Official Claude-Mem OpenClaw Memory Plugin

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:58 PM UTC
• Version: 1.0.1

Overview

This persistent-memory plugin is mostly coherent with its stated purpose, but it needs Review because installation and memory access are too broad for the sensitivity of the data it handles.

Install only after reviewing the installer and the remote repository at the exact version you intend to run. Prefer a pinned, verified release, avoid passing API keys on the command line, restrict who can send OpenClaw commands, disable MEMORY.md sync or observation feeds in sensitive workspaces, and assume tool inputs and outputs may be retained unless the implementation adds truncation, redaction, and retention controls.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:7
• Finding: Mutable remote installers are executed directly through shell pipelines<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7-32`; related execution in `install.sh:520-526` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash ## Quick Install (Recommended) Run this one-liner to install everything automatically: ```bash curl -fsSL https://install.cmem.ai/openclaw.sh | bash ``` The installer handles dependency checks (Bun, uv), plugin installation, memory slot configuration, AI provider setup, worker startup, and optional observation feed configuration — all interactively. ### Install with options Pre-select your AI provider and API key to skip interactive prompts: ```bash curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY ``` For fully unattended installation: ```bash curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --non-interactive ``` To upgrade an existing installation: ```bash curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --upgrade ``` ``` The downloaded installer subsequently executes another mutable remote installer: ```bash install_bun() { info "Installing Bun runtime..." if ! curl -fsSL https://bun.sh/install | bash; then error "Failed to install Bun automatically" error "Please install manually:" error " curl -fsSL https://bun.sh/install | bash" error " Or: brew install oven-sh/bun/bun (macOS)" error "Then restart your terminal and re-run this installer." exit 1 fi ``` ### Technical Analysis The installation instructions pipe remotely served content directly into `bash`. The content obtained from `install.cmem.ai` and `bun.sh` is not pinned to an immutable version and is not verified using a checksum, digital signature, or trusted release key. Consequently, the code executed by users can differ from the code reviewed in this audit. HTTPS protects the connection in transit but does not protect against compromise of the hosting domai ...[truncated 1521 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `curl | bash` with separate download, verification, and execution steps. 2. Publish versioned installer artifacts and pin installation instructions to a specific release. 3. Publish SHA-256 checksums and preferably cryptographic signatures backed by a documented release key. 4. Require users to verify the checksum or signature before execution. 5. Avoid automatically executing Bun’s remote installer. Use trusted package repositories or a pinned, verified artifact. 6. Do not pass API keys through `--api-key`. Read them from a protected file descriptor, environment supplied by a secret manager, or an interactive hidden prompt. 7. Document the exact files, services, and configuration entries the installer will modify before execution. 8. Provide a dry-run mode and a complete uninstall procedure. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:615
• Finding: Installer builds and executes unpinned repository and package content<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:615-685`; related dependency declarations in `package.json:12-15` **Vulnerability Type**: Unpinned remote code and non-reproducible dependency resolution **Risk Level**: High ### Vulnerable Code ```bash CLAUDE_MEM_REPO="https://github.com/thedotmack/claude-mem.git" CLAUDE_MEM_BRANCH="${CLI_BRANCH:-main}" PLUGIN_FRESHLY_INSTALLED="" install_plugin() { # Check for git before attempting clone check_git CLAUDE_MEM_EXTENSION_DIR="$(resolve_extension_dir)" # Remove existing plugin installation to allow clean re-install local existing_plugin_dir="$CLAUDE_MEM_EXTENSION_DIR" if [[ -d "$existing_plugin_dir" ]]; then info "Removing existing claude-mem plugin at ${existing_plugin_dir}..." rm -rf "$existing_plugin_dir" fi local build_dir build_dir="$(mktemp -d)" register_cleanup_dir "$build_dir" info "Cloning claude-mem repository (branch: ${CLAUDE_MEM_BRANCH})..." if ! git clone --depth 1 --branch "$CLAUDE_MEM_BRANCH" "$CLAUDE_MEM_REPO" "$build_dir/claude-mem" 2>&1; then error "Failed to clone claude-mem repository" error "Check your internet connection and try again." exit 1 fi local plugin_src="${build_dir}/claude-mem/openclaw" # Build the TypeScript plugin info "Building TypeScript plugin..." if ! (cd "$plugin_src" && NODE_ENV=development npm install --ignore-scripts 2>&1 && npx tsc 2>&1); then error "Failed to build the claude-mem OpenClaw plugin" error "Make sure Node.js and npm are installed." exit 1 fi ``` Dependency declarations are ranges rather than immutable versions: ```json "devDependencies": { "@types/node": "^25.2.1", "typescript": "^5.3.0" } ``` No package lockfile appears in the supplied project structure. ### Technical Analysis The installer clones the mutable `main` branch by default and accepts an arbitrary branch through the undocumented parsing of `--branch`. It does not resolve and verify an expected c ...