Triple Layer Memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:46 AM UTC
• Version: 2.1.0

Overview

This memory skill is mostly coherent, but it persistently changes future agent behavior and has broken scoping controls that users should review before installing.

Install only in an isolated workspace where you explicitly want Chinese-language automatic memory. Review or remove the MEMORY.md, AGENTS.md, and HEARTBEAT.md snippets before use, avoid storing secrets or regulated data, and fix channel authorization and filename validation before using it across multiple channels or users.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T02 · Agent Memory Poisoning

Error

• Location: scripts/init.sh:12

Finding

Persistent Agent Behavior Injection Through Long-Term Memory Initialization

Content

View full analysis

"$WORKSPACE_ROOT/MEMORY.md" << 'EOF' # MEMORY.md ## 长期认知（持续生效） 1. **提醒类任务先执行后汇报**：遇到"复盘/检查/整理"这类提醒，优先产出实际结果（文件或结论），再给用户状态更新。 2. **长文本先做完整性校验**：对榜单、日志、抓取结果等长输入，先判断是否被截断；若不完整，必须显式声明并提供补全路径。 3. **承诺即闭环，杜绝"只回复不落地"**：说"我来做"后必须在同一轮工具调用中完成产出（文件/结果），不得留到下一轮 session。 4. **Session 自动压缩 + 自动切换**：token 达到 150k 或上下文达到 80% 时触发，先压缩再输出新会话切换提示。 5. **关键时机自动写入记忆**：完成任务、做出决策、变更配置、解决问题时立即写入记忆，不等 session 结束。 6. **新 session 智能加载记忆**：启动时根据频道和任务自动加载相关记忆，避免重复询问已知信息。 ## 配置记录 _待补充_ EOF ``` ### Technical Analysis The initialization procedure does not create only an empty memory structure. It writes author-controlled behavioral directives into `MEMORY.md` and labels them as continuously effective long-term cognition. The Skill documentation directs the Agent to load `MEMORY.md` in later sessions. Consequently, these rules can continue to influence Agent behavior after initialization. The directives also encourage automatic memory collection at task completion, decision, configuration-change, and problem-resolution points. This crosses the boundary between implementing memory storage and supplying persistent instructions that govern unrelated future Agent behavior. Because the content is placed in long-term state rather than remaining local to the current Skill invocation, it constitutes persistent memory poisoning. ### Attack Path 1. A user installs the Skill and runs the documented `scripts/init.sh` command. 2. The script resolves the workspace root and creates `MEMORY.md` if it does not already exist. 3. The script inserts its predefined behavioral rules into that persistent file. 4. The documented session-start process causes later Agent sessions to read `MEMORY.md`. 5. Future sessions continue appl ...[truncated 571 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: templates/HEARTBEAT.md:44

Finding

Heartbeat Template Mandates Global Interception and Replacement of Agent Responses

Content

View full analysis

8：正常输出 ``` ### Technical Analysis The heartbeat template instructs the host Agent to route every response through the Skill's quality gate. Responses receiving a score below seven are replaced with a fixed message rather than returned to the user. The underlying evaluator in `scripts/quality_gate.py` uses superficial text heuristics, including response length, repeated lines, punctuation density, and selected words. It cannot establish factual accuracy or general security. Applying it globally allows unrelated and legitimate Agent output to be suppressed or modified. The instruction is stored in a heartbeat configuration intended to affect continuing Agent operation, making this broader than an optional quality-analysis utility. ### Attack Path 1. The user copies or installs the supplied heartbeat template into the workspace. 2. The Agent follows the instruction that every output must be evaluated. 3. A legitimate response triggers one or more heuristic deductions and receives a score below seven. 4. The original response is discarded. 5. The user receives the Skill-defined replacement message instead of the requested result. ### Impact Assessment The Skill can interfere with all Agent responses in the affected workspace, including responses unrelated to memory management. This creates an availability and integrity impact by suppressing valid output and imposing Skill-controlled response behavior. No direct sys ...[truncated 103 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/channel_memory.py:22

