T06 · System Persistence
Error
- Location
SKILL.md:27- Finding
Installation of Persistent Scheduled Summary Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
Experience Summary Sys
Security checks for vulnerabilities and agentic risk
Overview
This skill openly builds an automated memory system, but it should be reviewed carefully because it preserves deleted/reset conversations and changes future agent behavior with recurring memory jobs.
Install only if you intentionally want OpenClaw to keep long-term summaries of conversation history, including deleted or reset sessions. Review or remove the deleted/reset ingestion, the global AGENTS.md retrieval rules, and the recurring cron jobs before use; prefer explicit memory lookups, exclude deleted/reset files by default, and add a clear way to purge derived summaries.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:83- Finding
Deleted and Reset Conversations Are Recovered and Repersisted
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:208- Finding
Persistent Global Agent Rules Enable Automatic Historical-Memory Injection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs the system to retain and reuse content from deleted/reset conversations in future summaries, creating persistent memory from data the user may have attempted to remove. In this context, the skill is specifically about long-term memory and retrieval, which makes this behavior more dangerous because it operationalizes unauthorized retention and resurfacing.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The proposed AGENTS.md rules instruct proactive retrieval of historical content based on vague references like '之前' or '上次', encouraging broad reuse of prior user data in new conversations. This increases the chance of unnecessary disclosure, mistaken cross-context recall, and leakage of sensitive information that is not needed for the current task.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example summary persists personal preferences and excerpts from deleted conversations into long-lived memory files, demonstrating storage of sensitive and potentially intentionally discarded data. This materially raises privacy, consent, and secondary-use risks because the information can be surfaced long after the original context was removed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs processing and preserving deleted/reset conversation files as input to persistent summaries. This defeats user expectations around deletion/reset semantics and creates a hidden retention channel for sensitive content that may later be surfaced or reused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill retains and processes deleted/reset conversations without a clear privacy notice or consent mechanism. Because these files may contain sensitive user content that users intended to discard, silent retention materially increases privacy and compliance risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The yearly-summary feature includes optional deletion of session artifacts, which introduces destructive file-management behavior beyond simple summarization. Even if framed as cleanup, bundling deletion into a summary workflow increases risk of accidental data loss and scope creep.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documented
find ... -deletecommands irreversibly remove files matching deleted/reset session patterns without strong safety controls. This is a destructive capability outside the core purpose of experience summarization and could erase audit-relevant or user-expected records.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cleanup commands perform irreversible deletion yet are presented as an optional operational detail rather than a high-risk action. Without prominent warnings or guardrails, users may execute them without understanding the consequences.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example memory content includes a stored user preference for responses in a specific persona and locale style: '温柔的台湾女生语气'. This reflects a language/locale-style constraint without indicating user opt-in handling or offering a choice, which can conflict with organizational language policy requirements.
- Content
Static analysis
No suspicious patterns detected.