Clawhub Memory Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 5.0.2

Overview

This disclosed memory skill should go to Review because it automatically stores all conversations and installs persistent maintenance and agent-instruction changes without enough scoping or rollback detail.

Install only if you intentionally want this plugin to retain and search conversation history automatically. Before enabling it, inspect the installed setup script, pin or verify the package version, and confirm where data is stored, whether embeddings leave the machine, how to delete/export memories, what cron jobs and instruction patches are created, and how to fully uninstall them.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:39

Finding

Persistent Scheduled Tasks and Agent Instruction Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-45
Vulnerability Type: Persistent scheduled execution and durable agent-state modification
Risk Level: High

Vulnerable Code:

bash

## Install

```bash
openclaw plugins install @icex-labs/openclaw-memory-engine
bash ~/.openclaw/extensions/memory-engine/setup.sh
openclaw gateway restart

Setup handles: interactive core memory, legacy data migration, quality pass, maintenance crons, agent instruction patching. One command.

text

### Technical Analysis

The documented setup procedure executes a package-provided shell script. The description explicitly states that this script creates maintenance cron jobs and patches agent instructions.

Cron jobs survive the initial installation process and execute code in future sessions. Agent instruction patches also create durable state capable of changing subsequent agent behavior. The repository contains only `SKILL.md`; therefore, the exact scheduled commands, execution frequency, modified instruction files, and rollback behavior cannot be audited.

Although persistence may support legitimate memory maintenance, silently combining scheduled execution and instruction modification into one setup command creates a high-impact trust boundary. Any malicious or compromised package release could use these mechanisms to retain execution or behavioral influence after installation.

### Attack Path

1. An attacker compromises the package publisher, package release process, or distributed setup script.
2. A user follows the documented installation procedure.
3. The user executes `setup.sh` under their account.
4. The script creates package-controlled cron jobs and modifies persistent agent instructions.
5. The installed jobs continue executing after the installation session ends.
6. Modified instructions continue influencing later agent sessions until manually identified and removed.

### Impact Assessmen
...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic cron creation and agent instruction patching from the default setup path.
• Require separate, explicit user consent for each persistent modification.
• Display the exact cron entries, commands, schedules, target instruction files, and proposed diffs before installation.
• Restrict scheduled tasks to a dedicated least-privileged account or sandbox.
• Provide documented commands that completely remove cron entries, instruction changes, stored data, and installed components.
• Make maintenance an opt-in operation that can be invoked manually instead of installing a persistent task.
• Include the setup implementation in the reviewed project so its behavior can be independently audited.
• Record all persistent changes in a machine-readable installation manifest to support verification and rollback.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:39

Finding

Unpinned Third-Party Package Is Installed and Its Shell Script Is Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-43
Vulnerability Type: Mutable third-party dependency execution
Risk Level: High

Vulnerable Code:

bash

## Install

```bash
openclaw plugins install @icex-labs/openclaw-memory-engine
bash ~/.openclaw/extensions/memory-engine/setup.sh
openclaw gateway restart

text

### Technical Analysis

The installation command does not specify an exact package version or integrity digest. It therefore resolves mutable content associated with the package name at installation time. The next command directly executes a shell script supplied by that installed package.

The npm and GitHub references point to recognizable hosting services, and the provided project contains no evidence that the named package is currently malicious. However, the absence of version and integrity pinning means the code ultimately executed may differ from the code reviewed or expected. The package source and `setup.sh` are not included in the submitted project, preventing verification of their behavior.

This creates a supply-chain execution path in which compromise of the publisher account, package registry, release process, or upstream repository can result in arbitrary commands being run under the installing user's account.

### Attack Path

1. An attacker compromises the package publisher credentials or release pipeline.
2. The attacker publishes a modified package version under the legitimate package name.
3. A user runs the unversioned plugin installation command.
4. The package manager resolves and installs the attacker-controlled release.
5. The user executes the installed `setup.sh`.
6. The script executes with the user's privileges and may modify files, configuration, scheduled tasks, or accessible application data.

### Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user performing installation. Based on th
...[truncated 292 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific audited version rather than resolving the latest release.
• Verify the package using a cryptographic integrity digest or trusted package signature.
• Include or vendor the setup script in the reviewed project so users can inspect the exact code before execution.
• Avoid instructing users to execute package-provided shell scripts directly.
• Run installation in a sandbox with minimal filesystem, network, and process permissions.
• Verify publisher identity and release provenance through signed releases and reproducible builds.
• Require review and approval before dependency updates.
• Document the expected hashes and files created by installation so users can detect unauthorized changes.

other

Error

• Location: SKILL.md:28

Finding

Automatic Capture and Persistent Storage of All Conversation Messages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-34
Vulnerability Type: Excessive sensitive-data collection and retention
Risk Level: High

Vulnerable Code:

text

## What It Does

Two hooks passively capture every conversation. No "let me save that" — memory just happens.

User sends message → hook auto-stores fact + graph triple + embedding Agent replies → hook auto-stores reply (deduped)

text

Technical Analysis

The skill states that two hooks passively capture every conversation and automatically store both user messages and agent replies. Stored representations include facts, graph triples, embeddings, episodic information, and behavioral reflections.

Conversations may contain credentials, authentication tokens, medical information, personal identifiers, confidential business data, or sensitive tool output. The documentation does not specify default exclusions, secret redaction, encryption, retention limits, access-control boundaries, consent prompts, or secure deletion behavior.

The submitted project provides no implementation, so the storage location and any network transmission cannot be verified. There is no evidence in the supplied file of external exfiltration. The confirmed risk is broad, automatic, persistent collection without documented data-minimization safeguards.

Attack Path

1. A user installs and enables the memory plugin.
2. The message:received and message:sent hooks observe all conversation traffic.
3. A user or connected tool places sensitive information in a message.
4. The hooks automatically persist the message or derived representations without per-message approval.
5. The stored information becomes available through search, recall, graph, dashboard, backup, or export functionality.
6. An unauthorized local user, compromised plugin, compromised account, or insufficiently isolated agent may subsequently retrieve the retained informat ...[truncated 559 chars]

Remediation

View remediation

Remediation Suggestions

• Make passive capture opt-in and clearly disclose what data will be stored before enabling hooks.
• Allow users to select specific conversations, message types, agents, and data categories eligible for retention.
• Detect and redact credentials, access tokens, private keys, financial data, health data, and other sensitive values before persistence.
• Exclude tool output, environment variables, authentication headers, and system prompts by default.
• Encrypt stored content and derived representations at rest using keys isolated per user or agent.
• Apply least-privilege access controls and enforce tenant and agent isolation at every retrieval interface.
• Establish configurable retention periods with automatic expiration and verifiable secure deletion.
• Provide controls to inspect, export, correct, and permanently delete all stored and derived data.
• Maintain auditable logs for memory access, export, import, and administrative operations.
• Document whether any content is transmitted externally for embedding generation or other processing, and require separate consent if applicable.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states that hooks passively capture every conversation and store facts, graph triples, embeddings, and replies, but it does not present any clear consent, notice, retention, or sensitive-data handling controls. In a memory skill, this creates a real privacy and security risk because users may disclose medical, financial, or other sensitive information that is then persistently stored and searchable without explicit awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger conditions are broad enough to activate in many ordinary interactions involving recall, factual questions about the user, or memory-related tasks, which increases the chance that the skill is invoked when persistent storage is unnecessary. In this skill's context, unintended invocation is more dangerous because activation enables passive logging behavior rather than a narrowly scoped read-only memory lookup.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document describes automatic retention of all user messages and agent replies in persistent memory, including derived facts and embeddings, with examples involving medical information. This creates a substantial risk of over-collection and long-term storage of sensitive personal data, which expands exposure in the event of misuse, overbroad access, or compromise.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The hook definitions instruct unconditional logging of both inbound and outbound conversation content, which removes contextual judgment and guarantees that sensitive or confidential material will be captured. Because the logging is automatic and persistent, the skill context makes this more dangerous than ordinary telemetry: it is a core behavior, not an incidental feature.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.