T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:7- Finding
Mutable remote installers are executed directly through shell pipelines
- Content
View full analysis
- Remediation
View remediation
Security audit
Official Claude-Mem OpenClaw Memory Plugin
Security checks for vulnerabilities and agentic risk
Overview
This persistent-memory plugin is mostly coherent with its stated purpose, but it needs Review because installation and memory access are too broad for the sensitivity of the data it handles.
Install only after reviewing the installer and the remote repository at the exact version you intend to run. Prefer a pinned, verified release, avoid passing API keys on the command line, restrict who can send OpenClaw commands, disable MEMORY.md sync or observation feeds in sensitive workspaces, and assume tool inputs and outputs may be retained unless the implementation adds truncation, redaction, and retention controls.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:615- Finding
Installer builds and executes unpinned repository and package content
- Content
View full analysis
&1; then error "Failed to clone claude-mem repository" error "Check your internet connection and try again." exit 1 fi local plugin_src="${build_dir}/claude-mem/openclaw" # Build the TypeScript plugin info "Building TypeScript plugin..." if ! (cd "$plugin_src" && NODE_ENV=development npm install --ignore-scripts 2>&1 && npx tsc 2>&1); then error "Failed to build the claude-mem OpenClaw plugin" error "Make sure Node.js and npm are installed." exit 1 fi ``` Dependency declarations are ranges rather than immutable versions: ```json "devDependencies": { "@types/node": "^25.2.1", "typescript": "^5.3.0" } ``` No package lockfile appears in the supplied project structure. ### Technical Analysis The installer clones the mutable `main` branch by default and accepts an arbitrary branch through the undocumented parsing of `--branch`. It does not resolve and verify an expected c ...[truncated 1568 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/index.ts:848- Finding
Memory search and timeline commands lack explicit authorization enforcement
- Content
View full analysis
{ const raw = ctx.args?.trim() || ""; if (!raw) { return "Usage: /claude-mem-search [limit]"; } const pieces = raw.split(/\s+/); const maybeLimit = pieces[pieces.length - 1]; const hasTrailingLimit = /^\d+$/.test(maybeLimit); const limit = hasTrailingLimit ? parseLimit(maybeLimit, 10) : 10; const query = hasTrailingLimit ? pieces.slice(0, -1).join(" ") : raw; const data = await workerGetJson( workerPort, `/api/search/observations?query=${encodeURIComponent(query)}&limit=${limit}`, api.logger, ); if (!data) { return "Claude-Mem search failed (worker unavailable or invalid response)."; } const items = Array.isArray(data.items) ? data.items : []; return [ `Claude-Mem Search: \"${query}\"`, summarizeSearchResults(items, limit), ].join("\n"); }, }); ``` The same authorization omission applies to: - `/claude-mem-recent` - `/claude-mem-timeline` - `/claude_mem_status` - `/claude_mem_feed` The command context explicitly exposes authorization state: ```ts interface PluginCommandContext { senderId?: string; channel: string; isAuthorizedSender: boolean; args?: string; commandBody: string; config: Record; } ``` ### Technical Analysis The plugin API supports both a `requireAuth` command property and an `isAuthorizedSender` context field. None of the registered commands uses these controls. The search, recent-context, and timeline commands query information derive ...[truncated 1474 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/index.ts:645- Finding
Complete tool inputs and outputs are persisted without truncation or secret redaction
- Content
View full analysis
(block.type === "tool_result" || block.type === "text") && "text" in block) .map((block) => String(block.text)) .join("\n"); } // Fire-and-forget: send observation + sync MEMORY.md in parallel workerPostFireAndForget(workerPort, "/api/sessions/observations", { contentSessionId, tool_name: toolName, tool_input: event.params || {}, tool_response: toolResponseText, cwd: "", }, api.logger); ``` The documentation states that tool responses are truncated: ```text tool_result_persist — Records observation (fire-and-forget), re-syncs MEMORY.md (fire-and-forget). Tool responses are truncated to 1000 characters. ``` No such truncation appears in the audited implementation. ### Technical Analysis Every persisted tool event sends: - The complete `event.params` object - The full concatenated tool-result text - The tool name - The session identifier No maximum length, field allowlist, secret detector, content classification, or sensitive-tool exclusion is applied in this code. Tool output commonly contains source files, configuration files, environment data, command output, access tokens, private keys, personal information, and proprietary content. The worker uses this data to build persistent observations. Those observations can subsequently influence `MEMORY.md`, memory-query responses, and—when explicitly enabled—external observation feeds. This behavior also exceeds the documented collection boundary because the guide promises a 1,000-character truncation that the implementation does not enforce. # ...[truncated 1277 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:1022- Finding
AI-provider API keys are written without explicit restrictive file permissions
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
install.sh:1175- Finding
Downloaded worker code is launched as a detached background process
- Content
View full analysis
> "$log_file" 2>&1 & WORKER_PID=$! # Write PID file for future management local pid_file="${HOME}/.claude-mem/worker.pid" mkdir -p "${HOME}/.claude-mem" INSTALLER_PID_FILE="$pid_file" INSTALLER_WORKER_PID="$WORKER_PID" node -e " const info = { pid: parseInt(process.env.INSTALLER_WORKER_PID, 10), port: 37777, startedAt: new Date().toISOString(), version: 'installer' }; require('fs').writeFileSync(process.env.INSTALLER_PID_FILE, JSON.stringify(info, null, 2)); " success "Worker process started (PID: ${WORKER_PID})" info "Logs: ${log_file}" } ``` ### Technical Analysis The installer starts worker code using `nohup` and backgrounds it. The process can therefore remain active after the installation shell exits. Detached executio ...[truncated 1514 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (66)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The guide instructs users to fetch and immediately execute a remote shell script via curl piped to bash. This prevents meaningful inspection of the installer before execution and creates a high-risk supply-chain vector: if the remote host, DNS, TLS termination, or published script is compromised, arbitrary code executes on the target system.
- Content
Run this one-liner to install everything automatically:
bash curl -fsSL https://install.cmem.ai/openclaw.sh | bashThe installer handles dependency checks (Bun, uv), plugin installation, memory slot configuration, AI provider setup, worker startup, and optional observation feed configuration — all interactively.
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The '| bash' construct is the dangerous chaining step that turns network retrieval into immediate code execution. In this skill context, the command is presented as the recommended install path, which increases the likelihood that users will run it without inspection and exposes gateway hosts to arbitrary installer behavior.
- Content
Run this one-liner to install everything automatically:
bash curl -fsSL https://install.cmem.ai/openclaw.sh | bashThe installer handles dependency checks (Bun, uv), plugin installation, memory slot configuration, AI provider setup, worker startup, and optional observation feed configuration — all interactively.
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
This variant still executes a remotely fetched script directly, now additionally passing an API key on the command line. Besides arbitrary code execution risk from the unverified installer, command-line secrets may be exposed through shell history, process listings, logs, or audit systems.
- Content
Pre-select your AI provider and API key to skip interactive prompts:
bash curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEYFor fully unattended installation (defaults to Claude Max Plan, skips observation feed):
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The unattended installation command executes remote code without review and removes interactive friction that might otherwise prompt users to inspect options or understand side effects. In automated environments, this can silently deploy compromised code at scale if the installer source is tampered with.
- Content
For fully unattended installation (defaults to Claude Max Plan, skips observation feed):
bash curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --non-interactiveTo upgrade an existing installation (preserves settings, updates plugin):
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The upgrade path repeats the same unsafe remote-script execution pattern. Because upgrades often run on already trusted systems and may occur routinely, a compromised update script could provide an efficient mechanism for broad code execution across existing deployments.
- Content
To upgrade an existing installation (preserves settings, updates plugin):
bash curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --upgradeAfter installation, skip to Step 4: Restart the Gateway and Verify to confirm everything is working.
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The bun installation instruction also uses curl piped to bash, carrying the same arbitrary code execution and supply-chain risks as the main installer. Even if common in ecosystem docs, it remains unsafe because users execute unaudited remote code with their local privileges.
- Content
You'll need bun installed for the worker service. If you don't have it:
bash curl -fsSL https://bun.sh/install | bashStep 2: Get the Worker Running
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
This chaining pattern again causes unaudited remote content to execute immediately in the user's shell. Because it installs a runtime dependency, compromise at this stage can taint the broader environment and any later plugin operations running on the host.