[truncated 1568 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the repository to an immutable, reviewed commit hash. 2. Prefer signed release tags and verify the signature before building. 3. Remove arbitrary branch installation from normal production workflows. 4. Commit a package lockfile and use `npm ci --ignore-scripts` instead of `npm install`. 5. Pin exact dependency versions rather than caret ranges for the installer build. 6. Generate and publish provenance or an SBOM for release artifacts. 7. Verify the hash of copied worker and plugin files before activation. 8. Build release artifacts in a controlled CI environment rather than compiling mutable source on the target system. 9. Preserve the existing working installation until the replacement has been verified, enabling atomic rollback on failure. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.ts:848
• Finding: Memory search and timeline commands lack explicit authorization enforcement<![CDATA[ ## Vulnerability Details **File Location**: `src/index.ts:848-979` **Vulnerability Type**: Missing authorization on access to persistent memory **Risk Level**: High ### Vulnerable Code The complete search-command registration does not set `requireAuth: true` or validate `ctx.isAuthorizedSender`: ```ts api.registerCommand({ name: "claude-mem-search", description: "Search Claude-Mem observations by query", acceptsArgs: true, handler: async (ctx) => { const raw = ctx.args?.trim() || ""; if (!raw) { return "Usage: /claude-mem-search <query> [limit]"; } const pieces = raw.split(/\s+/); const maybeLimit = pieces[pieces.length - 1]; const hasTrailingLimit = /^\d+$/.test(maybeLimit); const limit = hasTrailingLimit ? parseLimit(maybeLimit, 10) : 10; const query = hasTrailingLimit ? pieces.slice(0, -1).join(" ") : raw; const data = await workerGetJson( workerPort, `/api/search/observations?query=${encodeURIComponent(query)}&limit=${limit}`, api.logger, ); if (!data) { return "Claude-Mem search failed (worker unavailable or invalid response)."; } const items = Array.isArray(data.items) ? data.items : []; return [ `Claude-Mem Search: \"${query}\"`, summarizeSearchResults(items, limit), ].join("\n"); }, }); ``` The same authorization omission applies to: - `/claude-mem-recent` - `/claude-mem-timeline` - `/claude_mem_status` - `/claude_mem_feed` The command context explicitly exposes authorization state: ```ts interface PluginCommandContext { senderId?: string; channel: string; isAuthorizedSender: boolean; args?: string; commandBody: string; config: Record<string, unknown>; } ``` ### Technical Analysis The plugin API supports both a `requireAuth` command property and an `isAuthorizedSender` context field. None of the registered commands uses these controls. The search, recent-context, and timeline commands query information derive ...[truncated 1474 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `requireAuth: true` on every command that accesses memory, status, targets, or feed configuration. 2. Add defense-in-depth checks at the start of every handler: ```ts if (!ctx.isAuthorizedSender) { return { text: "Unauthorized." }; } ``` 3. Scope memory queries to the authorized sender’s project, agent, conversation, or tenant. 4. Do not allow arbitrary project selection unless the caller has administrative authorization. 5. Avoid disclosing configured feed target identifiers through broadly accessible status commands. 6. Add tests where `isAuthorizedSender` is `false` and verify that no worker request occurs. 7. Document the required gateway authorization configuration and fail closed when authorization metadata is unavailable. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.ts:645
• Finding: Complete tool inputs and outputs are persisted without truncation or secret redaction<![CDATA[ ## Vulnerability Details **File Location**: `src/index.ts:645-663`; contradictory documentation at `SKILL.md:405` **Vulnerability Type**: Excessive sensitive-data collection and insecure persistence **Risk Level**: High ### Vulnerable Code ```ts // Extract result text from all content blocks let toolResponseText = ""; const content = event.message?.content; if (Array.isArray(content)) { toolResponseText = content .filter((block) => (block.type === "tool_result" || block.type === "text") && "text" in block) .map((block) => String(block.text)) .join("\n"); } // Fire-and-forget: send observation + sync MEMORY.md in parallel workerPostFireAndForget(workerPort, "/api/sessions/observations", { contentSessionId, tool_name: toolName, tool_input: event.params || {}, tool_response: toolResponseText, cwd: "", }, api.logger); ``` The documentation states that tool