Security audit
Security checks for vulnerabilities and agentic risk
This plugin is a disclosed local conversation-memory/context manager; the main risk is that it intentionally keeps complete conversation history for recall.
Install only if you want OpenClaw to retain local long-term conversation memory. Review the database and large-files paths, configure ignoreSessionPatterns or statelessSessionPatterns for conversations you do not want stored, and pin the package version before running npx migration commands with --apply.
Line L03 explicitly says the system stores full conversation history, which is user data with clear privacy and retention impact. In this markdown file, there is no accompanying warning or disclosure about persistence, sensitivity, or handling of that stored data.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Why it matters:
- Larger chunks reduce summarization frequency.
- Smaller chunks create more summaries and more DAG fragmentation.
- The default is 20000 tokens.
Use this when:
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- `/new` prunes active context but keeps the same LCM conversation row
- `/reset` archives the active LCM conversation row and creates a fresh active row
- ordinary chat/thread LCM history may continue in the same row across runtime `sessionId` changes when the stable `sessionKey` continues
- cron scheduler keys create fresh LCM rows per runtime run so prior runs do not enter the new run's assembled context
## Why
The documentation instructs users to execute an npm package via npx using @latest and without a pinned version. This creates a supply-chain risk: a compromised publisher account, malicious new release, or dependency hijack could cause users to run unreviewed code on their system. In a skill context, copy-pasteable operational commands materially increase the chance of exploitation.
This command again uses npx with an unpinned package version and adds --apply, which increases risk because the fetched code will perform writes after execution. If an attacker can influence the published package or its dependency chain, users may execute arbitrary code and modify local state or databases. The presence of an explicit write mode makes the operational impact higher than a read-only example.
Detected: suspicious.prompt_injection_instructions
the system prompt: