Security audit

openclaw memory opportunity

Security checks for vulnerabilities and agentic risk

Overview

This local memory skill is not clearly malicious, but it needs review because it can persist conversation details and imported files while its docs conflict about automatic saving.

Install only if you want a persistent local memory store. Treat phrases like "remember," "save," and "记住" as save commands, avoid importing broad folders such as your whole home or Documents directory, do not store secrets, and regularly inspect or delete files under ~/.memory-os/.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill makes strong safety claims such as '100% local-only' and 'AI features NOT IMPLEMENTED' while elsewhere describing automatic conversation-memory extraction from natural-language input. Even if implemented locally, this is still automated processing of chat content and materially changes the privacy/security model, creating misleading documentation that can cause users and agents to enable the skill under false assumptions.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The YAML security declaration says collection is manual-only and must be explicitly triggered, but the body advertises automatic triggering from conversational keywords. This contradiction is security-relevant because platforms and users may rely on the top-level metadata to decide whether the skill can persist user data, leading to unconsented retention of chat content.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The document says there is no automatic background collection and that collection is manual-only, yet later states that ordinary conversation containing broad keywords can trigger storage. That inconsistency can cause accidental capture of sensitive personal or project information because users may believe only manual commands persist data.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The file simultaneously claims there are no AI/LLM capabilities while describing 'AI-powered' intelligent extraction from conversation. Even if the extraction is heuristic rather than LLM-based, the wording obscures what processing occurs and can mislead users about data handling, confidence, and privacy implications.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The Chinese section presents the current version as v0.1.0 with manual-only collection, while the English section describes v0.1.2 with conversation auto-triggering. Conflicting multilingual guidance can cause some users to believe the skill has a safer data-collection posture than it actually does, undermining informed consent and review.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README explicitly advertises auto-trigger support for generic phrases like "remember..." / "记住...", which are common in ordinary conversation and do not establish clear consent or activation boundaries. In a memory-extraction skill, this can cause unintended persistence of user content, including sensitive facts, from routine dialogue rather than deliberate save actions.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The feature description says conversation memory is extracted from natural language and coupled with auto-trigger support, but it does not define strict boundaries for when capture occurs. For a tool designed to store memories, ambiguous activation materially increases the risk of collecting unintended user content and retaining it locally without meaningful user awareness.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The auto-trigger keywords include everyday phrases like 'remember' and 'keep in mind', which are common in normal dialogue and not reliably indicative of consent to store persistent memory. This creates a meaningful risk of unintended activation and silent retention of personal data from ordinary chat.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The supported-language trigger list uses vague verbs such as save, store, keep, note, and record without defining strict activation boundaries. In a conversational agent context, these broad triggers increase the chance that non-memory-related utterances are interpreted as authorization to persist data.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The Chinese trigger list contains broad, high-frequency words like 记住 and 保存 that are likely to appear in normal assistance requests. Without strict scoping or confirmation, they can cause unintentional memory writes containing sensitive user details.

Ssd 3

Medium

Confidence: 93% confidence
Finding: Auto-triggered extraction from natural conversation is inherently capable of capturing sensitive personal data shared in ordinary dialogue, especially because the product is framed around memory retention. Even if storage is local-only, retaining unintended personal data still creates privacy and confidentiality risk on the user's machine.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The examples encourage storing directly identifying information such as a person's name and project deadlines through chat-like prompts. In context, this normalizes use of the tool for persistent storage of PII and other sensitive personal data without emphasizing minimization, confirmation, or redaction safeguards.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill explicitly encourages auto-triggered capture of conversational facts into persistent local storage, including personal details. Persistent retention of chat-derived data is a real privacy/security risk because users may reveal names, deadlines, contacts, or other sensitive information without realizing it will be stored beyond the current session.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The examples normalize storing personally identifying information and project details from free-form conversation, then confirming the saved values back to the user. This increases privacy exposure and can leak sensitive data into logs, screenshots, or shared terminals even when storage is local.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The extraction rules direct the system to harvest names, dates, events, and other facts from dialogue automatically. In a memory skill, this context makes the issue more dangerous because the product’s core function is persistence, so any accidental extraction becomes durable data collection rather than transient processing.

Static analysis

No suspicious patterns detected.