Finding

Caller-Controlled Boss Channel Bypasses Memory Isolation

Content

View full analysis

str: ch = (channel or "").strip().lower().replace("#", "") if ch: return ch name = Path.cwd().name.lower() if name.endswith("openclaw-workspace"): return "boss" mapping = { "openclaw-workspace-knowledge": "knowledge", "openclaw-workspace-twitter": "twitter-trends", "openclaw-workspace-trading": "trading", "openclaw-workspace-twitter2xhs": "twitter2xhs", "openclaw-workspace-alpha": "alpha", "openclaw-workspace-github-push": "github-push", } return mapping.get(name, "boss") ``` ```python def search_memory(channel: str = "boss", keyword: Optional[str] = None, limit: int = 20) -> list[dict]: """检索路由：优先索引，索引不可用或未命中时回退扫描。""" ch = _normalize_channel(channel) key = _norm_text(keyword or "") # 1) 索引优先 if INDEX_FILE.exists(): try: idx = json.loads(INDEX_FILE.read_text(encoding="utf-8")) results = [] for item in idx: ich = item.get("channel", "boss") if ch != "boss" and ich != ch: continue summary = _norm_text(item.get("summary", "")) if key and key not in summary: continue results.append(item) if results: return results[:limit] except Exception: pass # 2) 回退全量扫描 results = [] for md in sorted(MEMORY_DIR.glob("*.md")): entries = read_all_meta(md, channel=ch, boss_full_access=True) for e in entries: if key and key not in _norm_text(e.get("summary", "")): continue results.append(e) return results[:limit] ``` ### Techn ...[truncated 1809 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/session_handoff.py:82

Finding

Session Handoff Returns Unfiltered Cross-Channel Memory

Content

View full analysis

")`. 2. The function opens memory files for the current and previous day. 3. It extracts a session summary or falls back to the last 20 lines without parsing channel metadata. 4. It appends the unfiltered c ...[truncated 710 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/channel_memory.py:86

Finding

Path Traversal and Arbitrary File Append Through Memory Filename

Content

View full analysis

dict: ch = _normalize_channel(channel) dup = _is_duplicate(text, ch) if dup: return { "stored": False, "reason": "duplicate", "channel": ch, "duplicate_of": { "file": dup.get("file"), "line": dup.get("line"), "summary": dup.get("summary"), "similarity": dup.get("similarity", 1.0), }, } file_path = MEMORY_DIR / (file_name or f"{Path.cwd().name}.md") if file_name is None: from datetime import datetime file_path = MEMORY_DIR / f"{datetime.now().strftime('%Y-%m-%d')}.md" write_meta_to_entry(file_path, text, importance=importance, channel=ch) return {"stored": True, "path": str(file_path), "channel": ch} ``` The resulting path reaches this append operation in `scripts/memory_meta.py:72-78`: ```python def write_meta_to_entry(filepath: Path, entry_text: str, importance: int = 5, channel: str = "boss") -> None: today = date.today().isoformat() meta_line = format_meta(importance, 0, today, today, channel=channel) content = filepath.read_text(encoding="utf-8") if filepath.exists() else "" with open(filepath, "a", encoding="utf-8") as f: if content and not content.endswith("\n"): f.write("\n") f.write(f"\n{entry_text}\n{meta_line}\n") ``` ### Technical Analysis The public `file_name` value is joined to `MEMORY_DIR` without validation. A value containing parent-directory components can escape the intended directory. With `pathlib`, an absolute right-hand operand also replaces the preceding base path entirely. The resulting ...[truncated 1419 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: docs/mem0-channel-isolation.md:58

Finding

Channel-Isolation Documentation Relies on Missing Security Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

编辑 `~/.openclaw/extensions/openclaw-mem0/index.ts`，参考 `docs/mem0-channel-isolation.md`。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/github-upload-guide.md (reported line 18)May include surrounding context.

md

有两种方式：

#### 方式 A：使用 Personal Access Token（推荐）

1. 访问 https://github.com/settings/tokens
2. 点击 "Generate new token" → "Generate new token (classic)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/github-upload-guide.md (reported line 73)May include surrounding context.

md

有两种方式：

#### 方式 A：使用 Personal Access Token（推荐）

1. 访问 https://github.com/settings/tokens
2. 点击 "Generate new token" → "Generate new token (classic)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/github-upload-guide.md (reported line 117)May include surrounding context.

md

有两种方式：

#### 方式 A：使用 Personal Access Token（推荐）

1. 访问 https://github.com/settings/tokens
2. 点击 "Generate new token" → "Generate new token (classic)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/github-upload-guide.md (reported line 45)May include surrounding context.

