Security audit

MemClawz

Security checks for vulnerabilities and agentic risk

Overview

This memory-system skill is purpose-aligned, but its installer and examples grant persistent execution and remote data-sharing paths with weak scoping and supply-chain controls.

Review this carefully before installing. Only run it in an isolated account or test environment, pin the Git repository and Qdrant artifacts to reviewed versions, inspect service files before enabling them, protect or avoid plaintext API keys, disable federation unless you explicitly need it, and do not use the public HTTP federation example with real memories.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.sh:9
Finding: Mutable Remote Repository Is Installed and Persistently Executed
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.sh:29
Finding: Unverified Mutable Qdrant Archive Is Downloaded and Executed
Content: View full analysis
/tmp/qdrant.log 2>&1 & ``` The Skill documentation also recommends: ```bash # Or binary (no Docker) curl -sL https://github.com/qdrant/qdrant/releases/latest/download/qdrant-x86_64-unknown-linux-musl.tar.gz | tar xz ./qdrant --storage-path ~/.openclaw/qdrant-storage & ``` ### Technical Analysis The installer retrieves the mutable `latest` Qdrant release and streams it directly into `tar`. It does not pin an exact version, verify a cryptographic checksum or signature, or inspect archive paths before extraction. It then executes the extracted `qdrant` file. TLS protects the transport connection but does not establish that the retrieved release is the exact artifact reviewed by the Skill author. A compromised upstream release, account, release workflow, or artifact would be executed automatically. Direct extraction also creates archive traversal or unintended overwrite risk if the archive contains malicious paths. The fallback is unnecessary when Docker is available, but the Docker path is also unpinned. A memory service may legitimately require Qdrant, but downloading a mutable executable without integrity verification grants more trust than necessary. ### Attack Path 1. An attacker compromises the upstream release process or causes the mutable `latest` artifact to reference a malicious archive. 2. The installer downloads the substituted archive without validating a fixed version, checksum, or signature. 3. `tar` extracts attacker-controlled content directl ...[truncated 817 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:53
Finding: API Credentials Are Stored in Plaintext Without Explicit Permission Hardening
Content: View full analysis
~/memclawz/.env << EOF OPENAI_API_KEY= ANTHROPIC_API_KEY= QDRANT_HOST=localhost QDRANT_PORT=6333 QDRANT_COLLECTION=yoniclaw_memories NEO4J_URI=bolt://localhost:7687 NEO4J_USER=neo4j NEO4J_PASSWORD= GRAPHITI_ENABLED=true FEDERATION_ENABLED=true FEDERATION_ROLE=master WORKSPACE_DIR=/home/yoniclaw/.openclaw/workspace EOF ``` ### Technical Analysis The instructions place OpenAI and Anthropic credentials in a plaintext `.env` file. They do not set a restrictive `umask`, create the file with mode `0600`, verify directory permissions, or use a secret-management facility. The resulting permissions depend on the user's ambient environment. Under a permissive umask, another local account or process may be able to read the credentials. Storing the file inside a Git repository directory also increases the chance of accidental inclusion in commits, archives, backups, or diagnostic bundles. The instructions additionally provide a fixed user-specific workspace path. This is not itself a privilege escalation, but it may encourage broad workspace access by persistent services. ### Attack Path 1. A user follows the documented configuration procedure and enters live provider credentials. 2. The `.env` file is created using ambient filesystem permissions. 3. Another local principal, an overly broad backup process, or an accidental repository commit obtains the file. 4. The exposed keys are used to invoke paid APIs, inspect associated account metadata where permitted, or impersonate the user to the relevant provider. ### Impact Assessment The immediate scope is disclosure of the OpenAI and Anthropic API keys and any Neo4j password later added to the file. Exposed provider credentials may permit unauthorized API usage and financial abuse up to the permissions and quotas assig ...[truncated 192 chars]
Remediation: View remediation

other

Error

Location: SKILL.md:127
Finding: Federation Example Uses a Hard-Coded External Host over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (18)

Credential Access

High

Category: Privilege Escalation
Confidence: 78% confidence
Finding: The skill instructs users to place multiple credentials in a plaintext .env file, including API keys and database connection details, without discussing file permissions, secret storage, or leakage risks. In multi-user systems or agent environments, such files are commonly exposed through logs, backups, process environments, or accidental repository inclusion.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
Configure

bash
cat > ~/memclawz/.env << EOF OPENAI_API_KEY=<your-key> ANTHROPIC_API_KEY=<your-key> QDRANT_HOST=localhost

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.
→ {"total_memories": N, "by_type": {...}, "by_agent": {...}, "by_source": {...}}

text
## Delete Memory

DELETE /api/v1/memory/<memory_id>

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 51)May include surrounding context.
Delete Memory

text
DELETE /api/v1/memory/<memory_id> → {"status": "deleted"}

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents shell-based installation, service management, and network operations but declares no tool scope or allowed-tools restrictions. In an agent setting, this can lead to overbroad execution authority where the skill may trigger privileged local commands without explicit containment or user awareness.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The Docker command uses the floating image reference qdrant/qdrant without a version tag or digest, making builds non-reproducible and exposing users to upstream image changes or supply-chain compromise. A later malicious or incompatible image could be pulled automatically and run as a persistent service.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill enables multiple user-level systemd services to start automatically and persist across sessions, including API, watcher, and cron components, without emphasizing the persistence and background execution implications. In an agent context, this expands the window for misuse, unintended data collection, and ongoing network/service exposure after the initial setup step.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
bash
cp ~/memclawz/systemd/*.service ~/.config/systemd/user/ systemctl --user daemon-reload systemctl --user enable --now neo4j memclawz-api memclawz-watcher memclawz-cron