responses are truncated: ```text tool_result_persist — Records observation (fire-and-forget), re-syncs MEMORY.md (fire-and-forget). Tool responses are truncated to 1000 characters. ``` No such truncation appears in the audited implementation. ### Technical Analysis Every persisted tool event sends: - The complete `event.params` object - The full concatenated tool-result text - The tool name - The session identifier No maximum length, field allowlist, secret detector, content classification, or sensitive-tool exclusion is applied in this code. Tool output commonly contains source files, configuration files, environment data, command output, access tokens, private keys, personal information, and proprietary content. The worker uses this data to build persistent observations. Those observations can subsequently influence `MEMORY.md`, memory-query responses, and—when explicitly enabled—external observation feeds. This behavior also exceeds the documented collection boundary because the guide promises a 1,000-character truncation that the implementation does not enforce. # ...[truncated 1277 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce the documented length limit before serialization: ```ts const MAX_TOOL_RESPONSE_LENGTH = 1000; toolResponseText = toolResponseText.slice(0, MAX_TOOL_RESPONSE_LENGTH); ``` 2. Apply independent size limits to tool parameters and individual fields. 3. Use an allowlist of tools and parameter fields suitable for memory capture rather than collecting every tool by default. 4. Exclude secret-management, environment, credential, shell-history, authentication, and private-key operations. 5. Redact common credential formats, authorization headers, tokens, cookies, private keys, passwords, and connection strings. 6. Make tool capture opt-in with an explicit disclosure of what is stored and where it may be transmitted. 7. Add retention limits and secure deletion controls. 8. Isolate memories by tenant, conversation, project, and agent. 9. Add automated tests proving truncation and redaction occur before the worker request. 10. Ensure external observation feeds receive only separately sanitized summaries. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:1022
• Finding: AI-provider API keys are written without explicit restrictive file permissions<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:1022-1106` **Vulnerability Type**: Plaintext credential storage with unsafe default permissions **Risk Level**: Medium ### Vulnerable Code The API key is transferred into the Node process and placed in the settings object: ```bash INSTALLER_AI_PROVIDER="$AI_PROVIDER" \ INSTALLER_AI_API_KEY="$AI_PROVIDER_API_KEY" \ INSTALLER_SETTINGS_FILE="$settings_file" \ node -e " const fs = require('fs'); const path = require('path'); const homedir = require('os').homedir(); const provider = process.env.INSTALLER_AI_PROVIDER; const apiKey = process.env.INSTALLER_AI_API_KEY || ''; const settingsPath = process.env.INSTALLER_SETTINGS_FILE; ``` Provider-specific settings persist the key: ```js const overrides = { CLAUDE_MEM_PROVIDER: provider }; if (provider === 'claude') { overrides.CLAUDE_MEM_CLAUDE_AUTH_METHOD = 'cli'; } else if (provider === 'gemini') { overrides.CLAUDE_MEM_GEMINI_API_KEY = apiKey; overrides.CLAUDE_MEM_GEMINI_MODEL = 'gemini-2.5-flash-lite'; } else if (provider === 'openrouter') { overrides.CLAUDE_MEM_OPENROUTER_API_KEY = apiKey; overrides.CLAUDE_MEM_OPENROUTER_MODEL = 'xiaomi/mimo-v2-flash:free'; } ``` The file is then written without an explicit mode: ```js fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2)); ``` The surrounding directory is likewise created without an explicit permission mode: ```bash mkdir -p "$settings_dir" ``` ### Technical Analysis The installer persists Gemini or OpenRouter API keys in plaintext at `~/.claude-mem/settings.json`. Neither directory creation nor file creation specifies restrictive permissions, and the script does not establish a protective `umask`. Actual permissions therefore depend on the caller’s environment. Under a common `022` umask, a newly created regular file can be readable by other local users. Existing files may also retain previously permissive permissions after being overwritten. Environment va ...[truncated 1005 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set a restrictive umask near the start of credential-handling operations: ```bash umask 077 ``` 2. Create the data directory with mode `0700`. 3. Open or create the settings file with mode `0600`, and explicitly correct permissions on existing files. 4. Write to a protected temporary file in the same directory, `fsync` it if appropriate, set mode `0600`, and atomically rename it. 5. Prefer an operating-system credential store or dedicated secret manager over a plaintext JSON file. 6. Separate non-sensitive settings from credentials. 7. Never recommend supplying the key through a command-line argument. 8. Add an installer check that refuses to continue if credential files are group- or world-readable. 9. Avoid printing any portion of a key unless explicitly required; even masked suffixes may assist correlation. ]]>

