Is ascottbell/maasv-memory safe?
https://github.com/openclaw/skills/tree/main/skills/ascottbell/maasv-memory
This skill is a documentation-only pointer to an external memory system (maasv). The skill repository itself contains zero executable code and exhibited no malicious behavior during installation. The primary risk lies in the unaudited external dependency chain (maasv PyPI/npm packages) and the persistent memory injection surface created by the autoRecall feature, which could amplify attacks from other vectors.
Category Scores
Findings (6)
MEDIUM Unaudited external dependency chain -15 ▶
The skill directs users to install two external packages (maasv from PyPI and @maasv/openclaw-memory from npm) that contain all the actual executable code. These packages are not included in the skill repository and were not analyzed during this audit. The real attack surface lies in those packages, not in this documentation-only skill.
MEDIUM Persistent memory injection surface via autoRecall -10 ▶
The autoRecall configuration injects stored memories into the agent's context before each turn. If the memory store is poisoned (by another malicious skill, compromised input, or a supply chain attack on the maasv server), this creates a persistent indirect prompt injection vector that would affect all future agent interactions.
LOW Silent entity extraction via autoCapture -5 ▶
The autoCapture feature silently extracts entities from each session without explicit per-session user consent. While this is the intended functionality, it means the agent will automatically store conversation data persistently, which could capture sensitive information discussed in sessions.
LOW External AI API dependencies in install extras -10 ▶
The pip install extras include 'anthropic' and 'voyage' which are API clients that communicate with external AI services. While these are legitimate tools, they establish outbound network channels that could theoretically be abused if the maasv server code is compromised.
INFO Clean skill repository with no executable code -5 ▶
The skill repo contains only documentation (SKILL.md), metadata (_meta.json), and a lock file. No executable code, no install hooks, no git hooks, no submodules, no symlinks. This is an exemplary minimal-footprint skill.
INFO Clean clone with no anomalous behavior -5 ▶
Installation produced only expected filesystem and network activity. All network traffic was to GitHub (clone), Ubuntu update servers, and local DNS. No skill-triggered processes were observed.