Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- plugin.mjs:100
- Evidence
if ((env || process.env).AGENTMEMORY_REQUIRE_HTTPS === "1") throw new Error(message);
Security audit
agentmemory
Security checks for vulnerabilities and agentic risk
Overview
This plugin is a disclosed long-term memory integration that stores recent conversation turns in a configured agentmemory server, with no hidden install script or unrelated behavior found.
Install only if you want OpenClaw conversations to be saved into agentmemory for later recall. Keep the default localhost server unless you intentionally trust a remote memory endpoint, and use HTTPS or a tunnel if AGENTMEMORY_SECRET or private conversation content will cross a network.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access