T06 · System Persistence

Error

• Location: install.sh:1175
• Finding: Downloaded worker code is launched as a detached background process<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:1175-1216` **Vulnerability Type**: Persistent execution of remotely acquired code **Risk Level**: High ### Vulnerable Code ```bash start_worker() { info "Starting claude-mem worker service..." if ! find_claude_mem_install_dir; then error "Cannot find claude-mem plugin installation directory" error "Expected worker-service.cjs in one of:" error " ~/.openclaw/extensions/claude-mem/plugin/scripts/" error " ~/.claude/plugins/marketplaces/thedotmack/plugin/scripts/" echo "" error "Try reinstalling the plugin and re-running this installer." return 1 fi local worker_script="${CLAUDE_MEM_INSTALL_DIR}/plugin/scripts/worker-service.cjs" local log_dir="${HOME}/.claude-mem/logs" local log_date log_date="$(date +%Y-%m-%d)" local log_file="${log_dir}/worker-${log_date}.log" mkdir -p "$log_dir" # Ensure bun path is available if [[ -z "$BUN_PATH" ]]; then if ! find_bun_path; then error "Bun not found — cannot start worker service" return 1 fi fi # Start worker in background with nohup CLAUDE_MEM_WORKER_PORT=37777 nohup "$BUN_PATH" "$worker_script" \ >> "$log_file" 2>&1 & WORKER_PID=$! # Write PID file for future management local pid_file="${HOME}/.claude-mem/worker.pid" mkdir -p "${HOME}/.claude-mem" INSTALLER_PID_FILE="$pid_file" INSTALLER_WORKER_PID="$WORKER_PID" node -e " const info = { pid: parseInt(process.env.INSTALLER_WORKER_PID, 10), port: 37777, startedAt: new Date().toISOString(), version: 'installer' }; require('fs').writeFileSync(process.env.INSTALLER_PID_FILE, JSON.stringify(info, null, 2)); " success "Worker process started (PID: ${WORKER_PID})" info "Logs: ${log_file}" } ``` ### Technical Analysis The installer starts worker code using `nohup` and backgrounds it. The process can therefore remain active after the installation shell exits. Detached executio ...[truncated 1514 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not start the worker automatically without explicit, informed user confirmation. 2. Verify the worker against a signed release and immutable checksum before execution. 3. Run the worker under a dedicated least-privileged account with access only to required data directories. 4. Use a transparent service manager configuration with explicit lifecycle, logging, and sandbox controls rather than ad hoc `nohup`. 5. Apply filesystem, network, and process restrictions appropriate to the platform. 6. Provide clear status, stop, disable, and uninstall commands. 7. Record and display the exact verified worker version and source commit. 8. Bind the worker only to loopback and require authentication for sensitive administrative endpoints. 9. Validate PID ownership and executable identity before sending shutdown signals. 10. Document that the worker persists beyond the installer process and continuously handles agent-derived data. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (66)

External Script Fetching

High

• Category: Supply Chain

Content

Run this one-liner to install everything automatically:

```bash
curl -fsSL https://install.cmem.ai/openclaw.sh | bash
```

The installer handles dependency checks (Bun, uv), plugin installation, memory slot configuration, AI provider setup, worker startup, and optional observation feed configuration — all interactively.

• Confidence: 99% confidence
• Finding: The guide instructs users to fetch and immediately execute a remote shell script via curl piped to bash. This prevents meaningful inspection of the installer before execution and creates a high-risk supply-chain vector: if the remote host, DNS, TLS termination, or published script is compromised, arbitrary code executes on the target system.

Chaining Abuse

High

• Category: Tool Misuse

Content

Run this one-liner to install everything automatically:

```bash
curl -fsSL https://install.cmem.ai/openclaw.sh | bash
```

The installer handles dependency checks (Bun, uv), plugin installation, memory slot configuration, AI provider setup, worker startup, and optional observation feed configuration — all interactively.

