Security audit
Scope Recall for OpenClaw
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate long-term memory plugin, but it needs Review because some optional automation can mutate or expose stored memories with weak scoping and disclosure.
Install only if you intentionally want durable local memory. Keep autoCapture, autoRecall, memoryReflection, autoBackup, hosted LLM extraction, reranking, OAuth, and memoryCompaction disabled unless you understand what text will be stored or sent to providers. Be especially cautious enabling memoryCompaction in multi-scope deployments until same-scope merging is enforced, and avoid debug logging for sensitive conversations.
Static analysis
No suspicious patterns detected.
