Security audit

MemCore 记忆核心

Security checks for vulnerabilities and agentic risk

Overview

MemCore is a coherent local memory tool, but it can automatically turn past conversation logs into future startup context without enough review or control.

Install only if you are comfortable with this skill building a persistent local memory layer from OpenClaw logs and session state. Review MEMORY_BRIEF.md before making it startup context, avoid indexing secrets, and consider disabling or manually controlling first-run indexing, scheduled maintenance, and query logging until provenance, redaction, and deletion controls exist.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: scripts/memcore/bootstrap_context.py:83
Finding: Conversation-Derived Content Can Persist as Startup Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/memcore/trace.py:282
Finding: Sensitive Memory Content Is Duplicated into Plaintext SQLite Files Without Explicit Permission Hardening
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The repeated documentation/behavior mismatch is a real trust-boundary problem, especially because the skill is positioned as a memory-management and diagnostic component. In this context, overstated fallback, maintenance, and scoring features can cause the agent or human operator to skip manual checks, creating integrity and decision-quality risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The repeated documentation/behavior mismatch is a real trust-boundary problem, especially because the skill is positioned as a memory-management and diagnostic component. In this context, overstated fallback, maintenance, and scoring features can cause the agent or human operator to skip manual checks, creating integrity and decision-quality risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The repeated documentation/behavior mismatch is a real trust-boundary problem, especially because the skill is positioned as a memory-management and diagnostic component. In this context, overstated fallback, maintenance, and scoring features can cause the agent or human operator to skip manual checks, creating integrity and decision-quality risks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents shell execution and file read/write behavior but does not declare any tool scope such as permissions or allowed-tools. In an agent environment, missing capability boundaries can cause the skill to run with broader privileges than intended, increasing the blast radius of prompt mistakes or malicious task inputs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation guidance is broad and lacks clear exclusion conditions, so an agent may over-trigger the skill in situations involving sensitive files, uncertain context, or tasks that do not require memory maintenance. Overbroad activation criteria increase the chance of unnecessary shell execution, unintended file access, and inappropriate reliance on the skill's outputs.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill says health checks are report-only and never auto-fix, but elsewhere documents maintenance flows that perform state-changing feedback and decay operations. This inconsistency can mislead operators into believing a diagnostic invocation is side-effect free when it may mutate memory state, which is risky for auditability and safe operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire architecture document is written in Chinese, including headings, operational descriptions, and CLI explanations, with no indication that language choice is optional or tied to a region-specific requirement. This creates a natural-language policy concern because the skill documentation effectively mandates a specific language for users without offering a locale choice or documenting a justified constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation describes automatic memory writing, indexing, and pattern induction during normal workflow without a prominent warning that persistent state will be modified automatically. In a memory-management skill, silent background writes are security-relevant because they can alter logs, derived memory, and future agent behavior without informed operator consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The automatic maintenance section states that scheduled jobs will index logs, infer patterns, decay memories, and refresh briefs, but does not clearly warn that these background jobs process historical data and mutate stored state without user interaction. This increases the risk of unnoticed data processing, privacy issues, and hard-to-trace changes to the agent's long-term memory behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation contains a materially inconsistent safety claim: it says the original MEMORY.md is never modified, while earlier instructions state lessons are written into MEMORY.md during the shutdown flow. This can mislead operators about data integrity and backup assumptions, causing them to permit the skill to run under false expectations about what files it changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Comments and console output throughout the script are written only in Chinese, which effectively forces a specific language for users interacting with the installer. The file does not provide an opt-in language choice or explain that the skill is intended only for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module usage text claims update-memory will '更新 MEMORY.md（自动提取教训）', which implies modifying the MEMORY.md file. But the implemented cmd_update_memory function only computes traces/patterns and prints 'MEMORY.md 更新建议' to stdout without writing any file. This is a clear manifest/documentation-to-behavior mismatch in a user-facing command description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The brief command writes directly to a fixed file under the user's workspace without checking for an existing file, prompting for confirmation, or using an atomic safe-write flow. In a memory-management skill context, this can silently overwrite locally curated briefing content or automation outputs, causing integrity loss and potentially poisoning subsequent agent context if the overwritten file is trusted as startup input.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstrings and all generated natural-language skill/template text are written in Chinese, and the code does not provide any user opt-in or locale-selection mechanism. This can violate the language/locale policy for skills that should not force a specific language by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code automatically turns pattern data from local databases into SKILL.md content and update patches without any explicit disclosure, review gate, or provenance marking beyond a small auto-generated note in the template. Because fields such as name, description, tags, and solution_template are copied directly from workspace-derived data, an attacker or untrusted upstream source could poison memory/pattern records and cause misleading or unsafe instructions to be surfaced as trusted skill recommendations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and many user-readable comments/docstrings are written entirely in Chinese, which imposes a specific language on operators or maintainers without any opt-in or stated regional justification. Under the language/locale policy, forcing a specific language is a policy concern unless the skill offers a choice or clearly documents why the locale is required.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring describes tracking references, normalizing feedback signals, and value backpropagation, but the implementation goes further by directly modifying long-lived memory state in external trace databases. In particular, it updates feedback_count, feedback_score, and value_score in trace_index.db, and periodically decays older traces, which is a stronger memory-maintenance behavior than a simple feedback-loop tracker.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module automatically creates and writes to persistent databases under the user's home directory as part of normal operation, with no visible notice or control. In the context of an agent memory system, silent persistence increases privacy risk and can accumulate sensitive behavioral history that users may not expect to be retained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code persists user-derived queries and free-form feedback notes into a local SQLite database without minimization, redaction, retention limits, or user consent. In a memory skill, those fields can easily contain secrets, personal data, internal prompts, or incident details, so compromise of the local profile or unintended reuse can leak sensitive information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings in the module docstring force a specific language context for the skill description. Under the stated policy, language-specific behavior should either offer user choice or clearly justify the locale constraint.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The retriever is designed to return raw memory content and also logs the user's query, creating a straightforward path for sensitive information disclosure during normal operation. In this skill context, the workspace files and trace databases likely contain historical observations, reflections, and agent state, so overbroad retrieval plus telemetry meaningfully increases leakage risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The retriever logs search queries to feedback storage without any user-facing disclosure in this code path. Because memory-retrieval queries often encode sensitive intent, project names, incidents, or credentials pasted by users, silent persistence increases exposure and can violate privacy expectations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: When a query has no usable terms, the code falls back to returning highest-value traces rather than no results, which can expose unrelated stored observations and actions to the requester. In a memory system, this is especially dangerous because traces may include private operational history that the user did not ask for and may not be authorized to see.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a memory retrieval system with adaptive fallback, but spawning an OS command introduces an execution capability beyond ordinary file/database lookup. Since the same fallback could be implemented with native file parsing, the subprocess dependency is not an obvious requirement of the skill's purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.