openclaw-memory-tencentdb-setup

No explicit malware behavior is present in this fragment (no eval/exec, no direct exfiltration, no hardcoded secrets, no file damage). The main security concern is command/launch control: MEMORY_TENCENTDB_GATEWAY_CMD is accepted and passed to GatewaySupervisor, and _discover_gateway_cmd() auto-discovers a server.ts on disk and builds shell commands to run it. If GatewaySupervisor executes these commands (likely), this creates a potential supply-chain or environment-based command execution risk. Confirm how GatewaySupervisor handles gateway_cmd (validation/sandboxing/no-shell execution).

The fragment is an automated dist/ code-injection patcher that performs supply-chain-style modification of an installed Node.js package by inserting session-derived message data (`ctx.params.session?.messages`) into `hookEvent`/`after_tool_call` payload structures. No explicit network exfiltration, credential access, or obfuscation is visible in this fragment; however, the intent and effect are strongly indicative of behavioral tampering/integrity risk. Because the injection is specifically tied to message/session handling and is implemented via heuristic regex rewrites (including a permissive fallback), this should be treated as a high-integrity-risk modification that warrants provenance/intent verification and thorough diff review of the patched dist output.

This script is primarily an installer/bootstrapping mechanism that fetches and installs a third-party npm package from an unpinned @latest version, runs npm install steps that may execute lifecycle scripts, and then symlinks the installed code into a Hermes agent so it will be loaded by subsequent runtime components. There is no explicit evidence of backdoor behavior, reverse shells, keylogging, credential theft, or network exfiltration in the installer logic itself; however, the dominant risk is supply-chain execution and persistence impact (install-time code execution + later runtime loading). Additional concerns include the use of eval for home-directory resolution and writing persistent startup commands to both /etc/profile.d and ~/.hermes/.env.

No clear indicators of active malware/backdoors in this module. However, it is a telemetry exporter that intentionally transmits potentially sensitive LLM prompts, responses, URLs, and message/tool contents (plus session identifiers) to an external Opik endpoint using credentials from configuration/environment. Risk is therefore predominantly privacy/data-exfiltration via telemetry misconfiguration or unredacted sensitive data, not exploit-style compromise within this code.

This module appears to be a legitimate local diagnostic exporter (no clear indicators of malware, obfuscation, backdoor, or network exfiltration). However, it carries a high privacy/security risk by copying the entire memory plugin dataset (including likely user conversations and a SQLite vectors/FTS database) into a shareable tarball without redaction, while only partially redacting secrets in openclaw.json. Treat exported archives as highly sensitive; only share with trusted parties and consider stronger redaction/sanitization for memory content.

The JavaScript module itself is straightforward, but it creates a meaningful supply-chain risk by executing a bundled shell script during installation on linux/darwin. Because the patch script contents are not present here, malicious intent cannot be ruled out. Key risk signals include arbitrary install-time command execution via bash, passing the full environment to the child process, inherited stdio, and non-blocking error handling. Review the referenced openclaw-after-tool-call-messages.patch.sh to confirm it performs only the intended patch actions and does not perform credential theft, persistence, or network/system modifications.

The package appears to be a legitimate plugin that compiles TypeScript and runs a postinstall script. The primary risk is the postinstall hook (and other included scripts) executing arbitrary code during installation. Without inspecting scripts/postinstall.mjs and the other included shell/JS scripts, you cannot rule out telemetry, data exfiltration, system modification, or other malicious behavior. There are no obvious dependency redirections or insecure HTTP dependency URLs in the package.json, which lowers supply-chain red flags, but the automatic execution of local postinstall scripts remains a medium-high risk.