- Content
You'll need bun installed for the worker service. If you don't have it:
bash curl -fsSL https://bun.sh/install | bashStep 2: Get the Worker Running
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
Channel type:
discordTo find your channel ID:
- Enable Developer Mode in Discord: Settings → Advanced → Developer Mode
- Right-click the target channel → Copy Channel ID
json
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
sh Channel type: `discord` To find your channel ID: 1. Enable Developer Mode in Discord: Settings → Advanced → Developer Mode 2. Right-click the target channel → Copy Channel ID ```json
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The installer explicitly recommends
curl ... | bash, which executes remote network content immediately without inspection, integrity verification, or pinning. This pattern is especially dangerous for an installer that modifies configs, downloads more code, and starts background services.- Content
sh # Installs the claude-mem persistent memory plugin for OpenClaw gateways. # # Usage: # curl -fsSL https://install.cmem.ai/openclaw.sh | bash # # Or with options: # curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY # # Direct execution:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| bashchaining pattern removes any inspection boundary between downloading and executing code, making content tampering, server compromise, or CDN hijack immediately exploitable. In this installer context, that would allow arbitrary code execution plus persistent system and config changes.- Content
sh # Installs the claude-mem persistent memory plugin for OpenClaw gateways. # # Usage: # curl -fsSL https://install.cmem.ai/openclaw.sh | bash # # Or with options: # curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY # # Direct execution:
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
This usage example again encourages executing fetched remote installer code directly while also passing secrets as arguments. The combination amplifies risk because users both trust unverified code and expose credentials during execution.
- Content
sh # Usage: # curl -fsSL https://install.cmem.ai/openclaw.sh | bash # # Or with options: # curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY # # Direct execution: # bash install.sh [--non-interactive] [--upgrade] [--provider=claude|gemini|openrouter] [--api-key=KEY]
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh done ############################################################################### # TTY detection — ensure interactive prompts work under curl | bash # When piped, stdin reads from curl's output, not the terminal. # We open /dev/tty on fd 3 and read interactive input from there. ###############################################################################
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh done ############################################################################### # TTY detection — ensure interactive prompts work under curl | bash # When piped, stdin reads from curl's output, not the terminal. # We open /dev/tty on fd 3 and read interactive input from there. ###############################################################################
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh done ############################################################################### # TTY detection — ensure interactive prompts work under curl | bash # When piped, stdin reads from curl's output, not the terminal. # We open /dev/tty on fd 3 and read interactive input from there. ###############################################################################
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh done ############################################################################### # TTY detection — ensure interactive prompts work under curl | bash # When piped, stdin reads from curl's output, not the terminal. # We open /dev/tty on fd 3 and read interactive input from there. ###############################################################################
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh done ############################################################################### # TTY detection — ensure interactive prompts work under curl | bash # When piped, stdin reads from curl's output, not the terminal. # We open /dev/tty on fd 3 and read interactive input from there. ###############################################################################
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh done ############################################################################### # TTY detection — ensure interactive prompts work under curl | bash # When piped, stdin reads from curl's output, not the terminal. # We open /dev/tty on fd 3 and read interactive input from there. ###############################################################################
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh done ############################################################################### # TTY detection — ensure interactive prompts work under curl | bash # When piped, stdin reads from curl's output, not the terminal. # We open /dev/tty on fd 3 and read interactive input from there. ###############################################################################
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The script installs Bun by piping a remote script from
https://bun.sh/installdirectly intobash, executing third-party code with full user privileges and no integrity verification. This is a classic supply-chain risk and broadens the trusted computing base during installation.- Content
sh install_bun() { info "Installing Bun runtime..." if ! curl -fsSL https://bun.sh/install | bash; then error "Failed to install Bun automatically" error "Please install manually:" error " curl -fsSL https://bun.sh/install | bash"
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh if ! curl -fsSL https://bun.sh/install | bash; then error "Failed to install Bun automatically" error "Please install manually:" error " curl -fsSL https://bun.sh/install | bash" error " Or: brew install oven-sh/bun/bun (macOS)" error "Then restart your terminal and re-run this installer." exit 1
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This plugin persistently records user prompts, tool inputs/results, and assistant outputs, then republishes observation summaries to messaging channels such as Telegram, Slack, Discord, and others. In this skill context, that behavior is especially dangerous because the plugin is explicitly designed to observe agent activity, so sensitive operational data may be stored and broadcast outside the original execution context.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh #!/bin/bash echo "1.2.0" FAKEBUN chmod +x "${fake_home}/.bun/bin/bun" # Hide bun from PATH local saved_path="$PATH"
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Writing the full observation timeline to MEMORY.md in each agent workspace creates a persistent local disclosure channel across sessions. Future agents, tools, or users with access to the workspace may read accumulated historical observations that were not intended for them, increasing the blast radius of any sensitive data captured by the memory system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide encourages enabling a real-time observation feed to Telegram/Discord/Slack and similar services without a prominent privacy warning about what data may be transmitted. Because observations are derived from agent tool usage and may include sensitive workspace content, credentials, internal code details, or user data, this creates a meaningful risk of unintended disclosure to third-party platforms.
- Content