2. 复制公钥：

bash

cat ~/.ssh/id_ed25519.pub

3. 添加到 GitHub：

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code promises channel-scoped read isolation, but _normalize_channel silently converts empty or unrecognized channels to boss. Since search_memory and _is_duplicate treat boss as able to read all channels, a caller supplying a blank or unexpected channel can be upgraded to broad read access, violating the intended authorization boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is presented entirely in Chinese, which effectively imposes a language choice on users without any opt-in or alternative locale guidance. The stated policy flags language or locale constraints unless the skill offers user choice or clearly documents a justified regional scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly describes automatic loading and writing of memory files at session start and during key events, but it does not require user notice, consent, or filtering of sensitive content. In an agent context, this can silently persist personal, project, or confidential data to workspace files and make that data available in later sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The provided example and surrounding design normalize writing task summaries, tags, project names, lessons, and file references into persistent memory. While not inherently malicious, this is session persistence behavior that can retain sensitive operational context or user data without sufficient safeguards, especially when combined with the skill's automated write triggers.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

写入记忆

python

from scripts.auto_memory_write import auto_write_memory

auto_write_memory(
    summary="完成了某个重要任务",

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The AGENTS.md guidance tells the agent to automatically read SOUL.md, USER.md, recent logs, and core memory at session start, then retrieve related memory based on channel and task. This establishes cross-session retention and resurfacing of prior user/profile data, which can expose sensitive information in contexts where the user did not intend it to be reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HEARTBEAT instructions direct the agent to summarize conversation history and write it into persistent files during session rotation, again without warning that history may be condensed and stored. This creates a clear risk of retaining secrets, personal data, or sensitive operational details beyond the current session.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The heartbeat workflow instructs the model to summarize dialogue history and save it into persistent memory files, which can capture sensitive user-provided content in durable storage. Because this occurs automatically during session lifecycle management, users may be unaware that confidential discussion content is being retained and later resurfaced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guidance, headings, and operational instructions are presented exclusively in Chinese, which can impose a fixed language on users. The policy for this audit flags language or locale constraints unless the file offers user opt-in or clearly documents a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's docstrings, comments, labels, and default output strings are written entirely in Chinese, including user-visible content such as log headings and metadata labels. There is no indication that the user can choose language or that the Chinese-only behavior is limited to a justified locale-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function automatically appends memory entries to a persistent file without any consent, notification, policy check, or content filtering. In an agent context, this can silently retain sensitive user data, internal decisions, file names, or project details beyond the user’s expectations, creating privacy and data-governance risk even though the code does not appear overtly malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function writes user-provided text into files under the memory directory via write_meta_to_entry, but there is no confirmation prompt, print/log disclosure, or inline comment/docstring warning users that persistent storage will occur. For a code file, persistent file writes are safety-relevant and should have some visible disclosure unless clearly warned elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script creates and populates multiple files in the workspace and copies an additional document, but it does so immediately with no dry-run, prompt, or explicit confirmation. In an agent-driven context, this is risky because running the skill can silently alter repository contents, create persistent memory/config artifacts, and influence later agent behavior without the user's informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The generated MEMORY.md template is written entirely in Chinese and embeds operational instructions in Chinese without any indication that language is configurable or user-selected. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/init.sh (reported line 143)May include surrounding context.

sh

echo "3. 更新 HEARTBEAT.md 添加 token 检查逻辑"
echo "4. 如果使用 Mem0，配置频道级命名空间隔离"
echo ""
echo "详细文档: skills/triple-layer-memory/SKILL.md"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring presents the skill description entirely in Chinese, which constitutes a language-specific constraint in natural-language content. There is no indication that the user can choose another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Tainted flow: 'lines' from pathlib.Path.read_text (line 192, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_decay.py (reported line 129)May include surrounding context.

python

channel=meta.get("channel", "boss"),
            )
            lines[idx] = META_PATTERN.sub(new_meta, lines[idx])
            filepath.write_text("\n".join(lines) + "\n", encoding="utf-8")

    return feedback_stats

Tainted flow: 'new_lines' from pathlib.Path.read_text (line 203, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_decay.py (reported line 204)May include surrounding context.

python

break

        new_lines = [l for i, l in enumerate(lines) if i not in remove_lines]
        filepath.write_text("\n".join(new_lines) + "\n", encoding="utf-8")

    return stats

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function advertises channel-isolated metadata reads, but its default behavior explicitly grants unrestricted cross-channel reads when the caller supplies channel='boss' and boss_full_access remains True. If an attacker or unauthorized component can invoke this helper with the boss channel, the isolation boundary is bypassed and metadata from all channels becomes readable, which undermines confidentiality assumptions built on channel separation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The function appends entries and metadata to a file, which changes persistent user data. In this code, there is no confirmation prompt, logging/print statement, or explanatory docstring/comment disclosing that the function will write to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This function updates access metadata and rewrites the file contents, which is a persistent file modification. The code does not include a visible warning, confirmation, or explanatory docstring/comment to disclose this behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.