Skills/ClawHub/openclaw-memoria

openclaw-memoria@3.35.0

CAUTION· install only

Publisher claims: "Local-first, multi-agent persistent memory for AI assistants. Use it to install, operate, connect, diagnose, or update Memoria on macOS." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher nieto42 · publishing for 120 daysInstalls 1,444Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Direct script execution from GitHub raw URL; Prompting user to enter sensitive credentials; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandpackages/core/src/engine/memoria.ts:1896 · File permission modification command — agent changes file ownership/permissionsreason = `clé API absente — place-la dans ~/.${provider}/api_key (chmod 600)`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/core/src/llm/detect.ts:280 · File permission modification command — agent changes file ownership/permissions* (chmod 600) — l'action « Réutiliser ma config OpenClaw » de l'onboarding.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/daemon/src/server.ts:396 · File permission modification command — agent changes file ownership/permissions// (chmod 600). La valeur n'est JAMAIS loggée ni renvoyée.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/core/src/secrets/aes-vault.ts:4 · File permission modification command — agent changes file ownership/permissions* clé machine auto-générée `<secretsDir>/vault.key` (chmod 600).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/api.ts:335 · File permission modification command — agent changes file ownership/permissions* ~/.<provider>/api_key chmod 600, jamais renvoyée). Providers cloud uniquement. */Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Direct script execution from GitHub raw URLpackages/web/src/screens/Docs.tsx:85 · Direct script execution from GitHub raw URL — unverified code source<pre className="command">curl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | sh</pre>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Prompting user to enter sensitive credentialspackages/web/src/messages/en.ts:754 · Prompting user to enter sensitive credentials — social engineering'settings.engine.keyPlaceholderPaste': 'Paste your API key here…',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Privileged sudo commandscripts/install-memoria.sh:42 · Privileged sudo command — agent may execute with elevated privilegescommand -v git >/dev/null 2>&1 || err "git manquant. Installe-le (ex. sudo apt install git) puis relance ce script."Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandpackages/daemon/src/server.ts:376 · File permission modification command — agent changes file ownership/permissions// ~/.<provider>/api_key (chmod 600). La valeur n'apparaît JAMAIS ici.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Pipe-to-shell patternSKILL.md:26 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Direct script execution from GitHub raw URLscripts/install-memoria.sh:4 · Direct script execution from GitHub raw URL — unverified code source# curl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | shFix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patternpackages/web/src/screens/Docs.tsx:85 · Pipe-to-shell pattern — downloads and immediately executes remote code<pre className="command">curl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | sh</pre>Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandpackages/core/test/llm-detect.test.ts:197 · File permission modification command — agent changes file ownership/permissionsit('copie la clé vers le fichier cible en chmod 600 (sans la logger)', () => {Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathspackages/cli/test/install-script.test.ts:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { HOME: home, PATH: path, ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandpackages/mcp/test/mcp.test.ts:63 · File permission modification command — agent changes file ownership/permissionsit('round-trip + chmod 600', () => {Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/daemon/test/agents-routes.test.ts:92 · File permission modification command — agent changes file ownership/permissionsit('1 clic : pairing en processus + credentials chmod 600 + enregistrement MCP', async () => {Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/core/src/llm/detect.ts:9 · File permission modification command — agent changes file ownership/permissions* (chmod 600) sans jamais logger la valeur.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/daemon/src/server.ts:608 · File permission modification command — agent changes file ownership/permissions// completePairing), credentials chmod 600, puis enregistrement MCPFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagepackages/core/src/agents/register.ts:14 · npx invocation of non-well-known package — may execute untrusted code* publication → `npx -y @memoria/mcp`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandpackages/daemon/test/agents-routes.test.ts:105 · File permission modification command — agent changes file ownership/permissions// credentials écrits, chmod 600, token VALIDE (utilisable sur /v1/memory/*)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/daemon/src/state.ts:4 · File permission modification command — agent changes file ownership/permissions* - `daemon.json` (chmod 600) : { daemon_id, port, admin_token, pid, started_at }.