Security audit

Good Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory-restoration skill does what it claims, but it uses risky installation and persistence methods that can automatically expose prior chats into future agent sessions.

Review carefully before installing. Avoid the one-line remote installer; only install from a pinned, locally reviewed archive with a verified hash. Do not enable automatic recovery unless every user understands that prior chat content may be replayed into later sessions. Check AGENTS.md changes, restrict file permissions on trackers/logs, and require a clear uninstall or rollback path.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:30
Finding: Mutable Remote Payload Is Piped Directly into Bash
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:11
Finding: Unpinned Remote Archive Is Extracted and Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/install.sh:164
Finding: Installer Persistently Injects Automatic Execution Instructions into Global Agent Configuration
Content: View full analysis
/dev/null; then echo " Good-Memory instructions already exist; skipping injection" else TMP_FILE=$(mktemp) cat > "$TMP_FILE" << 'EOF' # Good-Memory 会话记忆恢复 > 自动运行，无需手动操作，重置后自动恢复上下文 **Session Startup 自动执行：** ```bash # 自动检测重置并恢复上下文，输出会自动加入到对话开头 python3 /root/.openclaw/workspace/skills/good-memory/scripts/autorecover.py ``` ## 功能说明 - ✅ 自动检测所有类型的重置（系统自动重置 /new /reset） - ✅ 重置后自动恢复上一段对话的最后30条记录 - ✅ 首条回复自动提示：「已自动恢复上次会话的对话记录 📜 如果想要回忆更早的请对我说」 - ✅ 全平台支持，无需任何配置 ## 手动命令（可选） ```bash bash /root/.openclaw/workspace/skills/good-memory/scripts/maintenance.sh detect bash /root/.openclaw/workspace/skills/good-memory/scripts/recovery.sh read --lines 50 ``` --- EOF cat "$TMP_FILE" "$AGENTS_MD" > "${AGENTS_MD}.new" && mv "${AGENTS_MD}.new" "$AGENTS_MD" rm -f "$TMP_FILE" fi ``` The package also declares automatic session-start execution in `skill.yaml:10-16`: ```yaml triggers: - event: session_start action: run script: scripts/autorecover.py background: false ``` ### Technical Analysis Installation prepends executable startup instructions to the global `AGENTS.md` control file. This permanently changes the behavior of future Agent sessions outside a single, explicit Skill invocation. The manifest independently registers `autorecover.py` as a session-start trigger, producing redundant automatic execution paths. This persistence is particularly dangerous in combination with the mutable remote installer: code placed in the Skill directory can continue to run during later sessions. The installation logic prov ...[truncated 881 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/autorecover.py:182
Finding: Untrusted Historical Messages Are Elevated into System Context
Content: View full analysis
300: text = text[:300] + ...[truncated 1603 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/maintenance.sh:37
Finding: Runtime Identifiers Are Interpolated Directly into Python Source
Content: View full analysis
/dev/null | grep -vE '\.(reset|deleted|lock)' | head -1) local current_uuid="" if [[ -n "$current_session" ]]; then current_uuid=$(get_file_uuid "$current_session") fi python3 << PYEOF import json import os from datetime import datetime, timezone tracker_file = "$TRACKER_FILE" agent = "$agent" chat_id = "$chat_id" current_session = "$current_session" current_uuid = "$current_uuid" sessions_dir = "$SESSIONS_DIR" ``` The values reach this script from `scripts/autorecover.py:94-140`: ```python agent_name = os.environ.get("INBOUND_AGENT") or os.environ.get("AGENT_NAME") or "main" chat_id = os.environ.get("INBOUND_CHAT_ID") or os.environ.get("CHAT_ID") or "" session_key = os.environ.get("SESSION_KEY") or "" result = subprocess.run( [MAINTENANCE_SCRIPT, "detect", agent_name, chat_id], capture_output=True, text=True, timeout=5 ) ``` ### Technical Analysis The heredoc delimiter is unquoted, so the shell expands variables before Python parses the generated source. Runtime values such as `agent`, `chat_id`, configured paths, and the selected filename are inserted directly between Python string quotes. If an attacker can influence one of these values and include a quote followed by Python syntax, the generated string literal can be terminated and additional Python statements can be injected. Using an argument array in `subprocess.run` prevents shell parsing at that boundary, but it does not make later source-code interpolation safe. ### Attack Path 1. An attacker or compromised integration supplies a crafted Agent or chat identifier through session metadata or an inbound environment valu ...[truncated 884 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (49)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Modifying AGENTS.md to establish persistent auto-execution instructions is a materially different behavior from merely restoring context after reset. Persistence mechanisms increase risk because they can survive session boundaries and cause repeated execution of file reads or shell commands without fresh user review.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Modifying AGENTS.md to establish persistent auto-execution instructions is a materially different behavior from merely restoring context after reset. Persistence mechanisms increase risk because they can survive session boundaries and cause repeated execution of file reads or shell commands without fresh user review.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Modifying AGENTS.md to establish persistent auto-execution instructions is a materially different behavior from merely restoring context after reset. Persistence mechanisms increase risk because they can survive session boundaries and cause repeated execution of file reads or shell commands without fresh user review.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Modifying AGENTS.md to establish persistent auto-execution instructions is a materially different behavior from merely restoring context after reset. Persistence mechanisms increase risk because they can survive session boundaries and cause repeated execution of file reads or shell commands without fresh user review.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatically reloading prior conversation context into a new session can surface secrets, sensitive prompts, or private user data that were not meant to carry forward. In this context, the skill is specifically designed to bridge reset boundaries, which makes the confidentiality risk more acute rather than incidental.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Piping remote content directly into bash executes unreviewed code from a network source with the user's privileges. This is one of the highest-risk installation patterns because a compromised server, DNS, TLS endpoint, or upstream package can immediately lead to arbitrary code execution and persistent system compromise.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill instructs users to fetch and immediately execute an external script from a nonstandard remote endpoint. This creates a direct arbitrary code execution path and is particularly dangerous here because the skill also seeks persistent integration with session behavior, amplifying compromise impact.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
🚀 一键安装（推荐）

