Memcord

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 4.0.1

Overview

This memory skill is coherent, but it stores and recalls chat history broadly while running an unpinned external package that is not included for review.

Review before installing. Use this only if you are comfortable with chat history being persisted locally in plaintext and potentially recalled automatically in later sessions. Prefer an exact pinned version of the memcord package, verify its source, and avoid saving sensitive conversations unless you have clear consent and know where the files are stored and how to delete them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:8

Finding

Unpinned Third-Party Package Is Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–10 and 28–29
Vulnerability Type: Unpinned executable dependency
Risk Level: High

Vulnerable Code

yaml

install:
  - kind: uv
    package: memcord

The documented runtime configuration also executes the same unpinned package:

json5

command: "uvx",
args: ["memcord"],

Technical Analysis

The skill delegates all of its functionality to the third-party memcord package without specifying an exact version, cryptographic hash, lockfile, immutable source revision, or trusted package-index configuration. Executing uvx memcord can therefore resolve and run a package version that differs from the version originally reviewed.

Because the artifact contains only SKILL.md and no implementation of the MCP server, the package's behavior cannot be independently verified from the audited project. In particular, the claims that conversation data remains on the device and is stored only in local JSON files cannot be confirmed.

This creates a supply-chain risk: a compromised package release, registry-account takeover, package ownership transfer, or malicious future release could cause attacker-controlled code to run when OpenClaw starts the configured MCP server.

Attack Path

1. An attacker compromises the package publisher, distribution account, package source, or a future memcord release.
2. The attacker publishes a malicious package version under the dependency name used by the skill.
3. A user installs the skill or launches the documented MCP configuration.
4. uv or uvx resolves the unpinned dependency to the attacker-controlled version.
5. uvx memcord executes the malicious package with the privileges of the OpenClaw user.
6. The package can abuse its local process access and MCP role to inspect or misuse conversation data and any other resources accessible to that user.

Impact Assessment

Successful explo ...[truncated 533 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin memcord to an exact, independently audited version in both installation and runtime configuration.
2. Use a lockfile with cryptographic hashes so package contents are reproducible and integrity-checked.
3. Explicitly configure a trusted package index rather than relying on implicit resolver settings.
4. Prevent uvx from automatically selecting newer releases at runtime.
5. Prefer bundling reviewable server source code or referencing an immutable, verified source revision.
6. Verify package signatures or hashes before execution and establish a controlled dependency-update review process.
7. Run the MCP server with least privilege, restricted filesystem access, minimal environment exposure, and network isolation where feasible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages persistent storage of conversation history but does not clearly warn users, at the point of use, that invoking auto-save writes potentially sensitive chat content to local plaintext JSON files. This creates a privacy and consent risk because users may disclose secrets or personal data without understanding that the data will be retained beyond the current session.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guidance to call memcord_read at the start of a new session whenever continuity is expected is overly broad and can prompt automatic retrieval of stored prior conversations without a specific user request. That can expose sensitive historical context unnecessarily, increasing the chance of privacy leakage or cross-context disclosure to someone using the same environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.