Nowledge Mem Openclaw Plugin

• Outcome: Pass
• Latest audit: Aug 31, 2026 · 9:35 AM UTC
• Version: 0.8.34

Overview

This is a disclosed cross-tool memory plugin that persistently captures and searches conversations, so it is privacy-sensitive but coherent with its stated purpose.

Install only if you want OpenClaw conversations to become persistent searchable memory. Review sessionDigest, remote apiUrl/apiKey, captureExclude, and #nmem-skip before use; choose minimal mode with sessionDigest=false for manual-only memory, especially for sensitive or regulated work.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (31)

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The method contract says it patches only a single Working Memory section without affecting the rest of the document, but the fallback path performs a read-modify-write of the entire document via PUT. In concurrent use, another actor can update Working Memory between the read and write, causing unrelated sections to be lost or overwritten; this can corrupt state and violate caller assumptions about scoped updates.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This hook injects always-on system-level guidance on every turn directing the agent to proactively search a user's personal knowledge graph and autonomously save conversation-derived information. Because it operates in privileged prompt space and is not scoped to explicit user consent, task relevance, or a declared manifest purpose in this file, it can drive over-collection and persistence of sensitive user data beyond user expectations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document describes automatic thread capture and LLM-based distillation of conversations, but does not pair that behavior with a clear user-facing notice, consent model, or prominent privacy warning. In a memory plugin, this can lead to unintended retention and secondary processing of sensitive conversation content, especially if users assume only explicit save actions persist data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes unconditional end-of-session thread capture and optional LLM distillation of conversations, but the privacy implications are not surfaced as a strong, upfront warning at the point of installation or before enabling capture. Because this plugin stores conversation content persistently and may sync it to a local or remote backend, users may enable it without fully understanding the retention and privacy consequences, especially in sensitive or regulated environments.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill includes a remote configuration example that places an API key directly in a JSON file without warning users not to commit, share, or broadly expose that secret. In an installation guide, users often copy examples verbatim; this can lead to credential leakage via shell history, screenshots, backups, dotfile repos, or overly permissive file access, especially because the example uses a real config path under the user's home directory.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The plugin exposes broad session-context and memory-capture capabilities, and the surrounding manifest shows end-of-session capture enabled by default. In a memory/context-engine skill, this creates a real privacy and data-boundary risk because conversation content can be persistently stored or later reinjected without a narrowly scoped activation boundary.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manifest explicitly sets sessionDigest to enabled by default and describes capturing conversation threads and distilling them via an LLM at session end. That is a genuine privacy/security concern because users may unintentionally persist sensitive prompts, credentials, or proprietary data without a prominent warning or informed consent flow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The remote server settings allow the plugin to connect to a non-local API endpoint, but the help text does not prominently warn that conversation-derived memories may be transmitted off-device. In a memory plugin that captures and distills session content, this omission materially increases the risk of unintended disclosure to remote infrastructure.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation criteria are extremely broad and include many common conversational situations such as discussing prior work, plans, preferences, or decisions. In a memory skill that can search and persist cross-tool conversation history, over-broad triggering increases the chance of unnecessary invocation, excessive data access, and inadvertent exposure or retention of sensitive user information.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to save conversation-derived facts, preferences, plans, and context proactively without waiting to be asked, but provides no requirement to inform the user or obtain consent. Because this memory system spans multiple AI tools and imported sources, silent persistence can create significant privacy, retention, and cross-context data leakage risks far beyond the current conversation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The /forget command will automatically delete the top search result when its similarity score is at least 0.85, without requiring explicit user confirmation of the exact memory ID. This creates a real integrity risk because an ambiguous or slightly mistaken query can permanently remove the wrong memory, especially when semantic search returns a high-confidence but incorrect match.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The afterTurn handler automatically captures conversation threads on every turn and sends full message/session content into memory-processing functions, with no explicit consent or sensitivity gate visible in this file. This creates a realistic privacy and data-handling risk because secrets, personal data, or regulated content may be persisted and later reused beyond the user's immediate expectation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code propagates parent working memory and recalled memories into child sessions automatically, which can expose user-specific context to subagents that may not need it. If subagents operate with different tools, scopes, or prompts, this broadens the trust boundary and increases the chance of oversharing sensitive information across execution contexts.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The supplement automatically forwards recall queries and memory lookup identifiers to the Nowledge Mem client as part of the host's recall pipeline, with no visible consent, warning, or policy gate in this code path. Because this runs on every turn and can expose user prompts, search terms, and internal memory references to another subsystem or service, it creates a privacy and data-governance risk if users or operators do not explicitly understand that this access occurs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guidance explicitly tells the model to 'Save autonomously' decisions, preferences, plans, procedures, or learnings without waiting to be asked, but this file contains no disclosure, consent flow, or visibility mechanism for the user. In a memory-enabled assistant, that creates a real privacy and data-governance risk because personal or sensitive information may be persisted silently and repeatedly across conversations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code builds a plaintext conversation transcript from user and assistant messages, persists it via thread capture, and may send it to external triage/distillation services through client.triageConversation and client.distillThread. There is no consent, notice, redaction, or sensitivity gating in this file, so normal user content—including secrets or regulated data present in conversation history—can be exfiltrated beyond the immediate runtime boundary.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: resolveHookMessages falls back to reading an arbitrary sessionFile and loadMessagesFromSessionFile parses its contents into messages that are later appended to threads and potentially distilled externally. Because this path ingests file-backed conversation data without any visible provenance validation, disclosure, or redaction, sensitive local session contents can be silently persisted or transmitted onward.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The handler builds a search query from the latest user message and recent conversation context, then sends it to `client.searchRich(...)`. Because short queries are deliberately augmented with prior user/assistant messages, potentially sensitive conversation content can be disclosed to an external search backend without any consent check, notice, redaction, or policy gate in this code path. The warning text added later to the prompt only constrains the model's use of recalled content; it does not mitigate the outbound data exposure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This file registers automatic recall and conversation-capture hooks that can collect and re-inject prior conversation data, but there is no explicit user-facing consent, warning, or gating visible here. In a memory plugin, silently enabling lifecycle capture and prompt-time recall increases privacy risk because sensitive user or agent content may be persisted or resurfaced unexpectedly, especially when remote mode is configured.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The tool is explicitly designed to proactively search a user's knowledge graph and also return snippets from prior conversations, but this file contains no consent gate, purpose limitation, or user-visible notice before transmitting the current query and exposing historical thread content. In agent environments, this can cause over-collection and unintended resurfacing of sensitive personal or confidential information simply because the model inferred that prior context might be useful.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The tool description explicitly tells the agent to save conversation-derived information to the user's permanent knowledge graph proactively, without requiring an explicit consent step or a clear privacy/persistence warning. That creates a real privacy and data-governance risk because sensitive, regulated, or unnecessary personal information could be retained long-term based only on conversational context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This tool is explicitly designed to retrieve and return full conversation thread contents, which can include sensitive historical messages, and it exposes them wholesale to the caller without any built-in consent check, redaction, scope limitation, or user-facing warning. In a memory/thread retrieval context, this increases the risk of overexposing unrelated private data from prior conversations if a thread ID is obtained or inferred by an agent or downstream component.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This tool is explicitly designed to search and return snippets from past conversations, but it performs no authorization, consent, or contextual privacy checks before exposing potentially sensitive historical message content. In an agent setting, this can leak personal, confidential, or cross-session data to a user or downstream model that should not have access to prior threads.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The assemble logic retrieves startup context and recalled memories, escapes them for prompt inclusion, and appends them into systemPromptAddition. Although prompt escaping helps against prompt-structure injection, it does not prevent sensitive natural-language content from being surfaced to the model, where it can influence outputs, appear in summaries, or be exposed downstream.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The instruction to "Call this proactively — don't wait to be asked" encourages autonomous persistence of user-provided content without explicit request, confirmation, or sensitivity checks. In an agent setting, this can lead to over-collection of personal data, retention of transient or confidential details, and user expectations being violated because memory writes happen silently in the background.

Static analysis

No suspicious patterns detected.