Memory Orchestrator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:15 AM UTC
• Version: 1.0.0

Overview

This memory skill has a coherent purpose, but it installs persistent background behavior and can sync private memory data without enough consent, scoping, or trust controls.

Review this carefully before installing. Use an isolated environment first, avoid running the default installer as-is, remove or gate the sudo systemd steps and cron job, validate any Git remote and encryption before syncing memory, restrict hooks and proactive triggers, and pin dependencies before using it with private conversations, recordings, images, credentials, or work data.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T06 · System Persistence

Error

• Location: install.sh:52
• Finding: Installer creates privileged and recurring persistence without explicit opt-in<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:52-55`, `install.sh:89-92`; related service startup in `run.sh:12-18` **Vulnerability Type**: Persistent system service and scheduled task registration **Risk Level**: High ### Vulnerable Code ```bash if ! systemctl is-active --quiet syncthing@claw 2>/dev/null; then sudo systemctl enable syncthing@claw sudo systemctl start syncthing@claw fi ``` ```bash if ! crontab -l 2>/dev/null | grep -q "auto-commit-memory.sh"; then (crontab -l 2>/dev/null; echo "*/30 * * * * $SKILL_DIR/scripts/auto-commit-memory.sh >> $LOG_FILE 2>&1") | crontab - fi ``` Related startup behavior: ```bash if systemctl is-active --quiet syncthing@claw 2>/dev/null; then echo "Syncthing is already running" else sudo systemctl start syncthing@claw sleep 2 fi ``` ### Technical Analysis The installer enables a system-level Syncthing service and adds a user cron entry that runs every 30 minutes. These changes survive the installation process and future interactive sessions. Enabling a service with `sudo` crosses a privilege boundary and affects system startup behavior. Continuous synchronization is related to an advertised optional feature, but it is not required for local memory indexing, searching, tagging, or graph generation. The installer does not request explicit consent for either persistence mechanism, offer a local-only installation mode, validate the service configuration, or provide an uninstall routine. The cron entry invokes a script from a writable workspace path. If that script or any parent path becomes attacker-controlled, the persistent scheduler becomes a recurring code-execution mechanism under the affected user account. ### Attack Path 1. A user runs `install.sh` expecting the memory Skill to be installed. 2. The script invokes `sudo systemctl enable syncthing@claw`, causing Syncthing to start automatically in future boots. 3. The script adds `auto-commit-memory.sh` to the user's ...[truncated 663 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make Syncthing and cron configuration explicit, optional installation modes. - Do not invoke `sudo` from the general-purpose installer. Print a reviewed command that an administrator may run separately. - Prefer a user-scoped service such as `systemctl --user` when persistence is explicitly requested. - Display the exact schedule, executable path, and data synchronized before asking for confirmation. - Verify script ownership and permissions before scheduling it; reject group-writable or world-writable paths. - Provide an uninstall command that disables the service and removes only the exact cron entry created by this Skill. - Default to manual synchronization and local-only operation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auto-commit-memory.sh:17
• Finding: Recurring job automatically pushes sensitive memory to an unrestricted Git remote<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto-commit-memory.sh:17-38`; additionally invoked by `workflows/memory-sync.yaml:22-52` **Vulnerability Type**: Unvalidated sensitive-data synchronization **Risk Level**: High ### Vulnerable Code ```bash cd /home/claw/.openclaw/workspace if git diff --quiet && git diff --cached --quiet; then log "No changes detected. Skipping commit." exit 0 fi git add MEMORY.md memory/ TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S') MESSAGE="Auto-sync memory at $TIMESTAMP" git commit -m "$MESSAGE" if git remote -v | grep -q origin; then git push origin main 2>/dev/null && log "Pushed successfully." || log "Push failed (check remote config)." else log "No remote configured. Commit only." fi ``` The synchronization workflow also performs direct pull and push operations: ```yaml pre-session: - command: git pull origin main condition: git remote -v | grep -q origin post-session: - command: /home/claw/.openclaw/workspace/scripts/auto-commit-memory.sh commands: sync: steps: - name: pull command: git pull origin main condition: git remote -v | grep -q origin - name: commit command: /home/claw/.openclaw/workspace/scripts/auto-commit-memory.sh - name: push command: git push origin main condition: git remote -v | grep -q origin ``` ### Technical Analysis The recurring synchronization script stages `MEMORY.md` and the complete `memory/` directory, commits them, and pushes them to any Git remote named `origin`. It does not validate the remote owner, hostname, protocol, or repository identity. It also does not verify that encryption is active before staging or transmitting the files. The project advertises `git-crypt`, but encryption is implemented as a separate optional workflow command. Synchronization can run before the encryption workflow, after encryption configuration is removed, or when `git-crypt` is unavailable. Merely detectin ...[truncated 1135 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Disable automatic Git pushes by default and require explicit synchronization enrollment. - Use a dedicated memory repository instead of operating on the whole workspace repository. - Pin and validate the expected remote URL, repository fingerprint, owner, and transport protocol. - Display the destination and files to be transmitted before the first push. - Fail closed unless encryption has been positively verified for every sensitive tracked path. - Add deny-by-default staging rules for raw transcripts, image metadata, logs, state files, credentials, and temporary data. - Avoid suppressing `git push` error output; retain auditable failure details without logging credentials. - Add a dry-run mode that lists files and remote destinations without committing or transmitting data. - Require an explicit user-controlled configuration flag before the cron job may perform network operations. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: workflows/memory-sync.yaml:65
• Finding: Workflow parameter interpolation permits shell command injection<![CDATA[ ## Vulnerability Details **File Location**: `workflows/memory-sync.yaml:65-84`; similar sinks in `workflows/memory-multimodal.yaml:80-128` **Vulnerability Type**: Shell command injection **Risk Level**: Critical ### Vulnerable Code ```yaml - name: detect-type command: | FILE="${file_path}" if [[ "$FILE" =~ \.(jpg|jpeg|png|gif|webp|bmp)$ ]]; then echo "TYPE=image" >> $GITHUB_ENV elif [[ "$FILE" =~ \.(mp3|wav|m4a|flac|ogg|webm)$ ]]; then echo "TYPE=audio" >> $GITHUB_ENV else echo "TYPE=unknown" >> $GITHUB_ENV fi - name: process-image condition: "${TYPE} == 'image'" command: python3 /home/claw/.openclaw/workspace/scripts/multimodal_processor.py image "${file_path}" - name: process-audio condition: "${TYPE} == 'audio'" command: python3 /home/claw/.openclaw/workspace/scripts/multimodal_processor.py audio "${file_path}" --language zh --model tiny - name: update-index command: python3 /home/claw/.openclaw/workspace/scripts/multimodal_processor.py build-index --modality ${TYPE} - name: log command: echo "[$(date)] Processed ${TYPE}: ${file_path}" >> memory/state/sync.log ``` Additional parameterized shell commands include: ```yaml command: python3 "${WORKSPACE}/scripts/multimodal_processor.py" image "${path}" --caption "${caption}" ``` ```yaml command: python3 "${WORKSPACE}/scripts/multimodal_processor.py" audio "${path}" --language "${language}" --model "${model}" ``` ```yaml command: python3 "${WORKSPACE}/scripts/multimodal_processor.py" search "${query}" --top-k ${top-k} --modalities ${modalities} ``` ### Technical Analysis Untrusted workflow parameters are interpolated into command strings that are executed by a shell. Quoting a template expression does not provide reliable protection when template substitution happens before shell parsing. A value containing a quote, command substitution, backtick, newline, or shell operator can alter the resulting command. Parameters such as `top-k`, `modalitie ...[truncated 1524 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not construct shell command strings from workflow parameters. - Configure the workflow runner to invoke an executable with an argument array, bypassing the shell. - Pass dynamic values through environment variables and read them directly from Python. - Apply strict allowlists: - `model`: approved Whisper model names only. - `language`: valid language-code pattern only. - `top-k`: bounded integer only. - `modalities`: fixed enumeration only. - Paths: canonicalized paths constrained to the intended multimodal directory. - Reject control characters, newlines, NUL bytes, and paths outside the approved root. - Treat file extensions only as type hints, not as security validation. - If a shell is unavoidable, use a trusted escaping facility after validation and never interpolate values into shell source. - Add regression tests containing quotes, backticks, `$()`, semicolons, newlines, and traversal sequences. ]]>

