alibabacloud-tablestore-openclaw-memory

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to solicit AccessKey ID/Secret and API keys from the user and provides commands/templates that embed those secrets (export lines and config templates), so the LLM would need to handle and potentially output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup script queries and then installs the npm package @tablestore/openclaw-mem0@0.8.2 (e.g. contacting https://registry.npmjs.org/@tablestore%2fopenclaw-mem0 or the mirror https://registry.npmmirror.com/@tablestore%2fopenclaw-mem0) at runtime, which fetches and installs remote code that will execute as an OpenClaw plugin and can directly affect agent behavior.