Layered Memory Sys

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:31 AM UTC
• Version: 2.4.1

Overview

The skill is a coherent memory-management system, but it needs Review because it exposes sensitive long-term memory through unauthenticated services and installs persistent background components with broad local session access.

Install only in a trusted local environment. Do not expose ports 3456 or 3457 to a network without adding authentication, loopback binding, and CORS/origin restrictions. Avoid running the installer as root unless you intentionally want a persistent service, and review cloud embedding or summarization settings before using API keys because memory and session text may be sent to third-party providers.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T06 · System Persistence

Error

• Location: install.sh:103

Finding

Automatic Installation of a Persistent System Service

Content

View full analysis

/dev/null; then SCRIPTS_DIR="$(cd "$(dirname "$0")" && pwd)" cat > /tmp/layered-memory.service << EOF [Unit] Description=layered-memory-sys API Service After=network.target [Service] Type=simple WorkingDirectory=${SCRIPTS_DIR} ExecStart=$(which node) ${SCRIPTS_DIR}/scripts/start-api.mjs Restart=always RestartSec=5 Environment=NODE_ENV=production [Install] WantedBy=multi-user.target EOF if [ "$EUID" -eq 0 ]; then cp /tmp/layered-memory.service /etc/systemd/system/ systemctl daemon-reload systemctl enable layered-memory systemctl start layered-memory ``` ### Technical Analysis When native installation runs as root, the installer automatically copies a systemd unit into `/etc/systemd/system`, enables it at boot, starts it immediately, and configures it with `Restart=always`. A persistent service can be reasonable for an explicitly selected server deployment, but automatic system-level registration exceeds the minimum privilege needed merely to install or test the memory Skill. The installation flow does not request separate confirmation for persistence or create a dedicated restricted service account. The service therefore runs under the account used by systemd, which defaults to root because no `User=` directive is present. The service executes source code directly from the project directory. If an untrusted user can later modify that directory, the modified code will execute with the service's privileges after a restart or reboot. ### Attack Path 1. A user invokes `bash install.sh` as root and selects native installation. 2. The script writes the service definition through the predictable path `/tmp/layered-memory.service`. 3. The unit is copied to `/etc/systemd/system/layered-memory.service`. 4. `s ...[truncated 680 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/api/server.mjs:14

Finding

Unauthenticated REST API Exposes Full Memory Administration

Content

View full analysis

{ const url = new URL(req.url, `http://localhost:${port}`); const path = url.pathname; const method = req.method; // CORS res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PATCH,DELETE,OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); if (method === 'OPTIONS') { res.writeHead(200); res.end(); return; } // JSON body parsing let body = {}; if (method === 'POST' || method === 'PATCH') { const chunks = []; for await (const chunk of req) chunks.push(chunk); try { body = JSON.parse(Buffer.concat(chunks).toString()); } catch {} } try { const result = await route(path, method, url.searchParams, body, config); res.writeHead(result.status || 200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(result.data || result)); } catch (e) { res.writeHead(500, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: e.message })); } }); _server.listen(port); ``` Sensitive and destructive routes include: ```js if (path === '/api/memories' && method === 'GET') { return listMemories(...); } if (path === '/api/memories' && method === 'POST') { const mem = createMemory(body); return { status: 201, data: mem }; } if (path.match(/^\/api\/memories\/[^/]+$/) && method === 'PATCH') { const id = path.split('/').pop(); const mem = updateMemory(id, body); return mem; } if (path.match(/^\ ...[truncated 2447 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/api/ws.mjs:9

Finding

Unauthenticated WebSocket Broadcasts Live Memory Events

Content

View full analysis

{ _clients.add(ws); console.log(`WebSocket client connected (current: ${_clients.size})`); ws.on('close', () => { _clients.delete(ws); console.log(`WebSocket client disconnected (current: ${_clients.size})`); }); ws.on('message', (msg) => { try { const data = JSON.parse(msg.toString()); if (data.type === 'ping') ws.send(JSON.stringify({ type: 'pong' })); } catch {} }); ws.send(JSON.stringify({ type: 'connected', version: '2.0.0' })); }); // Subscribe to and push all events for (const event of Object.values(EVENTS)) { on(event, (data) => { broadcast({ type: event, data, timestamp: Date.now() }); }); } console.log(`WebSocket service started: ws://localhost:${port}`); return _wss; } ``` Broadcasting sends every event to every client: ```js function broadcast(message) { const data = JSON.stringify(message); for (const client of _clients) { if (client.readyState === 1) { try { client.send(data); } catch {} } } } ``` ### Technical Analysis The WebSocket server accepts every connection without validating an authentication token, client identity, or HTTP `Origin`. It then subscribes every connected client to every event type. REST memory creation and update operations emit complete memory objects. Consequently, event data may contain titles, summaries, content, source information, metadata, and other sensitive memory fields. The Docker configuration publishes WebSocket port 3457 directly on the host. ### Attack Path 1. The Skill starts its W ...[truncated 921 chars]

