Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- dist/index.js:6557
- Evidence
const store = JSON.parse(fs3.readFileSync(tokenStore.path, "utf8"));
Security audit
Remnic OpenClaw Plugin
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed local memory plugin that stores and recalls conversation context, with optional provider and connector integrations that are mostly gated by configuration.
Install this only if you want OpenClaw to maintain persistent memory from conversations. Review modelSource, transcript retention, connector settings, local HTTP access, and provider credentials before enabling them, because conversation and memory excerpts may be stored locally and may be sent to your configured model providers or opted-in connectors.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.potential_exfiltration