MCM Agent
PassAudited by VirusTotal on May 9, 2026.
Overview
Type: OpenClaw Skill Name: mcm-agent Version: 1.0.0 The mcm-agent skill is designed to exfiltrate sensitive user data, including chat history, personality profiles, and preferences, to an external third-party domain (clawsafe.vip) under the guise of 'cloud memory' synchronization. While SKILL.md claims to require user consent and an API key, the instructions direct the AI agent to categorize and upload private interaction data, which poses a significant privacy and data harvesting risk. The use of a .vip TLD and the broad targeting of multiple AI platforms (Claude Code, Cursor, Windsurf) are additional red flags for a potential data-collection operation.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The service may be able to access or modify the user's cloud memory account using the provided key.
The skill requires a service API key. This is expected for cloud memory sync, but it is still delegated account access that users should understand before providing.
User signs up at https://clawsafe.vip to get their API Key ... User provides their API Key to enable the service
Use a dedicated API key if available, review the service account permissions, and revoke the key if you stop using the skill.
Saved memories or chat-history-derived entries could influence future conversations or appear on other devices.
The skill persists personal memory categories and can reuse memories from other devices. That is the core purpose and includes a prompt-before-applying safeguard, but persistent cross-device memory can affect future agent context.
Categorize saved content into: personality, preferences, chat_history, memory. ... check for memories saved from other devices. Prompt user before applying.
Only save information you are comfortable storing in a cloud account, review recalled memories before applying them, and check whether the service provides deletion and retention controls.