Verify

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
Verify

bash
curl http://localhost:3500/health # {"status":"ok","version":"6.0.0","qdrant":"ok","neo4j":"ok","graphiti":"ok","federation":"ok",...}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The federation section explicitly supports pushing and pulling memories to remote nodes, including a public IP example, but provides no warning about privacy, data sensitivity, trust boundaries, or operator consent. Because this system handles agent memories and knowledge, remote synchronization can expose sensitive internal data, personal information, or operational context outside the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file documents a memory deletion operation that can permanently affect user data, but it provides no warning about the destructive nature of the action or any confirmation expectations. Under the markdown-file criteria, descriptions that omit warnings about behaviors affecting user data should be flagged.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The architecture states that conversation data is automatically extracted from the LCM database and sent to Mem0, Qdrant, and Anthropic/OpenAI-backed processing components, but it does not warn users that potentially sensitive conversation content may be transmitted to external AI services. This creates a real privacy and compliance risk because operators or users may enable or deploy the system without informed consent, data handling review, or tenant-specific restrictions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/install.sh (reported line 20)May include surrounding context.
sh
pip3 install -r requirements.txt # Check Qdrant if curl -s http://localhost:6333/healthz >/dev/null 2>&1; then echo "✅ Qdrant running" else echo "⚠️ Qdrant not running. Starting..."

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The installer pulls and runs the qdrant/qdrant Docker image without a pinned tag or digest, so the exact artifact executed can change over time and may be replaced by a compromised or malicious image upstream. In an install script that automatically starts long-lived services, this creates a real software supply chain risk because users implicitly trust and execute whatever image is current at install time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This installer makes persistent user-environment changes and immediately starts background services without prompting the user or clearly separating install from activation. That is dangerous because it can unexpectedly expose local services, consume resources, and create persistence mechanisms that survive the shell session, especially in an agent-memory system that deploys multiple components.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: Launching Qdrant with nohup ... & starts a detached background process that persists beyond the current shell session, without supervision, user confirmation, or easy visibility. In an automated installer, this is risky because it creates an unsupervised service from a freshly downloaded binary, which can continue listening locally and writing data after installation completes.
Content: Scanner excerpt · scripts/install.sh (reported line 31)May include surrounding context.
sh
else echo "📥 Downloading Qdrant binary..." curl -sL https://github.com/qdrant/qdrant/releases/latest/download/qdrant-x86_64-unknown-linux-musl.tar.gz | tar xz -C ~/memclawz/ nohup ~/memclawz/qdrant --storage-path ~/.openclaw/qdrant-storage > /tmp/qdrant.log 2>&1 & fi sleep 3 fi

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: Creating ~/.config/systemd/user and copying service files there establishes the mechanism for user-level persistence. In context, this is part of an installer that deploys long-running agent-memory services, so silently planting service units increases risk because the user may not realize background execution and restart behavior have been configured.
Content: Scanner excerpt · scripts/install.sh (reported line 37)May include surrounding context.
sh
fi # Deploy systemd services mkdir -p ~/.config/systemd/user cp ~/memclawz/systemd/*.service ~/.config/systemd/user/ systemctl --user daemon-reload systemctl --user enable --now memclawz-api memclawz-watcher

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: systemctl --user enable --now both starts the services immediately and configures them to persist across future user sessions. In a setup script, that creates lasting execution of code fetched from a repository without requiring a separate trust decision, increasing the blast radius if the repository or service definitions are unsafe.
Content: Scanner excerpt · scripts/install.sh (reported line 40)May include surrounding context.
sh
mkdir -p ~/.config/systemd/user cp ~/memclawz/systemd/*.service ~/.config/systemd/user/ systemctl --user daemon-reload systemctl --user enable --now memclawz-api memclawz-watcher echo "✅ MemClawz v5 installed!" echo "API: http://localhost:3500/health"

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill advertises sleep-time reflection that produces MEMORY.md update proposals without clearly warning that local knowledge artifacts may be automatically altered. In agent workflows, silent or poorly bounded updates to canonical memory files can corrupt trusted context, introduce prompt injection persistence, or overwrite user-authored knowledge.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The documentation describes an endpoint that changes persisted memory content but does not mention that it alters stored user data. For markdown skill documentation, operations affecting user data should include a brief caution so users understand the impact before using them.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

other

SkillSpector

Credential Access

Configure

Memory Manipulation

Tool Parameter Abuse

Delete Memory

Undeclared Tool Scope

Rp1

Session Persistence

Verify

External Transmission

Verify

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

Rp1

Missing User Warnings

Session Persistence

Session Persistence

Session Persistence

Missing User Warnings

Missing User Warnings

Static analysis