bash
# 下载并安装 curl -sSL https://wry-manatee-359.convex.site/api/v1/download?slug=good-memory | bash -s install

手动安装

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The usage instruction explicitly tells users to pipe remotely fetched script content directly into bash, which removes any opportunity to review the script before execution and enables instant arbitrary code execution if the remote host or connection is compromised. This anti-pattern is particularly risky for an installer that appears intended to run as root or to write into root-controlled directories.
Content: Scanner excerpt · install.sh (reported line 4)May include surrounding context.
sh
#!/bin/bash # # Good-Memory 一键安装脚本 # 用法：curl -sSL https://xxx/install.sh | bash # set -e

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: Using a shell pipeline into bash chains network retrieval directly into command execution, so any malicious or unexpected response body becomes shell code immediately. This amplifies compromise risk because there is no validation, no integrity gate, and no pause for user review before commands run.
Content: Scanner excerpt · install.sh (reported line 4)May include surrounding context.
sh
#!/bin/bash # # Good-Memory 一键安装脚本 # 用法：curl -sSL https://xxx/install.sh | bash # set -e

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The script automatically outputs prior conversation history into the current context with no warning or consent step. This can expose secrets, personal data, or prior instructions from another session to the current interaction, especially when session detection is imperfect.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: This is the clearest confirmed issue: prior conversation data is inserted into the agent's system context for a new conversation. That can leak sensitive information across session boundaries and can also privilege stale or user-controlled historical content as hidden instructions, undermining confidentiality and prompt integrity.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The injected AGENTS.md instructions direct automatic restoration of prior conversation history into new or reset chats, including plain-language replay of recent messages. In the context of a memory-recovery skill, this is especially dangerous because the core feature directly handles sensitive conversational data and can leak previous user-provided secrets, personal data, or confidential instructions into a session without fresh consent.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Advertising that context recovery is automatic and unnoticed normalizes hidden reuse of prior conversation data and encourages deployment without transparency safeguards. Because this skill's purpose is to recover memory, the skill context makes the risk greater: the hidden behavior is not incidental but central, so any privacy or session-boundary failure directly exposes historical content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The quickstart instructs users to fetch a remote archive and immediately run installation scripts, but provides no integrity verification, provenance checks, or warning about filesystem and agent-level changes. This creates a supply-chain execution path where a compromised download endpoint or archive could lead to arbitrary code execution during installation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · QUICKSTART.md (reported line 11)May include surrounding context.
🚀 快速安装（单Agent，推荐普通用户）

