memos-local

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user for an API key and then instructs the agent to insert that API key verbatim into command-line arguments and config writes (e.g., passing "<API_KEY>" in node -e and showing "sk-your-key"), which requires the LLM to handle and output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The presence of direct install scripts served from a third‑party CDN (cdn.memtensor.com.cn) that the skill instructs to execute via curl|bash and PowerShell iex is a high-risk distribution pattern because it runs remote code without user validation and can deliver malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains multiple high-risk behaviors (autonomous privileged command execution, downloading and running remote install scripts, npm package installation, obfuscated exec calls, and collecting/storing API keys) that create supply-chain, remote-code-execution, and credential-exfiltration opportunities.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs remote install scripts at runtime using "curl -fsSL https://cdn.memtensor.com.cn/memos-local-openclaw/install.sh | bash" and "powershell -c "irm https://cdn.memtensor.com.cn/memos-local-openclaw/install.ps1 | iex"", which fetch and execute remote code during installation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to execute shell commands and install scripts (curl | bash / iex), autonomously modify local config files (patch ~/.openclaw/openclaw.json), restart the gateway, and even suggests running privileged package installs (sudo apt install ...), which directs the agent to change the machine's state and potentially require elevated privileges.