Security audit

OpenClaw Memory OS

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local memory tool, but installation and security claims are inconsistent enough that users should review it carefully before installing.

Install only after verifying the exact npm package version, tarball integrity, and matching source commit. Treat stored memories as unencrypted local files, avoid broad collection paths, keep auto-trigger disabled unless you understand the capture behavior, and do not store secrets or regulated data in it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: skill.md:22
Finding: Global Installation of Externally Retrieved npm Package
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: skill.md:117
Finding: Verification Procedure Audits a Different Version and Commit Than the Installed Package
Content: View full analysis
=0.3.0" verified_repo: https://github.com/ZhenRobotics/openclaw-memory-os verified_commit: 9254fcab35308b82ce55d3f23e297d44b7021977 ``` The audit procedure then uses a tarball and commit associated with different revisions: ```bash # Download and inspect without installing npm pack openclaw-memory-os@0.3.0 tar -xzf openclaw-memory-os-0.2.2.tgz cat package/package.json ``` ```bash # Clone verified commit git clone https://github.com/ZhenRobotics/openclaw-memory-os.git cd openclaw-memory-os git checkout 091eeab814533d2e3ae1738693445d2de8b3ab4d ``` ### Technical Analysis The Skill installs npm package version `0.3.0`, declares commit `9254fcab35308b82ce55d3f23e297d44b7021977`, extracts a file named for version `0.2.2`, and instructs the auditor to review commit `091eeab814533d2e3ae1738693445d2de8b3ab4d`. These identifiers are not equivalent. Consequently, following the documented audit steps does not establish that the source being inspected corresponds to the package that will execute. Reviewing a repository commit alone is also insufficient unless the exact npm tarball is reproducibly matched to that commit. This discrepancy is especially significant because no executable source is present in the submitted project. All runtime security assertions therefore depend on the external artifact being correctly identified and verified. ### Attack Path 1. A user follows the stated audit procedure before installation. 2. The user reviews commit `091eeab...` or attempts to inspect a `0.2.2` tarball. 3. The user then installs npm release `0.3.0`, which is associated in the metadata with a different commit. ...[truncated 753 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skill.md:85
Finding: Sensitive Conversation and File Contents Are Stored as Plaintext JSON
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (53)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation presents deletion commands, including recursive removal of the entire data directory, without an explicit irreversible-data-loss warning or confirmation safeguards. Users may destroy all stored memories accidentally, especially when copying commands verbatim.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: Instructing users to delete JSON files directly with rm bypasses application-level safeguards, auditability, and input validation. Users may delete the wrong record or corrupt expected state if companion indexes or metadata exist now or in future versions.
Content: Scanner excerpt · USAGE_EXAMPLES.md (reported line 324)May include surrounding context.
md
openclaw-memory-os search "要删除的内容" # 删除文件 rm ~/.memory-os/data/memories/<memory-id>.json # 或删除所有 rm -rf ~/.memory-os/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: This finding is a true positive for destructive tool-parameter abuse because the example normalizes a force-recursive delete of the skill’s whole storage tree. Documentation that encourages copy-paste execution of such commands increases the likelihood of accidental or overly broad deletion.
Content: Scanner excerpt · USAGE_EXAMPLES.md (reported line 327)May include surrounding context.
rm ~/.memory-os/data/memories/.json

或删除所有

rm -rf ~/.memory-os/

text
### Q: v0.1.0 需要 API key 吗？

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: This finding is a true positive for destructive tool-parameter abuse because the example normalizes a force-recursive delete of the skill’s whole storage tree. Documentation that encourages copy-paste execution of such commands increases the likelihood of accidental or overly broad deletion.
Content: Scanner excerpt · USAGE_EXAMPLES.md (reported line 327)May include surrounding context.
rm ~/.memory-os/data/memories/.json

或删除所有

rm -rf ~/.memory-os/

text
### Q: v0.1.0 需要 API key 吗？

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · readme.md (reported line 38)May include surrounding context.
md
- Stored: `~/.memory-os/` (local JSON files) - Control: You decide what to collect and when - Ownership: You own all data files - Deletion: `rm -rf ~/.memory-os/` removes everything **Recommended Safe Usage:** 1. Test in sandbox/VM first

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · readme.md (reported line 315)May include surrounding context.
md
- Stored: `~/.memory-os/` (local JSON files) - Control: You decide what to collect and when - Ownership: You own all data files - Deletion: `rm -rf ~/.memory-os/` removes everything **Recommended Safe Usage:** 1. Test in sandbox/VM first

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · readme.md (reported line 38)May include surrounding context.
md
- Stored: `~/.memory-os/` (local JSON files) - Control: You decide what to collect and when - Ownership: You own all data files - Deletion: `rm -rf ~/.memory-os/` removes everything **Recommended Safe Usage:** 1. Test in sandbox/VM first

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · readme.md (reported line 315)May include surrounding context.
md
- Stored: `~/.memory-os/` (local JSON files) - Control: You decide what to collect and when - Ownership: You own all data files - Deletion: `rm -rf ~/.memory-os/` removes everything **Recommended Safe Usage:** 1. Test in sandbox/VM first

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · readme.md (reported line 38)May include surrounding context.
md
- Stored: `~/.memory-os/` (local JSON files) - Control: You decide what to collect and when - Ownership: You own all data files - Deletion: `rm -rf ~/.memory-os/` removes everything **Recommended Safe Usage:** 1. Test in sandbox/VM first

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 59)May include surrounding context.
md
default_enabled: false # AUTO-TRIGGER is OFF by default (opt-in for privacy) confirmation_required: true # ✅ IMPLEMENTED in v0.3.0 - Always prompts before saving privacy_filter: integrated # ✅ IMPLEMENTED in v0.3.0 - Automatic redaction of sensitive data path_protection: enforced # ✅ IMPLEMENTED in v0.3.0 - Blocks ~/.ssh, ~/.aws, .env files safe_mode: true # ✅ IMPLEMENTED in v0.3.0 - Forces confirmation + filter + path checks opt_in: configurable # Can be enabled in ~/.memory-os/config.json encryption: optional # Framework added, full implementation in v0.3.1

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 293)May include surrounding context.
md
default_enabled: false # AUTO-TRIGGER is OFF by default (opt-in for privacy) confirmation_required: true # ✅ IMPLEMENTED in v0.3.0 - Always prompts before saving privacy_filter: integrated # ✅ IMPLEMENTED in v0.3.0 - Automatic redaction of sensitive data path_protection: enforced # ✅ IMPLEMENTED in v0.3.0 - Blocks ~/.ssh, ~/.aws, .env files safe_mode: true # ✅ IMPLEMENTED in v0.3.0 - Forces confirmation + filter + path checks opt_in: configurable # Can be enabled in ~/.memory-os/config.json encryption: optional # Framework added, full implementation in v0.3.1

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 568)May include surrounding context.
md
default_enabled: false # AUTO-TRIGGER is OFF by default (opt-in for privacy) confirmation_required: true # ✅ IMPLEMENTED in v0.3.0 - Always prompts before saving privacy_filter: integrated # ✅ IMPLEMENTED in v0.3.0 - Automatic redaction of sensitive data path_protection: enforced # ✅ IMPLEMENTED in v0.3.0 - Blocks ~/.ssh, ~/.aws, .env files safe_mode: true # ✅ IMPLEMENTED in v0.3.0 - Forces confirmation + filter + path checks opt_in: configurable # Can be enabled in ~/.memory-os/config.json encryption: optional # Framework added, full implementation in v0.3.1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 104)May include surrounding context.
md
**DO NOT:** - ❌ Enable AUTO-TRIGGER in production without code audit - ❌ Run `collect --source ~/` or other broad paths with sensitive data - ❌ Collect directories containing: `.env`, `.aws/`, `.ssh/`, `credentials.json`, etc. - ❌ Store API keys, passwords, or credentials in collected files - ❌ Trust plaintext storage for confidential information - ❌ Grant autonomous agent access if AUTO-TRIGGER is enabled

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 498)May include surrounding context.
md
**DO NOT:** - ❌ Enable AUTO-TRIGGER in production without code audit - ❌ Run `collect --source ~/` or other broad paths with sensitive data - ❌ Collect directories containing: `.env`, `.aws/`, `.ssh/`, `credentials.json`, etc. - ❌ Store API keys, passwords, or credentials in collected files - ❌ Trust plaintext storage for confidential information - ❌ Grant autonomous agent access if AUTO-TRIGGER is enabled

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 255)May include surrounding context.
md
**Current Limitation:** The filter is **not automatically applied** during memory collection in v0.2.2. Users must: 1. Review collected data manually: `cat ~/.memory-os/memories/*.json` 2. Delete sensitive files: `rm ~/.memory-os/memories/<uuid>.json` 3. Avoid collecting directories with credentials **Planned:** Automatic privacy filter integration in v0.3.0

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 387)May include surrounding context.
md
**Current Limitation:** The filter is **not automatically applied** during memory collection in v0.2.2. Users must: 1. Review collected data manually: `cat ~/.memory-os/memories/*.json` 2. Delete sensitive files: `rm ~/.memory-os/memories/<uuid>.json` 3. Avoid collecting directories with credentials **Planned:** Automatic privacy filter integration in v0.3.0

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 658)May include surrounding context.
md
**Current Limitation:** The filter is **not automatically applied** during memory collection in v0.2.2. Users must: 1. Review collected data manually: `cat ~/.memory-os/memories/*.json` 2. Delete sensitive files: `rm ~/.memory-os/memories/<uuid>.json` 3. Avoid collecting directories with credentials **Planned:** Automatic privacy filter integration in v0.3.0