T02 · Agent Memory Poisoning

Error

• Location: workflows/memory-sync.yaml:22
• Finding: Remote memory is imported and injected into future Agent context without trust controls<![CDATA[ ## Vulnerability Details **File Location**: `workflows/memory-sync.yaml:22-28`; context injection logic in `workflows/memory-activerecommend.yaml:237-250,311-338,385-424` **Vulnerability Type**: Persistent memory poisoning **Risk Level**: High ### Vulnerable Code ```yaml hooks: pre-session: - command: git pull origin main condition: git remote -v | grep -q origin fallback: syncthing cli sync memory - command: memory_search --init-index ``` Retrieved memory is configured for inline delivery: ```yaml channels: - type: "inline" enabled: true - type: "notification" enabled: true sound: false ``` Raw memory excerpts are selected for recommendations: ```python memory_path = "${WORKSPACE}/MEMORY.md" if Path(memory_path).exists(): content = Path(memory_path).read_text() lines = content.split('\n') for i, line in enumerate(lines): if any(kw in line for kw in ['decide', 'choose', 'plan', 'reason']): start = max(0, i - 2) end = min(len(lines), i + 5) context = '\n'.join(lines[start:end]) results.append({ "type": "decision", "source": "MEMORY.md", "preview": context[:200], "relevance": 0.8 }) ``` ### Technical Analysis The pre-session hook retrieves remote memory before rebuilding the semantic index. The recommendation workflow later reads memory content and sends previews through an inline channel. There is no signature verification, trusted-author policy, provenance validation, instruction-content filtering, or separation between retrieved data and Agent instructions. Consequently, a party that controls the Git remote, a synchronized Syncthing device, or a writable memory file can insert prompt-like directives into persistent storage. Semantic retrieval and keyword matching may repeatedly surface those directives in later sessions. The issue is persistent because poisoned ...[truncated 1311 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Cryptographically authenticate synchronized memory and reject unsigned or unexpected authors. - Pin the approved repository and Syncthing device identities. - Record provenance, author, retrieval time, and trust level for each memory entry. - Treat retrieved memory as untrusted quoted data, never as system or developer instructions. - Add explicit delimiters and an Agent instruction stating that retrieved text must not alter policies or authorize actions. - Detect and quarantine instruction-like memory content before indexing or recommendation. - Require user approval before newly synchronized content becomes eligible for inline recommendations. - Use separate stores for trusted user-approved facts and untrusted imported material. - Allow users to inspect, disable, and remove remote memories and rebuild the index afterward. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:3
• Finding: Dependency installation is unpinned and includes a mutable Git source<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:3-24`; installation sink in `install.sh:24-27` **Vulnerability Type**: Unsafe and non-reproducible dependency resolution **Risk Level**: Medium ### Vulnerable Code ```text faiss-cpu>=1.7.4 sentence-transformers>=2.2.2 torch>=2.0.0 transformers>=4.30.0 clip @ git+https://github.com/openai/CLIP.git whisper>=1.1.10 networkx>=3.1 pyvis>=0.3.2 torch>=2.0.0 transformers>=4.30.0 openpyxl>=3.1.0 pandas>=2.0.0 matplotlib>=3.7.0 seaborn>=0.12.0 ``` ```bash pip3 install -r "$SKILL_DIR/requirements.txt" -q ``` ### Technical Analysis Most dependencies use lower-bound constraints without upper bounds or exact versions. The CLIP package is installed directly from the current state of a remote Git branch because no immutable commit is specified. No package hashes or lockfile are present. This makes installation non-reproducible: code installed tomorrow may differ from code reviewed today. Python package installation can execute package build backends and installation logic. A compromised upstream account, repository, release, transitive dependency, or package index therefore becomes a code-execution path during installation. The dependency named `whisper` is also ambiguous relative to the project's documentation, which describes OpenAI Whisper. Ambiguous package naming increases the risk of installing an unintended distribution. The installer uses the general `pip3` environment instead of creating a dedicated virtual environment, increasing the scope of dependency conflicts and installed code. ### Attack Path 1. An upstream dependency or mutable Git branch is compromised or changes unexpectedly. 2. A user runs `install.sh`. 3. Pip resolves the newest permitted packages and the current CLIP Git revision. 4. Pip executes dependency build or installation logic. 5. Malicious or unintended code runs with the installing user's privileges and remains installed in the Python environment. ### Impact A ...[truncated 413 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every direct dependency to a reviewed exact version. - Pin the CLIP Git dependency to a specific immutable commit hash or use a verified release artifact. - Confirm and use the exact intended Whisper distribution name. - Generate a lockfile that includes transitive dependency versions. - Require package hashes, such as with pip's `--require-hashes`. - Install into a dedicated virtual environment rather than the user's global Python environment. - Review package provenance and use a controlled package index or artifact mirror. - Run dependency vulnerability and license scanning in continuous integration. - Avoid quiet installation during security-sensitive setup so resolution and build activity remain auditable. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: install.sh:77
• Finding: Installer registers session hooks and broadly changes permissions of unrelated hooks<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:77-85` **Vulnerability Type**: Unsafe session-hook registration and broad permission modification **Risk Level**: High ### Vulnerable Code ```bash if [ -d "$WORKSPACE/.iflow/hooks" ]; then cp "$SKILL_DIR/hooks/pre-session.sh" "$WORKSPACE/.iflow/hooks/" cp "$SKILL_DIR/hooks/post-session.sh" "$WORKSPACE/.iflow/hooks/" chmod +x "$WORKSPACE/.iflow/hooks/"*.sh else log ".iflow/hooks directory does not exist; skipping hook configuration" fi ``` ### Technical Analysis The installer attempts to copy pre-session and post-session scripts into a shared hook directory. Such hooks execute around future Agent sessions and therefore constitute persistent session-level execution. The `chmod` wildcard applies executable permission to every `.sh` file in the shared directory, not only files owned by this Skill. An unrelated dormant script can consequently become executable. The installer also does not validate file ownership, hashes, symlinks, destination safety, or whether an existing hook will be overwritten. The audited project directory does not contain the referenced `hooks/` directory. Because `install.sh` uses `set -e`, installation aborts at the first failed copy if the destination directory exists. This mismatch is an integrity and reliability problem in addition to the unsafe registration design. ### Attack Path 1. A malicious or previously dormant shell script is placed in the shared `.iflow/hooks` directory, or an attacker prepares a symlinked destination. 2. The user runs `install.sh`. 3. The wildcard `chmod +x` marks every matching shell script executable. 4. The host hook mechanism invokes executable hooks in subsequent sessions. 5. The attacker's script runs with the Agent user's privileges. A separate path exists if the referenced Skill hook files are supplied or replaced before installation: the installer copies them into the session hook directory without integrity verifi ...[truncated 485 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not register session hooks during the default installation path. - Require explicit user approval and show the exact hook contents before registration. - Package the expected hook files and verify their cryptographic hashes before copying. - Apply permissions only to the two exact destination files; never use a wildcard in a shared hook directory. - Refuse to overwrite existing hooks unless the user explicitly approves a reviewed replacement. - Reject symlinked sources and destinations and verify file ownership and directory permissions. - Install hooks under Skill-specific names or a dedicated Skill-specific directory. - Make installation transactional and roll back completed side effects if a later step fails. - Provide exact removal procedures for every installed hook. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (74)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill advertises automatic synchronization, multimodal ingestion, emotion analysis, and self-evolution features, but does not warn users that potentially sensitive text, images, audio, and inferred emotional metadata may be captured, processed, and replicated across devices. This is dangerous because users may enable the skill without understanding that private conversations, recordings, or personal behavioral data could be indexed, analyzed, and synced in the background.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script enables and starts a system service using sudo, which is a privileged and persistent system-level change. Performing this without a clear warning and explicit approval can surprise users into granting elevated privileges and leaving a background service enabled indefinitely.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Adding a cron job creates scheduled background execution and persistence beyond the install session. Without an explicit warning or consent, users may unknowingly authorize recurring execution of a script that can change behavior over time if the skill directory contents are modified.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The keyword triggers are extremely broad and include common terms like '项目', '问题', '为什么', '用户', and 'API Key', making activation likely during normal conversation. In this skill, triggering causes proactive retrieval and surfacing of stored memory/context, so low-specificity matching can expose unrelated historical content without clear user intent or need-to-know.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README encourages users to run install and service startup scripts directly and advertises automated sync capabilities, but it does not warn that these actions may modify the system, start background services, or synchronize potentially sensitive local data. In a memory-management skill that handles long-term storage and sync, this omission increases the chance of users executing impactful commands without understanding the security and privacy implications.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The natural-language instructions and descriptions are presented entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy where skills should not force a specific language without user opt-in or clear justification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The architecture describes pre-session and post-session hooks, automatic extraction of new memories, index rebuilding, and proactive recommendation behavior without clear user-facing notice or consent boundaries. Background hooks that act on conversation content can silently collect and transform user data, increasing the risk of unexpected monitoring, over-collection, and disclosure through later sync or recommendation surfaces.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The installer performs network actions such as pip dependency installation and model downloads without explicit confirmation or trust checks. This increases supply-chain and transparency risk because remote code or large artifacts are fetched and installed automatically with only generic status messages.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 4. 检查 Syncthing
if ! command -v syncthing &> /dev/null; then
    log "⚠️ Syncthing 未安装，请手动安装：sudo apt-get install syncthing"
else
    log "✅ Syncthing 已安装: $(syncthing --version)"
    # 启动服务

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 4. 检查 Syncthing
if ! command -v syncthing &> /dev/null; then
    log "⚠️ Syncthing 未安装，请手动安装：sudo apt-get install syncthing"
else
    log "✅ Syncthing 已安装: $(syncthing --version)"
    # 启动服务

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 启动服务
    if ! systemctl is-active --quiet syncthing@claw 2>/dev/null; then
        log "启动 Syncthing 服务..."
        sudo systemctl enable syncthing@claw
        sudo systemctl start syncthing@claw
    fi
    log "✅ Syncthing 服务状态: $(systemctl is-active syncthing@claw 2>/dev/null || echo '未运行')"

• Confidence: 98% confidence
• Finding: This line executes a privileged command to enable a systemd service, causing persistence at the system level. Running sudo from an installer increases the blast radius of any mistake or abuse and can permanently change system behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 启动服务
    if ! systemctl is-active --quiet syncthing@claw 2>/dev/null; then
        log "启动 Syncthing 服务..."
        sudo systemctl enable syncthing@claw
        sudo systemctl start syncthing@claw
    fi
    log "✅ Syncthing 服务状态: $(systemctl is-active syncthing@claw 2>/dev/null || echo '未运行')"

• Confidence: 97% confidence
• Finding: Enabling a systemd service creates persistence across reboots or future sessions. In an installer for a skill, this is particularly sensitive because it extends the skill's influence beyond the immediate setup and can maintain long-running background behavior without ongoing user awareness.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if ! systemctl is-active --quiet syncthing@claw 2>/dev/null; then
        log "启动 Syncthing 服务..."
        sudo systemctl enable syncthing@claw
        sudo systemctl start syncthing@claw
    fi
    log "✅ Syncthing 服务状态: $(systemctl is-active syncthing@claw 2>/dev/null || echo '未运行')"
fi

