storage and re-inject it into future prompts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill instructs installation of a long-term memory component that persists configuration and memory-related state under the user's home/OpenClaw state directory. Persistent storage is expected for this feature, but without stronger warnings about data lifetime and cleanup, it increases the chance that sensitive conversation data or API-related configuration remains on disk longer than intended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

**Recommended order (TO C):** (1) OpenClaw installed and **default model + provider auth** configured. (2) **Python 3.10+ verified** (`python3 --version`) *before* venv / `pip install`. (3) `pip install powermem` and `pmem` available to the gateway (PATH or `pmemPath`). (4) Install the **memory-powermem** plugin. **No `powermem.env` is required** for the default path.

The curl **`install.sh`** deploys the plugin and OpenClaw entries; with **`-y`** it may still create **`~/.openclaw/powermem/powermem.env`** as an *optional* template—it does **not** run `pip install powermem`. That file is **not** required if the user relies on **OpenClaw-injected** LLM + default SQLite.

1. **Check OpenClaw**  
   `openclaw --version`. If missing: `npm install -g openclaw`, `openclaw onboard`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly enables automatic memory capture and recall of conversation content, but the document does not provide any privacy notice, consent guidance, retention expectations, or warning about sensitive data collection. In a long-term memory plugin, this omission can lead operators to deploy persistent storage of user conversations without understanding the privacy and compliance implications, increasing the risk of collecting secrets, personal data, or regulated information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.