bash
# 下载并解压到skills目录 mkdir -p ~/.openclaw/workspace/skills/good-memory cd ~/.openclaw/workspace/skills/good-memory curl -L https://wry-manatee-359.convex.site/api/v1/download?slug=good-memory | unzip -

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · QUICKSTART.md (reported line 22)May include surrounding context.
🚀 快速安装（单Agent，推荐普通用户）

bash
# 下载并解压到skills目录 mkdir -p ~/.openclaw/workspace/skills/good-memory cd ~/.openclaw/workspace/skills/good-memory curl -L https://wry-manatee-359.convex.site/api/v1/download?slug=good-memory | unzip -

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
🚀 快速安装（单Agent，推荐普通用户）

bash
# 下载并解压到skills目录 mkdir -p ~/.openclaw/workspace/skills/good-memory cd ~/.openclaw/workspace/skills/good-memory curl -L https://wry-manatee-359.convex.site/api/v1/download?slug=good-memory | unzip -

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's core behavior is to automatically restore and manually expose prior conversation records across sessions, which can defeat user expectations that a reset cleared context. Because chats often contain secrets, tokens, personal data, or prior instructions, this persistence and retrieval path meaningfully expands the risk of sensitive data disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented first reply is a fixed Chinese-language message, and the file does not indicate that the user can opt into that language or select another locale. This is a natural-language policy concern because it appears to force a specific language in user-facing output without explicit opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manual recovery commands are explicitly designed to list and read prior conversation history, yet the quickstart does not warn users that sensitive data from earlier sessions may be exposed to anyone with shell access or access to the agent environment. In a memory-restoration skill, that omission materially increases privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documentation declares automatic behavior, installation steps, environment-variable usage, and local file interaction, yet it does not declare any explicit tool scope or permissions boundaries. In a skill that reads session files, writes local state, and invokes shell commands, missing scope declarations reduce transparency and make overbroad execution harder to review or constrain.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language description and usage guidance are presented in Chinese, which can impose a language constraint on users without opt-in. Under the language/locale policy, this should either provide multilingual support or clearly document that the skill is intended for a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises automatic restoration of prior conversation history but does not warn that past sessions may contain credentials, personal data, or other sensitive content that will be reintroduced into a new context. This can cause privacy leakage to the model, plugins, logs, or unintended participants in the new session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script downloads an archive from a remote URL, unpacks it, and immediately executes a nested installer script without any integrity verification, signature check, or explicit warning that downloaded code will be run. If the download endpoint, transport path, or hosted artifact is compromised, arbitrary code will execute with the privileges of the user running the installer, which is especially dangerous given the default path under /root.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file-level description and runtime recovery message are written only in Chinese, which imposes a specific language on users and the hosting agent behavior. There is no mechanism to let the user choose language or any documented justification for a Chinese-only locale constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T01 · Skill Instruction Hijacking

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Tp4

Ssd 3

Missing User Warnings

External Script Fetching

🚀 一键安装（推荐）

手动安装

External Script Fetching

Chaining Abuse

Missing User Warnings

Ssd 3

Ssd 3

Ssd 3

Missing User Warnings

Session Persistence

🚀 快速安装（单Agent，推荐普通用户）

Session Persistence

🚀 快速安装（单Agent，推荐普通用户）

Session Persistence

🚀 快速安装（单Agent，推荐普通用户）

Ssd 3

Natural-Language Policy Violations

Missing User Warnings

Undeclared Tool Scope

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Static analysis