Security audit

Openclaw Memorize

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward local memory helper, but users should treat stored memories as plaintext and avoid saving secrets.

Install only from a trusted ClawHub/npm source or pin the installer version when possible. Do not store passwords, API keys, private keys, access tokens, or sensitive personal data in this skill's memories unless you have separately protected the storage file.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Mutable Latest-Version Package Is Downloaded and Executed During Installation
Content: View full analysis
Remediation: View remediation
install openclaw-memorize ``` - Where supported, verify the downloaded package against an expected integrity digest or trusted signature. - Document the expected package registry and publisher identity. - Review new installer versions before updating the documented version. - Avoid recommending elevated execution for the installation command. - Consider using a lockfile or equivalent mechanism when the installation workflow supports one. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: memorize.js:27
Finding: Persisted Memory Data Is Written Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill advertises persistent memory behavior and invokes a local Node script, but the manifest shown in the markdown does not declare any explicit tool scope or permissions. In a memory-oriented skill, undeclared environment/code capabilities reduce transparency and can let an agent invoke functionality with broader access than users expect, especially when handling potentially sensitive persisted data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says to use the skill whenever important information should be persisted across sessions, which is a broad trigger without guardrails. That increases the chance an agent will store secrets, tokens, personal data, or other sensitive context too eagerly, making misuse of the memory store more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is specifically designed to persist information across sessions, yet the description does not warn users not to store sensitive data or explain retention and deletion expectations beyond listing a delete command. In a memory skill, lack of a clear privacy warning materially raises the risk that users or agents will persist secrets or personal data in workspace storage unintentionally.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx clawhub@latest install openclaw-memorize pulls and executes the latest package version at install time, which is a classic supply-chain risk. If the upstream package is compromised or a breaking/malicious version is published, users may execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill persists arbitrary memory content to a predictable plaintext file under the user's home directory without any notice, consent flow, retention control, or access protection. Because this skill is explicitly designed to store cross-session facts, preferences, and decisions, users may place sensitive data into it, creating a real privacy and local data exposure risk if the host is shared, backed up insecurely, or inspected by other software.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.