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide encourages collecting notes and investment rules into long-lived local storage without warning that such data may be sensitive, regulated, or later exposed through local compromise, backups, shell history, or shared accounts. Users may ingest personal, financial, or proprietary material without understanding the privacy consequences.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 76% confidence
Finding: The examples instruct users to collect notes into a persistent memory store, creating durable local retention of content that may include sensitive personal or financial information. In a memory/recording skill, persistence is core functionality, but without strong warnings and retention controls it still presents real privacy and data-exposure risk.
Content: Scanner excerpt · USAGE_EXAMPLES.md (reported line 92)May include surrounding context.
bash
# 创建测试笔记 mkdir ~/my-notes echo "学习了 TypeScript 的高级类型系统" > ~/my-notes/typescript-notes.txt echo "React Server Components 性能优化技巧" > ~/my-notes/react-notes.txt

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The FAQ says the skill does not automatically save all conversations unless explicitly asked, but the skill metadata and examples describe conversation-recording infrastructure and automatic memory capture flows. This mismatch can mislead users about when sensitive content is persisted, weakening informed consent and privacy expectations.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The README explicitly states that when auto-trigger is enabled, conversation data is saved immediately with no confirmation prompt. In a memory-recording skill handling potentially sensitive personal content, this increases the risk of unintended capture and storage of secrets, personal data, or regulated information without a final user check.
Content: Scanner excerpt · readme.md (reported line 12)May include surrounding context.
md
**🔒 Privacy Notice (v0.2.2):** - ✅ **AUTO-TRIGGER is OFF by default** (opt-in only) - ⚠️ **No confirmation prompt** when enabled (saves immediately - planned for v0.3.0) - ⚠️ **Privacy filter exists but not integrated** (code implemented, CLI integration pending) - ⚠️ **No encryption at rest** (plain JSON files) - ✅ **100% local runtime** - zero network calls during operation (installation requires npm)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: Advertising auto-trigger support that saves immediately without confirmation describes behavior that can persist sensitive conversation content without user review. Given the skill's purpose is conversation memory extraction, the context makes accidental over-collection more dangerous than in a non-sensitive local note-taking tool.
Content: Scanner excerpt · readme.md (reported line 22)May include surrounding context.
md
- ✅ Basic keyword search (all local computation) - ✅ Batch file collection (user-triggered CLI) - ✅ **Conversation memory extraction** (extract from natural language) - ✅ **Auto-trigger support** (opt-in, saves immediately without confirmation in v0.2.2) - ✅ Recursive directory scanning with progress display - ✅ Automatic file type detection (TEXT vs CODE) - ✅ Timeline and statistics (local only)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The documented design allows natural conversations to be extracted and stored directly when enabled, with no confirmation prompt in v0.2.2. Because conversations often contain passwords, health data, financial details, or third-party information, autonomous persistence without review creates a meaningful privacy and data-handling risk.
Content: Scanner excerpt · readme.md (reported line 55)May include surrounding context.
md
Memory-OS is an open-source personal memory management system designed for digital immortality and cognitive continuity. It can collect, store, retrieve, and intelligently process all your digital memories, build personal knowledge graphs, and provide the ability to have conversations with your digitized "self". **v0.2.2 Focus:** Opt-in conversation memory with local-only storage. AUTO-TRIGGER is disabled by default and saves directly when enabled (no confirmation prompt in v0.2.2). Privacy filter code exists but CLI integration pending. Extract and store information from natural conversations. AI features (semantic search, LLM integration) are planned but NOT implemented in this version. ## Core Features

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The feature list normalizes auto-triggered memory capture with no confirmation, which is risky in a product designed to store long-lived personal memories. Even though it is opt-in and local-only, the absence of confirmation and the admitted lack of integrated privacy filtering materially increase the chance of storing unintended sensitive content.
Content: Scanner excerpt · readme.md (reported line 63)May include surrounding context.
md
- **Opt-In Design** - AUTO-TRIGGER disabled by default - **Local Storage** - JSON-based file storage, no cloud dependency, no encryption - **Conversation Memory** - Extract information from natural language - **Auto-Trigger** - Opt-in, saves immediately (no confirmation prompt) - **Entity Extraction** - Automatically extracts names, dates, events - **Privacy Filter** - Code implemented, CLI integration pending v0.3.0 - **Batch File Collection** - Import entire directories with one command

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · USAGE_EXAMPLES.md (reported line 274)May include surrounding context.
bash
# Verify data location ls -la ~/.memory-os/memories/ # Inspect collected memories cat ~/.memory-os/memories/*.json | jq '.'

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Tool Parameter Abuse

Tool Parameter Abuse

或删除所有

Tool Parameter Abuse

或删除所有

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Session Persistence

Intent-Code Divergence

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

File System Enumeration

Static analysis