OpenClaw Memory Curator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed memory-cleanup helper that reads and rewrites OpenClaw memory files with user approval and backups.

Install from a pinned reviewed version when possible, make sure backups are created before any rewrite, and review the proposed MEMORY.md and daily-note edits before approving because the skill intentionally compresses or removes low-value memory content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:21

Finding

Installation Uses an Unpinned Mutable Git Repository

Content

View full analysis

Vulnerability Details

File Location: README.md:21-23 and README.md:98-102
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The documented installation process clones the mutable default branch of an external GitHub repository:

bash

cd /root/clawd/skills
git clone https://github.com/1217047020/memory-curator.git

The English installation section repeats the same unpinned command:

bash

cd /root/clawd/skills
git clone https://github.com/1217047020/memory-curator.git

Technical Analysis

The installation instructions do not pin the Skill to an immutable commit, verified release artifact, or signed tag. They also provide no checksum or signature-verification procedure. Consequently, the content installed by this command may differ from the version covered by this audit.

This is a supply-chain trust weakness because the cloned repository contains both Agent instructions (SKILL.md) and executable code (scripts/curate_memory.py). If the upstream repository, maintainer account, or default branch is compromised, an attacker could replace these files without changing the documented installation command.

The audited version itself contains no evidence of malicious scripts, remote payload execution, command injection, persistence, privilege escalation, credential theft, or data exfiltration. The risk arises from the mutability and lack of verification of the documented installation source.

Attack Path

1. An attacker compromises the upstream GitHub account or obtains write access to the repository.
2. The attacker modifies the default branch, replacing SKILL.md or scripts/curate_memory.py with malicious content.
3. A user follows the README and clones the repository without selecting a reviewed commit or verifying its integrity.
4. The unreviewed content is placed directly in /root/clawd/skills, a location intended for trusted Skills.
5. OpenClaw loads th ...[truncated 1044 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a reviewed immutable commit rather than cloning the mutable default branch:

   bash

   git clone https://github.com/1217047020/memory-curator.git
   cd memory-curator
   git checkout --detach <reviewed-commit-sha>
   

2. Prefer signed, versioned release artifacts and document signature verification.
3. Publish a SHA-256 checksum for each release archive and require users to verify it before installation.
4. Protect release tags against modification and use signed Git tags where possible.
5. Document the exact commit corresponding to version 1.0.0.
6. Advise users to inspect SKILL.md and executable files after resolving the pinned revision and before enabling the Skill.
7. Consider automated provenance or reproducible-build attestations so users can confirm that downloaded artifacts match reviewed source code.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose centers on active memory curation and content transformation: organizing, deduplicating, summarizing, compressing, and maintaining long-term memory files. In contrast, the implementation is a utility for reporting statistics about markdown files in a memory directory, validating that expected workspace files/directories exist, and backing up the memory directory and MEMORY.md. These are materially different primary behaviors. While backup/inspection could support a memory-maintenance workflow, they do not implement the declared curation capabilities, and the main advertised functions are absent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly describes a workflow that rewrites and compresses MEMORY.md and daily memory notes, but it does not clearly warn that this can irreversibly discard information if backups are skipped, incomplete, or later overwritten. In a memory-management skill, users may trust the automation and invoke destructive operations on valuable long-term context, leading to silent data loss or corruption of persistent agent state.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description says to use the skill when the user asks to 'organize memory' or 'maintain long-term memory', which are fairly broad natural-language triggers without explicit boundaries or exclusion conditions. This can cause unintended invocation for general organizational requests rather than only for the specific memory-file curation workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a memory curator that organizes, deduplicates, summarizes, and compresses memory content. In this file, the implemented commands only inspect files, validate expected workspace structure, and create backups; there is no logic for reorganization, deduplication, summarization, or compression of memory data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The inline CLI documentation explicitly frames the script as a backup/inspection/validation tool. That stated intent diverges from the broader skill documentation promising organization, deduplication, summarization, and compression, indicating active documentation mismatch rather than mere omission.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.