• Confidence: 98% confidence
• Finding: The '| bash' construct is the dangerous chaining step that turns network retrieval into immediate code execution. In this skill context, the command is presented as the recommended install path, which increases the likelihood that users will run it without inspection and exposes gateway hosts to arbitrary installer behavior.

External Script Fetching

High

• Category: Supply Chain

Content

Pre-select your AI provider and API key to skip interactive prompts:

```bash
curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY
```

For fully unattended installation (defaults to Claude Max Plan, skips observation feed):

• Confidence: 99% confidence
• Finding: This variant still executes a remotely fetched script directly, now additionally passing an API key on the command line. Besides arbitrary code execution risk from the unverified installer, command-line secrets may be exposed through shell history, process listings, logs, or audit systems.

External Script Fetching

High

• Category: Supply Chain

Content

For fully unattended installation (defaults to Claude Max Plan, skips observation feed):

```bash
curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --non-interactive
```

To upgrade an existing installation (preserves settings, updates plugin):

• Confidence: 98% confidence
• Finding: The unattended installation command executes remote code without review and removes interactive friction that might otherwise prompt users to inspect options or understand side effects. In automated environments, this can silently deploy compromised code at scale if the installer source is tampered with.

External Script Fetching

High

• Category: Supply Chain

Content

To upgrade an existing installation (preserves settings, updates plugin):

```bash
curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --upgrade
```

After installation, skip to [Step 4: Restart the Gateway and Verify](#step-4-restart-the-gateway-and-verify) to confirm everything is working.

• Confidence: 98% confidence
• Finding: The upgrade path repeats the same unsafe remote-script execution pattern. Because upgrades often run on already trusted systems and may occur routinely, a compromised update script could provide an efficient mechanism for broad code execution across existing deployments.

External Script Fetching

High

• Category: Supply Chain

Content

You'll need **bun** installed for the worker service. If you don't have it:

```bash
curl -fsSL https://bun.sh/install | bash
```

### Step 2: Get the Worker Running

• Confidence: 97% confidence
• Finding: The bun installation instruction also uses curl piped to bash, carrying the same arbitrary code execution and supply-chain risks as the main installer. Even if common in ecosystem docs, it remains unsafe because users execute unaudited remote code with their local privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

You'll need **bun** installed for the worker service. If you don't have it:

```bash
curl -fsSL https://bun.sh/install | bash
```

### Step 2: Get the Worker Running

• Confidence: 97% confidence
• Finding: This chaining pattern again causes unaudited remote content to execute immediately in the user's shell. Because it installs a runtime dependency, compromise at this stage can taint the broader environment and any later plugin operations running on the host.

Instruction Override

High

• Category: Prompt Injection

Content

Channel type: `discord`

To find your channel ID:
1. Enable Developer Mode in Discord: Settings → Advanced → Developer Mode
2. Right-click the target channel → Copy Channel ID

```json

• Confidence: 70% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Instruction Override

High

• Category: Prompt Injection

Content

Channel type: `discord`

To find your channel ID:
1. Enable Developer Mode in Discord: Settings → Advanced → Developer Mode
2. Right-click the target channel → Copy Channel ID

```json

• Confidence: 70% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

External Script Fetching

High

• Category: Supply Chain

Content

# Installs the claude-mem persistent memory plugin for OpenClaw gateways.
#
# Usage:
#   curl -fsSL https://install.cmem.ai/openclaw.sh | bash
#   # Or with options:
#   curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY
#   # Direct execution:

• Confidence: 98% confidence
• Finding: The installer explicitly recommends `curl ... | bash`, which executes remote network content immediately without inspection, integrity verification, or pinning. This pattern is especially dangerous for an installer that modifies configs, downloads more code, and starts background services.

Chaining Abuse

High

• Category: Tool Misuse

Content

# Installs the claude-mem persistent memory plugin for OpenClaw gateways.
#
# Usage:
#   curl -fsSL https://install.cmem.ai/openclaw.sh | bash
#   # Or with options:
#   curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY
#   # Direct execution:

• Confidence: 97% confidence
• Finding: The `| bash` chaining pattern removes any inspection boundary between downloading and executing code, making content tampering, server compromise, or CDN hijack immediately exploitable. In this installer context, that would allow arbitrary code execution plus persistent system and config changes.

External Script Fetching

High

• Category: Supply Chain

Content

# Usage:
#   curl -fsSL https://install.cmem.ai/openclaw.sh | bash
#   # Or with options:
#   curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --provider=gemini --api-key=YOUR_KEY
#   # Direct execution:
#   bash install.sh [--non-interactive] [--upgrade] [--provider=claude|gemini|openrouter] [--api-key=KEY]

• Confidence: 98% confidence
• Finding: This usage example again encourages executing fetched remote installer code directly while also passing secrets as arguments. The combination amplifies risk because users both trust unverified code and expose credentials during execution.

External Script Fetching

High

• Category: Supply Chain

Content

done

###############################################################################
# TTY detection — ensure interactive prompts work under curl | bash
# When piped, stdin reads from curl's output, not the terminal.
# We open /dev/tty on fd 3 and read interactive input from there.
###############################################################################

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

done

###############################################################################
# TTY detection — ensure interactive prompts work under curl | bash
# When piped, stdin reads from curl's output, not the terminal.
# We open /dev/tty on fd 3 and read interactive input from there.
###############################################################################

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

done

###############################################################################
# TTY detection — ensure interactive prompts work under curl | bash
# When piped, stdin reads from curl's output, not the terminal.
# We open /dev/tty on fd 3 and read interactive input from there.
###############################################################################

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

done

###############################################################################
# TTY detection — ensure interactive prompts work under curl | bash
# When piped, stdin reads from curl's output, not the terminal.
# We open /dev/tty on fd 3 and read interactive input from there.
###############################################################################

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

done

###############################################################################
# TTY detection — ensure interactive prompts work under curl | bash
# When piped, stdin reads from curl's output, not the terminal.
# We open /dev/tty on fd 3 and read interactive input from there.
###############################################################################

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

done

###############################################################################
# TTY detection — ensure interactive prompts work under curl | bash
# When piped, stdin reads from curl's output, not the terminal.
# We open /dev/tty on fd 3 and read interactive input from there.
###############################################################################

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Chaining Abuse

High

• Category: Tool Misuse

Content

done

###############################################################################
# TTY detection — ensure interactive prompts work under curl | bash
# When piped, stdin reads from curl's output, not the terminal.
# We open /dev/tty on fd 3 and read interactive input from there.
###############################################################################

• Confidence: 70% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Script Fetching

High

• Category: Supply Chain

Content

install_bun() {
  info "Installing Bun runtime..."

  if ! curl -fsSL https://bun.sh/install | bash; then
    error "Failed to install Bun automatically"
    error "Please install manually:"
    error "  curl -fsSL https://bun.sh/install | bash"

• Confidence: 99% confidence
• Finding: The script installs Bun by piping a remote script from `https://bun.sh/install` directly into `bash`, executing third-party code with full user privileges and no integrity verification. This is a classic supply-chain risk and broadens the trusted computing base during installation.

External Script Fetching

High

• Category: Supply Chain

Content

if ! curl -fsSL https://bun.sh/install | bash; then
    error "Failed to install Bun automatically"
    error "Please install manually:"
    error "  curl -fsSL https://bun.sh/install | bash"
    error "  Or: brew install oven-sh/bun/bun (macOS)"
    error "Then restart your terminal and re-run this installer."
    exit 1

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This plugin persistently records user prompts, tool inputs/results, and assistant outputs, then republishes observation summaries to messaging channels such as Telegram, Slack, Discord, and others. In this skill context, that behavior is especially dangerous because the plugin is explicitly designed to observe agent activity, so sensitive operational data may be stored and broadcast outside the original execution context.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
echo "1.2.0"
FAKEBUN
  chmod +x "${fake_home}/.bun/bin/bun"

  # Hide bun from PATH
  local saved_path="$PATH"

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Writing the full observation timeline to MEMORY.md in each agent workspace creates a persistent local disclosure channel across sessions. Future agents, tools, or users with access to the workspace may read accumulated historical observations that were not intended for them, increasing the blast radius of any sensitive data captured by the memory system.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide encourages enabling a real-time observation feed to Telegram/Discord/Slack and similar services without a prominent privacy warning about what data may be transmitted. Because observations are derived from agent tool usage and may include sensitive workspace content, credentials, internal code details, or user data, this creates a meaningful risk of unintended disclosure to third-party platforms.