File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/memory-config/SKILL.md:170
- Evidence
api_key = "[REDACTED]"
Security audit
memsearch — OpenClaw Plugin
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent memory plugin that stores and recalls conversation history, with sensitive behavior disclosed and aligned to its purpose.
Install only if you want OpenClaw to remember prior conversations. Expect conversation summaries and transcript anchors to be stored on disk, recent memories to be injected into future prompts, and summaries to use the configured native or external LLM provider. Review MEMSEARCH_DIR and provider/API-key settings if you share machines, projects, or paid providers.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal