Security audit

MemoryRouter Memory

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real memory plugin, but it needs review because it can send conversations, workspace files, and session history to MemoryRouter while also changing OpenClaw memory behavior.

Install only if you intentionally want an external MemoryRouter vault to receive OpenClaw conversation context and optional historical workspace/session uploads. Before enabling, review what `openclaw mr upload` will include, avoid letting the onboarding prompt run broad uploads without your explicit consent, and confirm that replacing native memory search is acceptable. Use `openclaw mr off` or `openclaw mr delete` if you need to stop future use or clear the remote vault.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index.js:1088
Evidence: console.log(`\nGet your free API key: [REDACTED]`);

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index.ts:1171
Evidence: console.log(`\nGet your free API key: [REDACTED]`);