Security audit

OpenClaw Memory Migrator

Security checks for vulnerabilities and agentic risk

Overview

This is a local OpenClaw memory migration tool with disclosed safeguards; it handles sensitive memory data but I found no hidden network, destructive, or persistent behavior.

Install only if you are intentionally migrating OpenClaw memory and can protect the run directory as sensitive. Use copied exports and dry-runs first, keep outputs outside indexed memory paths, verify backups before any production action, and remember that redaction covers secret-like metadata keys, not necessarily secrets embedded in memory text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description describes a full migration skill for moving OpenClaw memory between storage backends and formats, with operational tasks like auditing, deduplicating, benchmarking, cutover, and rollback. The supplied code does not implement those workflows. Instead, it defines helper functions for canonicalizing text, hashing content, normalizing timestamps, stripping sensitive/vector fields, creating standardized memory records, and validating them. These utilities could support a migration pipeline, but on their own they do not perform migration or backend management. Therefore the description materially overstates and misrepresents the code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a migration skill for OpenClaw memory backends and related operational tasks. The supplied code does not implement migration or memory processing at all; it is a safety/helper module focused on validating file paths and output locations. While such checks could support a migration tool, this chunk’s actual purpose is materially narrower and different from the declared end-user capability. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code writes files atomically and can replace an existing output when overwrite is enabled via rename, but the file contains no confirmation prompt, visible log/print disclosure, or inline warning describing that user filesystem contents will be created or overwritten. Because this is a safety-relevant filesystem operation in a general operations module, some explicit user disclosure is missing within the code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: writeMemoryCore creates a temporary directory, writes multiple markdown files, and renames the directory into place, which materially changes user data on disk. Although the code avoids overwriting existing output and protects MEMORY.md, it does not include any user-facing warning, confirmation, or explicit inline disclosure about these filesystem changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This README is entirely written in Simplified Chinese and does not state within the file that the user may choose their preferred language. Although L12 links to an English version, the file itself presents a locale-specific experience by default, which can be interpreted as a language policy constraint without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该文档整体仅以简体中文呈现，文件名也限定为 zh-CN，本身体现了特定语言/locale 约束。按规则，若未明确提供用户语言选择、opt-in，或说明这是合理的地区性限制，可视为自然语言层面的语言/locale 政策风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The similarity routine lowercases text with toLocaleLowerCase("en-US"), which hard-codes a specific locale for text processing. This is a natural-language policy concern because it imposes a language/locale choice without offering user choice or documenting why U.S. English is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: localeCompare(..., "en") forces English collation rules for reporting counts, which is a language/locale constraint embedded in code. The file does not indicate that English-only ordering is required or give users a choice of locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.