Security audit

Remembrance

Security checks for vulnerabilities and agentic risk

Overview

This plugin is a disclosed Remembrance integration that auto-queries shared memory and manages feedback/private-learning workflows with documented controls and approval gates.

Install only if you want OpenClaw to send redacted task summaries and Remembrance-related feedback to the configured Remembrance service. Use an organization key only for approved private memory, review allow-always decisions for submission lanes carefully, and disable auto-query or auto-contribution with the documented environment variables if your environment requires stricter data-egress control.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: servers/remembrance-mcp.mjs:57184
Evidence: exec(input) {

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: servers/remembrance-mcp.mjs:54220
Evidence: eval(input, pos) {