File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/memory-config/SKILL.md:170
- Evidence
api_key = "[REDACTED]"
Security audit
memsearch — OpenClaw Plugin
Security checks for vulnerabilities and agentic risk
Overview
This memory plugin needs review because saved private conversations can be recalled without enforcing the current session’s privacy restrictions.
Use a dedicated private agent until recall and search enforce session privacy boundaries. Disabling automatic recall alone does not restrict the search tools. Review which model providers receive conversation text, and remember that uninstalling leaves saved journals behind.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal