openclaw-memx-memory-plugin
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to clone and install a plugin from a third-party GitHub repository (github.com/NeoLi00/openclaw-memx.git). This involves downloading and executing external code that is not verified as originating from a trusted organization.\n- [INDIRECT_PROMPT_INJECTION]: The skill enables an automated memory injection system (allowPromptInjection: true) that can influence agent behavior based on external data.\n
- Ingestion points: Conversation turns, task states, and relationship data are automatically ingested into the memory database.\n
- Boundary markers: The skill mentions that recall context provides instructions to the agent, but no explicit data delimiters or ignore instructions for the injected content are documented in the skill instructions.\n
- Capability inventory: The plugin has capabilities to execute shell commands (via openclaw and pip), write to the local file system (in ~/.openclaw/), and perform network operations for embeddings.\n
- Sanitization: No specific sanitization or validation logic for the ingested and subsequently injected memory content is described.\n- [EXTERNAL_DOWNLOADS]: The setup process involves downloading external dependencies, including Python packages (sentence-transformers, torch) and a remote Git repository.\n- [COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands for installation, configuration (including API key setup), and system diagnostics.
Audit Metadata