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/core/src/llm/detect.ts:272 · File permission modification command — agent changes file ownership/permissions/** Fichier écrit (chmod 600). */Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/core/src/llm/detect.ts:306 · File permission modification command — agent changes file ownership/permissions* (chmod 600). Permet de coller sa clé depuis l'UI sans toucher au terminal.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/core/src/agents/credentials.ts:3 · File permission modification command — agent changes file ownership/permissions* Le token d'instance est un secret local : fichier chmod 600, dossier chmod 700.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandpackages/daemon/test/agents-routes.test.ts:4 · File permission modification command — agent changes file ownership/permissions* - POST /v1/admin/agents_connect : pairing EN PROCESSUS + credentials chmod 600 +Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Direct script execution from GitHub raw URLSKILL.md:26 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | shFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
AWS access key pattern detectedpackages/core/test/secrets.test.ts:142 · AWS access key pattern detected — possible hardcoded or harvested keyconst access = 'AKIAIOSFODNN7EXAMPLE'Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
CRITICAL
Pipe-to-shell patternscripts/install-memoria.sh:4 · Pipe-to-shell pattern — downloads and immediately executes remote code# curl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandpackages/daemon/src/server.ts:7 · File permission modification command — agent changes file ownership/permissions* - Bearer <admin_token> (daemon.json chmod 600) : /v1/admin/* — réservé àFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathspackages/core/test/markdown-sync.test.ts:215 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexpect(slugifyFile('../../etc/passwd')).toBe('etc-passwd')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
GitHub token pattern detectedpackages/core/test/secrets.test.ts:150 · GitHub token pattern detected — possible hardcoded or harvested tokenconst v1 = 'ghp_abcdefghij1234567890ABCDEFGHIJ123456'Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Remote installer piped to shellSKILL.md:26 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandapps/desktop/src-tauri/src/lib.rs:7 · File permission modification command — agent changes file ownership/permissions//! 3. lire `<storage_root>/daemon.json` (port + admin_token, chmod 600) ;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/mcp/src/connect.ts:74 · File permission modification command — agent changes file ownership/permissions` Token : ${credentialsPath} (chmod 600)`,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/core/src/migration/legacy-schema.ts:283 · File permission modification command — agent changes file ownership/permissions'La clé API Anthropic est stockée dans le fichier api_key avec chmod 600',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/mcp/test/mcp.test.ts:2 · File permission modification command — agent changes file ownership/permissions* Tests @memoria/mcp : credentials (round-trip + chmod 600), auto-détectionFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagepackages/cli/src/commands/init.ts:53 · npx invocation of non-well-known package — may execute untrusted codeout.write(' 2. npx @memoria/web — ouvrir l’interface web\n')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandpackages/core/src/sync/engine.ts:388 · File permission modification command — agent changes file ownership/permissions// le token du hub est stocké au join (settings, chmod du registry) ; à défaut, en-tête vide → 401 clairFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagepackages/core/src/engine/memoria.ts:211 · npx invocation of non-well-known package — may execute untrusted codecommand: `npx -y @memoria/mcp connect --code ${code}`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepackages/daemon/src/server.ts:451 · npx invocation of non-well-known package — may execute untrusted code// Tant que @memoria/mcp n'est pas publié sur npm, la commande npx neFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedpackages/core/src/migration/transcript-parsers.ts:184 · Destructive file system command detected// Détection de formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandpackages/cli/src/commands/daemon.ts:130 · Process kill command — agent can terminate processes`stop : le daemon (pid ${state.pid}) ne s’est pas arrêté après SIGTERM (5 s) — en dernier recours : kill -9 ${state.pid}`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/fr.ts:764 · File permission modification command — agent changes file ownership/permissions'settings.engine.missing.key': 'Clé absente — place-la dans ~/.