Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:96
- Evidence
if (process.env.VOYAGE_API_KEY) return "voyage";
Security audit
Nexus Memory
Security checks for vulnerabilities and agentic risk
Overview
This memory plugin’s sensitive behavior is disclosed and aligned with its purpose, but users should only use it with a trusted Qdrant instance and embedding provider.
Install only if you want OpenClaw conversations remembered across sessions. Use a Qdrant instance and embedding provider you trust, disable autoCapture or autoRecall if you do not want automatic storage or injection, and avoid storing secrets unless your memory backend is appropriately secured.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- lib/embedder.ts:25
- Evidence
if (process.env.VOYAGE_API_KEY) return "voyage"