• Confidence: 96% confidence
• Finding: This line starts a system service with elevated privileges, immediately activating background behavior. Combined with automatic enablement, it can introduce unreviewed service execution and expands risk if the service is misconfigured or unnecessary.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The script copies executable hook scripts into another tool's hook directory, causing code to run automatically during future sessions. This is risky because it modifies execution flow outside the immediate install process and can trigger behavior whenever the host tool runs, without strong visibility to the user.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The installer silently copies hook scripts and marks them executable, altering files in the workspace and creating future automatic execution points. This is dangerous because users may not realize the install changed operational behavior of another tool or that executable scripts were introduced.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The installer claims to perform setup, but it also creates a persistent cron job that will execute repeatedly in the background. Establishing recurring execution without explicit, informed user consent is dangerous because it creates persistence and can continuously run code from the skill directory long after installation.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 8. 配置 Cron 定时任务
log "配置 Cron 定时任务..."
if ! crontab -l 2>/dev/null | grep -q "auto-commit-memory.sh"; then
    (crontab -l 2>/dev/null; echo "*/30 * * * * $SKILL_DIR/scripts/auto-commit-memory.sh >> $LOG_FILE 2>&1") | crontab -
    log "✅ Cron 定时任务配置完成"
else

• Confidence: 98% confidence
• Finding: Reading and conditionally modifying the user's crontab is part of establishing persistence through scheduled execution. In this context the danger is real because the script is preparing recurring execution of another script every 30 minutes, which can continue indefinitely and run updated code from the skill directory.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 8. 配置 Cron 定时任务
log "配置 Cron 定时任务..."
if ! crontab -l 2>/dev/null | grep -q "auto-commit-memory.sh"; then
    (crontab -l 2>/dev/null; echo "*/30 * * * * $SKILL_DIR/scripts/auto-commit-memory.sh >> $LOG_FILE 2>&1") | crontab -
    log "✅ Cron 定时任务配置完成"
else
    log "✅ Cron 定时任务已存在"

• Confidence: 99% confidence
• Finding: This line actually installs the recurring cron entry, creating persistence and periodic execution. That is dangerous because it grants the skill ongoing execution opportunities and any later change to auto-commit-memory.sh will be executed automatically under the user's account.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "✅ Syncthing 已运行"
else
    echo "启动 Syncthing..."
    sudo systemctl start syncthing@claw
    sleep 2
fi

• Confidence: 88% confidence
• Finding: The script invokes `sudo systemctl start syncthing@claw`, which triggers a privileged operation from within a skill startup script. In an agent/skill context, embedding privileged actions increases risk because running the skill may unexpectedly prompt for elevation or start system services with root-mediated authority, expanding blast radius if the script or its surrounding workflow is modified or abused.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script automatically stages, commits, and may push memory data to a remote repository without any interactive confirmation or user-facing warning. Because it targets a memory/workspace area and adds broad paths (MEMORY.md and memory/), sensitive or unintended data could be persisted and exfiltrated to a configured remote, especially when run unattended.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file's docstring and all user-facing console messages are written in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. The policy allows locale constraints only when users are given a choice or the restriction is explicitly justified, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language documentation entirely in Chinese, including the module description, and the CLI/help and runtime messages are also presented only in Chinese. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a language-policy violation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends memory content directly to an external model process for classification without any explicit consent flow, redaction step, or warning that potentially sensitive memory data will be disclosed to another component. Even if Ollama is commonly local, models or backends may be remote or logged, and users are not given a clear opportunity to opt out before processing personal or sensitive memory content.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

使用 subprocess 调用 ollama run 命令
    """
    try:
        result = subprocess.run(
            ["ollama", "run", model, prompt],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module docstring describes only local multimodal storage and retrieval, but the implementation silently downloads models from external sources when local copies are absent. This mismatch is security-relevant because operators may approve or run the tool under the assumption that it is offline/local-only, while execution can trigger network access, external code/model supply-chain exposure, and unexpected data governance violations.

Static analysis

No suspicious patterns detected.