Official Claude-Mem OpenClaw Memory Plugin

• Outcome: Review
• Latest audit: May 28, 2026 · 6:02 AM UTC
• Version: 1.0.1

Overview

This is a real memory plugin, but it broadly records agent activity, persists it, and can forward observations to chat services, so users should review it carefully before installing.

Install only if you want this plugin to keep persistent records of agent work. Review the installer before running it, avoid passing API keys on the command line, keep the observation feed disabled unless the destination is trusted, disable MEMORY.md sync for sensitive repos, and exclude or delete stored memory where it could be committed, backed up, or read by others.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The installer is presented as a setup script, but it can actively shut down an existing local service via an admin HTTP endpoint and then send kill signals to discovered PIDs. That creates availability risk and could terminate the wrong local process if port ownership or PID identity is misidentified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly states that agent observations are automatically recorded across sessions and can be streamed to external channels, but it does not present a prominent privacy warning, consent requirement, or clear guidance on sensitive-data handling. In an agent environment, tool outputs may contain secrets, personal data, internal code, or operational details, so normalizing continuous collection and sharing without strong warnings increases the risk of accidental data exposure.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The guide instructs users to forward observations to external messaging platforms such as Telegram, Discord, Slack, WhatsApp, and others, but it does not include an explicit warning that observations may contain sensitive or personal data. In a memory/observation plugin context, this omission increases the risk of unintentional data disclosure to third-party services or the wrong recipient during testing or production-like validation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script unconditionally deletes the existing plugin directory with rm -rf before reinstalling. If the resolved path is unexpected or the directory contains local modifications, this causes irreversible data loss without user confirmation or backup.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The installer edits ~/.openclaw/openclaw.json in place, temporarily removing plugin entries and slot mappings to make the CLI accept installation. Silent in-place mutation of user configuration can break unrelated behavior and is especially risky in a curl-to-bash installer where users may not expect structural config rewrites.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer persists supplied API keys into ~/.claude-mem/settings.json without a clear warning about on-disk credential storage or file permissions. Storing secrets in plain JSON increases the chance of local disclosure through backups, shared accounts, loose permissions, or other processes reading the file.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest explicitly advertises a live observation feed that can stream observations to multiple external messaging channels in real time, but it does not express meaningful trigger constraints, scoping limits, redaction rules, or exclusion conditions. In a memory/plugin context that records session observations, this creates a plausible data exfiltration path for sensitive prompts, code, secrets, or user content if the feature is enabled or misconfigured.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The top-level description says the plugin 'records observations from embedded runner sessions and streams them to messaging channels,' which normalizes automatic outbound sharing of session-derived data without stating any explicit opt-in, consent, or policy boundary. Although the schema later shows an 'enabled' flag defaulting to false, the description still presents a risky capability in a way that can mislead operators about privacy expectations and safe deployment.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill description uses broad activation language such as 'execute, run, or carry out a plan,' which can match many ordinary user requests and cause this high-authority orchestration skill to trigger too often. Because the skill is designed to deploy subagents and coordinate implementation work, overbroad invocation increases the chance of unintended autonomous actions on sensitive code or infrastructure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The plugin captures user prompts, assistant outputs, and tool results and sends them to a local worker service for storage and later retrieval, but this file contains no consent flow, notice, redaction, or opt-in around that data collection. Because these payloads can contain secrets, personal data, or sensitive workspace content, silent persistence materially increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The plugin writes MEMORY.md into the workspace based on content fetched from the worker, with no user warning or confirmation in this code path. This can expose previously captured sensitive context inside the project tree, where it may be committed, indexed, or read by other tools and agents unintentionally.

Ssd 3

High

• Confidence: 98% confidence
• Finding: This section instructs users to forward every new agent observation to third-party messaging platforms in real time. Because observations are derived from tool usage and session activity, they may include sensitive operational context, code snippets, secrets, or user data, creating a direct exfiltration path outside the gateway boundary.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The plugin is described as writing a full timeline of observations and summaries into MEMORY.md inside each agent workspace. Persisting comprehensive session context into workspace files expands the exposure surface to any process, user, backup system, or downstream tool with access to that directory.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The documentation states that every tool use is recorded, re-synced into persistent memory, and summarized across sessions. Capturing all tool activity creates a broad surveillance and retention mechanism that can unintentionally store credentials, proprietary material, and sensitive user content far beyond the original task context.

Ssd 3

High

• Confidence: 92% confidence
• Finding: The installer offers a feature that streams learned observations to external messaging channels in real time. Because those observations may contain sensitive project details, prompts, code insights, or operational data, enabling this can create a direct exfiltration path outside the local environment.

Ssd 3

High

• Confidence: 94% confidence
• Finding: This code writes persistent configuration for an external observation feed destination, causing future plugin activity to be transmitted to a specified chat target. Persisted outbound routing increases the blast radius because exfiltration can continue after installation without repeated user review.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The plugin persistently records prompts and tool observations, then separately supports forwarding observation summaries to external messaging channels. Even if the SSE notification only sends titles/subtitles, this design bridges sensitive internal activity into external systems, creating a meaningful risk of data leakage, cross-channel disclosure, and compliance issues.

Ssd 3

High

• Confidence: 90% confidence
• Finding: The event flow intentionally stores user prompts and observations for later summarization, context injection, and notification. In an agent skill, that makes the risk more serious because tool outputs and summaries can include credentials, proprietary code, customer data, or operational details that are later resurfaced or redistributed beyond the original interaction scope.

VirusTotal

65/65 vendors flagged this skill as clean.