memclaw-maintance

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install the @memclaw/memclaw plugin. This is a vendor-owned package associated with the skill author 'sopaco' and represents standard installation procedure for this extension.
  • [DATA_EXFILTRATION]: The skill describes tools like cortex_migrate that access local files in ~/.openclaw/workspace/memory/ and platform-specific application support paths. This access is required for processing local memory data and does not involve transmission to unauthorized external domains.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes user-controlled markdown files for vectorization. 1. Ingestion points: local memory files in ~/.openclaw/workspace/memory/. 2. Boundary markers: Not explicitly defined in instructions. 3. Capability inventory: Data migration and index maintenance tools. 4. Sanitization: No explicit validation of source file content is mentioned. This risk is assessed as low given it is the primary function of the tool.
  • [COMMAND_EXECUTION]: Provides documented maintenance commands such as prune and reindex. These are structured operations performed by the plugin on its internal data storage and do not permit arbitrary system command execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 12:52 AM
Security Audit — agent-trust-hub — memclaw-maintance