Install Powermem Memory Minimal

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:44 AM UTC
• Version: 0.1.0

Overview

The skill has a clear PowerMem installation purpose, but it recommends unverified one-line install commands that can run changing third-party code on the user's machine.

Review before installing. Only run this skill's commands if you trust the PowerMem package source and the GitHub installer, and prefer downloading and inspecting the installer, pinning to a reviewed commit or release, and using version/hash-pinned Python dependencies. Do not run the one-line installer from a privileged shell.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57
• Finding: Mutable Remote Installer Is Piped Directly into Bash## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://raw.githubusercontent.com/ob-labs/memory-powermem/main/install.sh | bash -s -y ``` ### Technical Analysis The installation instructions retrieve `install.sh` from the mutable `main` branch of an external GitHub repository and stream it directly into Bash. The command does not pin an immutable commit or release, verify a cryptographic checksum or signature, save the script for inspection, or request confirmation before execution. The remote installer is not included in the audited artifact, so its effective behavior cannot be determined from this project. Its contents can also change after the Skill has been reviewed. Direct shell execution is unnecessary for the declared plugin-installation function when safer approaches such as a pinned, reviewed installer or a supported package-management command could be used. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another component of the delivery chain. 2. The attacker modifies `install.sh` on the repository's `main` branch. 3. A user follows the Skill instructions and executes the documented command. 4. `curl` retrieves the attacker's current script without integrity verification. 5. Bash immediately executes the script with all permissions and environmental access available to the invoking user. 6. The payload can modify local files and OpenClaw configuration, read user-accessible information, install additional components, or contact attacker-controlled systems. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user running the installation command. The accessible scope can include that user's files, OpenClaw data and configuration, environment variables, API ...[truncated 286 chars]
• Remediation: ## Remediation Suggestions 1. Do not pipe remotely retrieved content directly into a shell. 2. Pin the installer to an immutable, reviewed commit or versioned release rather than `main`. 3. Download the installer as a separate file and verify a publisher-provided cryptographic signature or trusted SHA-256 digest before execution. 4. Make the script available for user inspection before it is run. 5. Prefer a supported OpenClaw package or plugin installation mechanism that provides versioning and integrity validation. 6. Execute the installer with ordinary user privileges and explicitly document the files, configuration, network access, and commands it requires. 7. Where practical, vendor the reviewed installer into the distributed artifact so its behavior is included in future audits.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40
• Finding: PowerMem Is Installed Without Version or Integrity Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 40–43 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash python3 -m venv ~/.openclaw/powermem/.venv source ~/.openclaw/powermem/.venv/bin/activate pip install powermem ``` ### Technical Analysis The Skill installs the latest version resolved for the `powermem` package without pinning a reviewed version, constraining transitive dependencies, or validating package hashes. Consequently, identical instructions may install different code over time. Python package installation may execute package build-backend or installation-related code, while the installed package and its dependencies will execute when PowerMem is used. A compromised upstream release, dependency, or package-maintainer account could therefore introduce malicious behavior after this Skill has been audited. The virtual environment limits dependency conflicts but does not sandbox installation or runtime code from the invoking user's files and credentials. ### Attack Path 1. An attacker compromises the `powermem` package, one of its dependencies, or an associated publishing account. 2. The attacker publishes a malicious release that satisfies the unconstrained installation request. 3. A user runs `pip install powermem`. 4. Pip resolves and downloads the affected package or dependency because no approved version or hash is required. 5. Malicious code executes during package building, installation, import, or subsequent PowerMem operation with the invoking user's permissions. ### Impact Assessment Exploitation could permit execution under the installing user's account and access to user-readable files, PowerMem data, OpenClaw configuration, environment variables, and credentials exposed to the process. It could also alter the virtual environment or manipulate memory processing. The audit did not establish that the current packag ...[truncated 131 chars]
• Remediation: ## Remediation Suggestions 1. Pin `powermem` to a specific reviewed version using an exact requirement. 2. Lock all transitive dependencies and include cryptographic hashes, such as through a hash-locked requirements file. 3. Install with hash enforcement, for example using `pip install --require-hashes -r requirements.txt`. 4. Document the expected official package index and reject untrusted additional indexes. 5. Review dependency updates before changing the lock file and use automated vulnerability and provenance scanning. 6. Retain the virtual environment, but do not treat it as a security sandbox; run installation and operation with only the minimum necessary user permissions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill recommends running fetched shell code without any explicit warning that this executes arbitrary remote commands on the user's system. In a 'minimal install' context, users are more likely to copy-paste blindly, increasing the chance of compromise if the script is malicious, tampered with, or later changed upstream.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger "安装长期记忆" is generic and does not clearly limit activation to PowerMem or OpenClaw. Because it overlaps with ordinary requests to install long-term memory features, it could cause unintended invocation of this specific skill in broader contexts.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill recommends executing a remote script directly via 'curl | bash', which grants immediate shell execution of unaudited network-fetched code. If the upstream repository, distribution channel, DNS/TLS path, or referenced script changes, users can be silently exposed to arbitrary command execution on their machine.

External Script Fetching

Low

• Category: Supply Chain

Content

5. **一键装插件（推荐）**  
   在 **Mac / Linux** 上执行（需已安装 OpenClaw）：
   ```bash
   curl -fsSL https://raw.githubusercontent.com/ob-labs/memory-powermem/main/install.sh | bash -s -y
   ```
   脚本会把插件放进 OpenClaw，并打开「用 OpenClaw 的模型驱动记忆」等默认选项。

• Confidence: 95% confidence
• Finding: This finding captures the same risky behavior directly: fetching a script from GitHub and piping it into bash. Even if the current script is benign, the pattern creates a supply-chain execution path where any compromise of the script source results in immediate code execution with the user's privileges.

Static analysis

No suspicious patterns detected.