Remediation

View remediation

other

Error

• Location: src/search/llm-summarizer.mjs:6

Finding

Implicit Cloud Transmission of Memory and Session Content

Content

View full analysis

`${m.role === 'user' ? 'User' : 'Assistant'}: ${m.text.slice(0, 200)}`) .join('\n'); const prompt = `Summarize the key points of the following dialogue: ${dialogue} Summary:`; try { const summary = await callLLM(prompt, model); return summary; } catch (e) { return extractFallbackSummary(messages, maxLength); } } ``` The prompt is transmitted to external providers: ```js if (apiKeys.doubao) { const res = await fetch('https://ark.cn-beijing.volces.com/api/v3/chat/completions', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKeys.doubao}`, }, body: JSON.stringify({ model: modelName || 'doubao-seed-1-6-flash-250828', messages: [{ role: 'user', content: prompt }], max_tokens: maxLength || 200, }), }); } if (apiKeys.dashscope) { const res = await fetch('https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKeys.dashscope}`, }, body: JSON.stringify({ model: modelName || 'qwen-turbo', messages: [{ role: 'user', content: prompt }], max_tokens: maxLength || 200, ...[truncated 2948 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/api/server.mjs:36

Finding

Unbounded HTTP Request Buffering Enables Remote Denial of Service

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (108)

Known Vulnerable Dependency: protobufjs==6.11.5 — 11 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +8 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

protobufjs 6.11.5 is flagged with numerous advisories including denial of service and potential code-injection issues in generated output paths. This is especially concerning because the package has an install script and may be reachable through optional model/ONNX-related features that often ingest external model or metadata files.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: tar==6.2.1 — 12 advisory(ies): CVE-2026-59873 (node-tar: Decompression/parse DoS via unlimited input); CVE-2026-24842 (node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Trave); CVE-2026-26960 (Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in no) +9 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence

Finding

tar 6.2.1 is a known vulnerable release with advisories for path traversal, arbitrary file overwrite/read, and decompression/parse denial of service. Since this project advertises import/export, backup, and Docker deployment, archive handling is contextually relevant, making vulnerable tar-processing dependencies more dangerous than in a purely static library.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger words are extremely broad—terms like '记忆', '分层', '归档', and '备份' are common in ordinary conversations and can activate the skill unintentionally. Because this skill includes data-modifying behaviors such as import/export, archiving, forgetting, backups, and deployment, accidental invocation could cause undesired memory writes, deletions, exports, or shell-backed operations in contexts where the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

node scripts/dream-cycle.mjs

Known Vulnerable Dependency: brace-expansion==1.1.14 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

brace-expansion 1.1.14 is a known vulnerable version with multiple denial-of-service issues from pathological expansion patterns. Even though it is transitive and optional, ReDoS/expansion DoS bugs can be triggered if attacker-controlled glob-like patterns reach code paths that use minimatch/glob during install-time or runtime tooling.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.32.6 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

sharp 0.32.6 inherits vulnerabilities from native image-processing libraries such as libvips/libheif, which commonly expose memory corruption or parsing flaws on crafted media. In a memory-management skill, image support is not the core function, so this is unnecessary attack surface if optional transformer/image paths are enabled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

User-controlled data from memory titles, tags, and dream-log messages is inserted directly into HTML via template strings without escaping. An attacker who can influence stored memory content or logs can inject arbitrary HTML/JavaScript into the generated report, leading to stored XSS when the panel is opened and potentially exposing sensitive local memory contents or performing actions in the browser context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code starts an unauthenticated WebSocket service on a network port and immediately accepts arbitrary client connections. In a memory-management system, exposing a live event stream without access control materially increases the risk of unauthorized data access and surveillance of internal operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code persistently stores user conversation content whenever Chinese 'remember this' phrases are detected, but it does so automatically and without any explicit user-facing consent, preview, or warning at the time of storage. In a long-memory agent skill, this can silently retain sensitive personal data, credentials, health information, or confidential business content that appeared in session logs, expanding privacy and data-retention risk far beyond the immediate chat.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The long-conversation summarization path creates new memory records even when the user never asked to save anything, based solely on conversation length and inferred topics. That behavior can unexpectedly preserve private discussion themes or contextual summaries in persistent storage, which is especially risky in a system explicitly designed for durable layered memory and later retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown instructs users to start an API service and lists HTTP/WebSocket endpoints, then later shows search and memory-creation requests. However, it does not include any warning about privacy or system-integrity implications of exposing memory contents via local network services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

