wip-memory-crystal Security Report — Trusted | ClawSafe

5 /100

wip-memory-crystal

Searchable memory system for AI agents — captures conversations, embeds for semantic search, stores facts and preferences across sessions and tools.

Memory Crystal is a legitimate, well-documented AI memory management system. The pre-scan base64 IOCs are false positives — Buffer.from(..., 'base64') is standard AES-GCM ciphertext decoding in crypto.ts and poller.ts, not obfuscation or shell execution. All execSync usage is for documented CLI tooling (npm, git, crontab, Claude Code MCP). No credential theft, reverse shells, or hidden exfiltration. No evidence of malicious behavior.

Skill Namewip-memory-crystal

Duration83.4s

Enginepi

✓

Safe to install

No action needed. This is a legitimate memory management skill. The base64 usage flagged by the pre-scan is standard cryptographic practice (decoding ciphertext components for AES-GCM decryption). All shell execution is documented and necessary for the install/CLI functionality.

Findings 3 items

Severity	Finding	Location
Low	npm install without version pinning SKILL.md shows 'npm install -g @wipcomputer/memory-crystal' without a specific version (e.g., @0.7.33). This means npm may install a newer (potentially different) version than tested. `npm install -g @wipcomputer/memory-crystal` → Pin to specific version: npm install -g @wipcomputer/[email protected]	`SKILL.md:45`
Info	Pre-scan base64 IOCs are legitimate crypto operations The pre-scan flagged Buffer.from(payload.nonce, 'base64') and similar at crypto.ts:22,70,71,72 and poller.ts:488,489 as 'CRITICAL base64_cmd'. These are false positives — they decode base64-encoded ciphertext components (nonce, ciphertext, tag) as part of AES-256-GCM decryption. This is standard cryptographic practice, not obfuscation or shell code execution. `const key = Buffer.from(raw, 'base64'); // Decoding relay key from base64` → No action needed. These IOCs are benign.	`src/crypto.ts:22,70-72, src/poller.ts:488-489:22`
Info	execSync used throughout for legitimate CLI tooling child_process.execSync is used in installer.ts, ldm.ts, doctor.ts, mlx-setup.ts, cli.ts, bridge.ts, staging.ts, dev-update.ts, core.ts. All uses are for documented system operations: npm, git, crontab, launchctl, Claude Code CLI, 1Password op CLI. No dynamic command construction from user input. `execSync('crontab -l 2>/dev/null')` → No action needed. This is standard CLI tool behavior for an install/config skill.	`src/*.ts`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`WRITE`	`WRITE`	✓ Aligned	installer.ts:deployToLdm(), ldm.ts:scaffoldLdm() — writes to ~/.ldm/, ~/.opencla…
Network	`READ`	`READ`	✓ Aligned	core.ts:embedOpenAI(), embedOllama(), embedGoogle() — API calls to OpenAI/Ollama…
Shell	`WRITE`	`WRITE`	✓ Aligned	installer.ts, ldm.ts — execSync for npm, git, crontab, Claude Code CLI, 1Passwor…
Environment	`READ`	`READ`	✓ Aligned	Uses CRYSTAL_RELAY_URL, CRYSTAL_RELAY_TOKEN, OPENAI_API_KEY env vars for configu…
Skill Invoke	`READ`	`READ`	✓ Aligned	MCP server tools: crystal_search, crystal_remember, crystal_forget, crystal_stat…

6 Critical 94 findings

🔒