T08 · Insecure Dependencies
Error
- Location
SKILL.md:91- Finding
Unpinned Third-Party Plugin Installation and Unverifiable Update Path
- Content
View full analysis
- Remediation
View remediation
Security audit
EchoMemory
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its EchoMemory setup purpose, but it asks for broad host permissions and handles executable plugin installs, cloud memory sync, and API keys with insufficient scoping.
Review before installing. Use local-only mode unless cloud sync is needed, inspect local markdown contents before syncing, avoid putting API keys on the command line, protect ~/.openclaw/.env, prefer a pinned and verified plugin version, and be cautious about enabling tools.profile full because it expands OpenClaw's host capabilities beyond ordinary memory browsing.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:168- Finding
Host-Wide Full Tool Profile Is Required Without a Least-Privilege Capability Definition
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/start-local-ui.mjs:86- Finding
Fallback Launcher Dynamically Executes Modules from an Insufficiently Validated Plugin Root
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/start-local-ui.mjs:24- Finding
API Key Can Be Exposed Through Process Arguments and Diagnostic Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill provides operational guidance that references reading and writing environment-backed credentials (
~/.openclaw/.env) and relies on environment configuration, but it declares no explicit tool scope or permission boundary. That mismatch can cause the host to expose broader capabilities than users expect, increasing the chance of unauthorized credential access or persistence through implicit env handling.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The description encourages use for broad setup, troubleshooting, and natural-language plugin requests, which can cause the skill to trigger on loosely related prompts. Over-broad invocation increases the chance that users are steered into sensitive account, config, or credential-changing flows when they only asked a general memory question.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction to use the skill for 'plain language' requests instead of exact commands is ambiguous and broadens routing beyond clear user intent. In context, that can route ordinary memory-related queries into a skill that discusses disabling native tools, changing config, and connecting cloud accounts, creating unnecessary security and privacy risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The account connection flow states that a new API key is generated and written to
~/.openclaw/.env, but the skill does not surface this credential-persistence behavior prominently before onboarding guidance. Users may unknowingly persist long-lived secrets to disk, where other local processes, backups, or misconfigurations could expose them.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The skill explicitly normalizes automatic writing of an API key after email verification, creating session persistence beyond the immediate authentication flow. Persisting credentials to disk increases the blast radius of local compromise and can lead to unintended reuse of authenticated state across sessions or by other tools.
- Content
md Important note: - with the current one-click flow, users do not need to hand-edit `ECHOMEM_API_KEY`; the plugin can write it automatically after email verification ### First restart and verification
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill enables implicit invocation without defining trigger constraints or exclusions, which can cause the agent to route unrelated user requests into this skill unexpectedly. Because this skill handles installation, configuration, troubleshooting, and routing for a plugin with setup and recovery flows, over-broad auto-invocation increases the chance of unintended execution paths, disclosure of sensitive setup details, or user confusion that could be abused through prompt steering.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The setup flow states that a scoped API key is written to
~/.openclaw/.env, but it does not warn users that this is credential storage on disk or discuss file-permission, backup, and local compromise risks. In a plugin onboarding context, silently persisting a live cloud credential increases the chance of accidental exposure through shared machines, synced home directories, logs, or source-control mistakes.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Wrong plugin ID wastes time fast. Use `echo-memory-cloud-openclaw-plugin` exactly. 2. Stale config entries create noisy false trails. If logs mention something like `plugins.entries.echomemory-cloud: plugin not found`, remove the stale key and keep only the real plugin entry. 3. Global install is not enough.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation says
/echo-memory synccan upload markdown memories in cloud mode, but it does not clearly warn users that local memory content will be sent to a remote service. In a memory plugin handling potentially sensitive notes or personal data, this omission can cause users to enable cloud mode or run sync without informed consent, leading to unintended data disclosure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance tells the agent to use sync for uploading local markdown memories to the EchoMemory cloud, but it does not instruct the agent to warn users that local files may be transmitted off-device. In a memory-management skill, users may reasonably assume local notes stay local unless explicitly told otherwise, so this omission can lead to unintended disclosure of sensitive personal or workspace data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This markdown file applies to SQP-2, and the cleanup flow instructs the user to uninstall the plugin and remove stale config entries. While the steps are operationally clear, the section does not explicitly warn that these actions will alter the active OpenClaw plugin installation and may temporarily disable the plugin until reinstalled.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The markdown directs the user to restore a valid API key, which involves handling sensitive credentials. Under SQP-2 for markdown files, behaviors affecting privacy or sensitive data should include an explicit warning, but this section does not mention keeping the key secret or using a secure storage path.
- Content
Static analysis
No suspicious patterns detected.