Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- dist/index.js:6528
- Evidence
const store = JSON.parse(fs3.readFileSync(tokenStore.path, "utf8"));
Security audit
Remnic OpenClaw Plugin
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed OpenClaw memory plugin that persistently stores and recalls conversation-derived memories, with external model/provider use and optional background features described in its metadata and docs.
Install only if you want Remnic to be your OpenClaw memory system. It can store conversation content locally and may send conversation or memory excerpts to configured model providers; use gateway/local models and avoid setting provider API keys if you want model-backed memory work kept on your approved OpenClaw path. Review optional settings before enabling live connectors, local HTTP access, cron auto-registration, active-recall transcript persistence, or managed upgrade flows.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.potential_exfiltration