搜索记忆

bash

curl -X POST http://localhost:3456/api/search \
  -H 'Content-Type: application/json' \
  -d '{"query":"记忆系统","limit":10}'

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises shell-based setup and execution commands such as npm install, bash install.sh, and node script entrypoints, but the manifest shown in SKILL.md does not declare any tool scope or allowed-tools boundaries. That creates an execution-surface mismatch: an agent may invoke shell-capable behavior without explicit least-privilege constraints or user visibility into what filesystem, network, or process actions are expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is entirely in Chinese and explicitly highlights '中文关键词搜索', with no indication that users may choose another language or locale. This can constitute a language/locale policy issue when a skill implicitly constrains interaction to a specific language without documenting user choice or a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill prominently describes destructive or data-affecting features—automatic forgetting, archiving, merging, import/overwrite/append modes, backups, and dream-cycle processing—without a clear warning about irreversible effects or confirmation requirements. In a memory-management skill, these capabilities are contextually legitimate, but they are still dangerous because they can alter or remove long-term agent state and may expose stored data through export or backup paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description and all auto-write keyword patterns are specified only in Chinese, which suggests the skill is designed to recognize and operate in a single language. There is no indication of user opt-in, multilingual support, or a documented reason for restricting operation to this locale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The configuration points sessionDir to ${HOME}/.openclaw/agents/main/sessions, which is outside the skill-scoped memory directory and appears to reference a broad agent session store. For a memory-management skill, this creates unnecessary access to potentially sensitive conversation history from other sessions or components, increasing the risk of over-collection, privacy leakage, and unintended cross-context persistence.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The autoWrite rules use broad natural-language triggers such as '记住', '别忘了', and generic completion phrases like '已经' and '成功', which can match ordinary conversation rather than explicit user consent to persist data. In a long-term memory skill with auto-write enabled, this can cause unintended storage of sensitive, irrelevant, or transient information, expanding retention beyond user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document declares lang="zh-CN" and all visible UI strings are in Chinese, which imposes a specific language/locale on users. There is no indication in this file that the language choice is optional, user-configurable, or justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The native installation path installs a systemd service and also starts the API in the background via nohup without any explicit opt-in beyond selecting the install mode. This creates persistent execution and modifies host runtime state, which is risky for an agent skill because users may not expect service registration and automatic process launch from a convenience installer.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

systemctl enable registers the service to start automatically on boot, establishing persistence on the host. In an agent skill/install script context, this is security-relevant because it changes long-term system behavior and can leave a network-accessible API running continuously without a separate explicit consent step.

Content

Scanner excerpt · install.sh (reported line 125)May include surrounding context.

sh

if [ "$EUID" -eq 0 ]; then
      cp /tmp/layered-memory.service /etc/systemd/system/
      systemctl daemon-reload
      systemctl enable layered-memory
      systemctl start layered-memory
      echo -e "  ✅ systemd 服务已安装并启动"
    else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 130)May include surrounding context.

sh

echo -e "  ✅ systemd 服务已安装并启动"
    else
      echo -e "  ⚠️ 非 root 用户，跳过 systemd 安装"
      echo "    手动: sudo cp /tmp/layered-memory.service /etc/systemd/system/"
    fi
  fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

Launching the API with nohup in the background causes the service to persist after the installer exits, which can surprise users and reduce visibility into what is running. For a memory-management skill that exposes an API on localhost, unattended background execution increases the risk of accidental exposure, misuse, or stale long-lived processes.

Content

Scanner excerpt · install.sh (reported line 136)May include surrounding context.

sh

# 启动服务
  echo -e "\n🚀 启动服务..."
  nohup node scripts/start-api.mjs > /tmp/layered-memory.log 2>&1 &
  echo "  ✅ 服务已启动 (PID: $!)"
  
  echo -e "\n${GREEN}✅ 安装完成!${NC}"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language comments and console output are written in Chinese, which imposes a specific language on users without offering a locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's comments, command descriptions, and console messages are consistently written in Chinese, which imposes a specific language on users of the CLI. The policy allows locale-specific behavior only when it is opt-in or clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/search/embedder.mjs:34

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/search/llm-summarizer.mjs:40