T02 · Agent Memory Poisoning
Warning
- Location
scripts/import_markdown_to_memos.py:21- Finding
Unvalidated Markdown Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Convert Memory Files Between Systems
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed memory-migration helper, but it can rewrite plugin configuration and write persistent agent memory without adequate confirmation, backups, or rollback safeguards.
Install only if you are intentionally migrating from memory-lancedb-pro to memos-local-openclaw-plugin and are comfortable reviewing the scripts first. Before running anything, manually back up your OpenClaw config, memory markdown files, and memos SQLite database; replace hard-coded paths carefully; do a dry run or inspect parsed records; and avoid importing untrusted markdown files into persistent agent memory.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/remove_memory_lancedb_pro.py:4- Finding
Configuration File Is Destructively Rewritten Without Backup or Atomic Replacement
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/import_markdown_to_memos.py:5- Finding
Live Memory Database Migration Lacks Backup, Schema Validation, and Idempotency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The stated purpose is memory conversion and import, but the operational content prominently includes removing plugin configuration and altering local state, which is a material behavior mismatch. This is dangerous because users or orchestration systems may invoke the skill expecting migration assistance while it also performs disruptive configuration changes that can disable components or alter persistence behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script's behavior does not match the declared skill purpose of converting memory files and importing markdown data. Instead, it silently removes the 'memory-lancedb-pro' plugin from the configuration, which can disable functionality and cause data access disruption or accidental loss of integration. In a migration-themed skill, this mismatch is especially dangerous because a user may trust it to preserve data while it performs destructive configuration changes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill contains code snippets that read and write configuration files and database-backed memory data, but it declares no tool scope or permission boundaries. In an agent setting, this creates an authorization gap where the agent may perform filesystem modifications without transparent consent or least-privilege constraints.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger conditions are very broad and can match generic requests about migration, markdown import, configuration changes, or plugin switching. Over-broad activation increases the chance that the skill is invoked in contexts where destructive config edits or database imports are inappropriate, leading to accidental misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The skill description and instructions are written entirely in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions direct deletion of plugin configuration and direct insertion into a SQLite database without prominent backup, rollback, schema validation, or integrity warnings. In context, this is risky because memory migration touches persistent user data; a malformed script, regex mismatch, or schema drift could corrupt records, create duplicates, or disable the existing memory system.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All example prompts in the evals are written in Chinese, and the file provides no indication that the skill supports multiple languages or is intentionally restricted to a Chinese-speaking context. This can reflect a natural-language policy issue if the skill behavior or evaluation setup assumes a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code performs persistent data writes by inserting markdown-derived content into the
chunkstable, which can affect user data state. The file contains no confirmation prompt, logging/print statement, or explanatory docstring/comment warning the user that content from the memory directory will be imported into the database.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script overwrites the configuration file in place without prompting the user, creating a backup, or providing rollback safeguards. This can cause irreversible configuration damage or service disruption if the change is unintended, the file structure differs from expectations, or the script is run in the wrong environment. The surrounding skill context increases risk because users expect a safe migration workflow, not silent destructive edits.
- Content