{provider}/api_key (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/fr.ts:240 · File permission modification command — agent changes file ownership/permissions…note': 'Les clés API peuvent être saisies dans l\'UI ou lues depuis un fichier (chmod 600) ; elles ne sont jamais loggées. Une clé déjà présente dans OpenClaw peut êt…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/es.ts:238 · File permission modification command — agent changes file ownership/permissions'docs.engine.providers.note': 'Las claves API pueden introducirse en la UI o leerse desde un archivo (chmod 600); nunca se registran. Una clave ya presente en OpenClaw puede reutilizarse.',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/en.ts:597 · File permission modification command — agent changes file ownership/permissions'onboarding.apikey.note': 'Memoria will never ask you to paste your key here — it stays in a protected file (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/en.ts:238 · File permission modification command — agent changes file ownership/permissions'docs.engine.providers.note': 'API keys can be entered in the UI or read from a file (chmod 600); they are never logged. A key already present in OpenClaw can be reused.',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/es.ts:762 · File permission modification command — agent changes file ownership/permissions'settings.engine.missing.key': 'Clave ausente — colócala en ~/.{provider}/api_key (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/es.ts:597 · File permission modification command — agent changes file ownership/permissions'onboarding.apikey.note': 'Memoria nunca te pedirá que pegues tu clave aquí — permanece en un archivo protegido (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install-memoria.sh:90 · File permission modification command — agent changes file ownership/permissionschmod +x "$BIN_DIR/memoria"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/fr.ts:599 · File permission modification command — agent changes file ownership/permissions'onboarding.apikey.note': 'Memoria ne te demandera jamais de coller ta clé ici — elle reste dans un fichier protégé (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/de.ts:762 · File permission modification command — agent changes file ownership/permissions'settings.engine.missing.key': 'Schlüssel fehlt — lege ihn in ~/.{provider}/api_key ab (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
HTML comment carrying imperative instructions to the agentapps/desktop/ui/index.html:2 · HTML comment carrying imperative instructions to the agent · informational: not an instruction filePage de lancement Memoria (app bureau). Affiche la séquence Node → daemon → UI, puis bascule la webview sur l'UI servie par le daemon (même origine que son API Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Remote installer piped to shellscripts/install-memoria.sh:4 · Remote installer piped to shell# curl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packagepackages/web/test/api.test.ts:134 · npx invocation of non-well-known package — may execute untrusted codecommand: 'npx -y @memoria/mcp connect --code ABC123',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandpackages/web/src/messages/pt.ts:597 · File permission modification command — agent changes file ownership/permissions'onboarding.apikey.note': 'O Memoria nunca te pedirá para colar a tua chave aqui — ela fica num ficheiro protegido (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/de.ts:597 · File permission modification command — agent changes file ownership/permissions'onboarding.apikey.note': 'Memoria wird dich nie bitten, deinen Schlüssel hier einzufügen — er bleibt in einer geschützten Datei (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/api.ts:428 · File permission modification command — agent changes file ownership/permissions/** Copie la clé API trouvée chez OpenClaw vers ~/.<provider>/api_key (chmod 600). */Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/pt.ts:238 · File permission modification command — agent changes file ownership/permissions'docs.engine.providers.note': 'As chaves API podem ser introduzidas na UI ou lidas a partir de um ficheiro (chmod 600); nunca são registadas. Uma chave já presente no OpenClaw pode ser reutilizada.',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/pt.ts:762 · File permission modification command — agent changes file ownership/permissions'settings.engine.missing.key': 'Chave ausente — coloca-a em ~/.{provider}/api_key (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/en.ts:762 · File permission modification command — agent changes file ownership/permissions'settings.engine.missing.key': 'Key missing — put it in ~/.{provider}/api_key (chmod 600).',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/messages/de.ts:238 · File permission modification command — agent changes file ownership/permissions…'API-Schlüssel können in der UI eingegeben oder aus einer Datei gelesen werden (chmod 600); sie werden nie geloggt. Ein bereits in OpenClaw vorhandener Schlüssel kann…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackages/web/src/screens/Onboarding.tsx:561 · File permission modification command — agent changes file ownership/permissionsconst command = `echo 'TA_CLÉ' > ~/.${provider}/api_key && chmod 600 ~/.${provider}/api_key`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellpackages/web/src/screens/Docs.tsx:85 · Remote installer piped to shell<pre className="command">curl -fsSL https://raw.githubusercontent.com/Primo-Studio/openclaw-memoria/memoria-v1/scripts/install-memoria.sh | sh</pre>Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

Cost to the agent

Instructions loaded
≈2,588 tok
2 files · 287 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim nieto42: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim nieto42Propose a patch to the maintainer