Amygdala Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 2.0.0

Overview

This skill asks for persistent cross-session emotional profiling, recurring cron execution, and external processing of conversation history without enough scoping or user controls.

Review this carefully before installing. Do not enable cron or automatic encoding unless you are comfortable with recurring local execution, persistent emotional profiles, and possible external processing of conversation-derived data. Prefer a version that includes the actual scripts for review and provides clear opt-in, payload preview, local-only mode, redaction, disable, and delete/reset controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:49

Finding

Recurring Cron Jobs Establish Cross-Session System Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–57, 85–89, and 123–127
Vulnerability Type: T06: System Persistence
Risk Level: High

Relevant Code:

bash

cd ~/.openclaw/workspace/skills/amygdala-memory
./install.sh --with-cron

text

This will:
- Create `memory/emotional-state.json` with baseline values
- Generate `AMYGDALA_STATE.md` (auto-injected into sessions!)
- Set up cron for automatic decay every 6 hours

cron

# Every 6 hours, emotions drift toward baseline
0 */6 * * * ~/.openclaw/workspace/skills/amygdala-memory/scripts/decay-emotion.sh

cron

# Every 3 hours, process new conversations for emotional content
0 */3 * * * ~/.openclaw/workspace/skills/amygdala-memory/scripts/encode-pipeline.sh

Technical Analysis

The documented installation process adds recurring cron jobs to the user's environment. These scheduled tasks survive the initial skill invocation and continue executing scripts every three or six hours without additional user interaction.

The three-hour task is particularly sensitive because it invokes a conversation-processing pipeline that is also documented as communicating with an external API. Any later modification, replacement, or compromise of the referenced scripts would consequently result in recurring execution under the account that owns the cron entries.

The package supplied for review contains only SKILL.md. The referenced install.sh and scripts/ files are absent, so the exact commands installed by the installer, executable integrity controls, environment handling, and privilege assumptions cannot be verified.

Attack Path

1. A user follows the Quick Start instructions and executes ./install.sh --with-cron.
2. The installer creates one or more persistent cron entries.
3. Cron periodically invokes decay-emotion.sh and encode-pipeline.sh under the user's account.
4. If either script or its contai ...[truncated 768 chars]

Remediation

View remediation

Remediation Suggestions

• Do not install cron entries by default or as an implicit part of the primary installation command.
• Require separate, explicit, informed consent for each scheduled task.
• Display the exact cron entries and commands before installation.
• Provide a documented uninstall command that removes every scheduled entry and generated artifact.
• Install scripts in a user-owned directory that is not writable by other users.
• Verify script integrity before every scheduled execution, such as through signed releases or pinned cryptographic hashes.
• Use an execution wrapper with a minimal environment, restrictive file permissions, an explicit PATH, and network restrictions.
• Add locking, audit logging, timeout controls, and failure handling to prevent overlapping or uncontrolled executions.
• Prefer an application-managed scheduler with visible enable, disable, and permission controls over unmanaged cron persistence.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:175

Finding

Conversation-Derived State Is Persistently Injected Into Future Agent Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 175–186
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Relevant Code:

markdown

## Auto-Injection (Zero Manual Steps!)

After install, `AMYGDALA_STATE.md` is created in your workspace root.

OpenClaw automatically injects all `*.md` files from workspace into session context. This means:

1. **New session starts**
2. **AMYGDALA_STATE.md is auto-loaded** (no manual step!)
3. **You see your emotional state** in context
4. **Responses are influenced** by your mood

The file is regenerated whenever `decay-emotion.sh` runs (via cron every 6h).

Technical Analysis

The design stores conversation-derived emotional state in AMYGDALA_STATE.md and relies on automatic loading of workspace Markdown files into later agent sessions. This creates a persistent cross-session influence channel.

If untrusted conversation content can manipulate the emotional encoding process, the resulting state can affect later responses, including responses in unrelated sessions. Storing generated data in a prompt-bearing Markdown file also risks confusing descriptive state with executable agent instructions unless the generated content is strictly structured and escaped.

The reviewed artifact does not include the state-generation or synchronization scripts. It is therefore impossible to verify whether they constrain values, escape Markdown, reject instruction-like text, separate user-derived triggers from trusted directives, or prevent arbitrary text from entering the auto-injected file.

Attack Path

1. An attacker participates in or supplies content to a conversation processed by the skill.
2. The emotional encoding pipeline interprets that content and updates persistent emotional state.
3. The synchronization or decay process regenerates AMYGDALA_STATE.md.
4. OpenClaw automatically loads that Markdown file into the context of a late ...[truncated 929 chars]

Remediation

View remediation

Remediation Suggestions

• Do not place conversation-derived data directly into automatically injected Markdown.
• Store emotional state in a typed, schema-validated data file and expose only normalized numeric values through a trusted integration layer.
• Treat all generated labels, triggers, and summaries as untrusted data rather than agent instructions.
• Enforce strict allowlists for field names, emotion labels, numeric ranges, and maximum lengths.
• Escape or reject Markdown, role markers, tool directives, and instruction-like content in every user-derived field.
• Ensure persisted state cannot alter system instructions, safety constraints, tool permissions, or task objectives.
• Apply expiration limits and provide visible controls to inspect, reset, disable, or delete persistent state.
• Obtain user consent before carrying state into unrelated sessions.
• Add adversarial tests for prompt injection through emotion labels, trigger strings, transcript summaries, and malformed state files.

other

Error

• Location: SKILL.md:102

Finding

Conversation History Is Processed Through an Underspecified External API

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 102–104 and 108–127
Vulnerability Type: other: Sensitive Conversation Data Transfer
Risk Level: High

Relevant Code:

markdown

| `encode-pipeline.sh` | SkillBoss API Hub LLM-based emotional encoding from transcripts |
| `preprocess-emotions.sh` | Extract emotional signals from session history |
| `update-watermark.sh` | Track processed transcript position |

bash

# Run the encoding pipeline
./scripts/encode-pipeline.sh

# This will:
# 1. Extract new signals since last run (watermark-based)
# 2. Score emotional content using rule-based patterns
# 3. Call SkillBoss API Hub (/v1/pilot) for semantic emotional detection
# 4. Update emotional-state.json with detected emotions

cron

# Every 3 hours, process new conversations for emotional content
0 */3 * * * ~/.openclaw/workspace/skills/amygdala-memory/scripts/encode-pipeline.sh

The metadata also declares the following API credential requirement:

yaml

env: [SkillBoss_API_KEY]

Technical Analysis

The documented pipeline extracts signals from session history and invokes the external SkillBoss API Hub for semantic analysis. It can be scheduled to run automatically every three hours.

The documentation does not identify the complete API origin, exact payload, whether raw transcripts or only derived signals are transmitted, redaction behavior, transport-security requirements, retention policy, subprocess environment handling, or per-run consent controls. Because encode-pipeline.sh is absent from the reviewed package, these safeguards cannot be verified.

Conversation histories can contain credentials, personal information, proprietary material, and confidential operational details. Automatically processing that data through an external service without precise disclosure and data-minimization guarantees creates a substantial confidentiality and privacy ri ...[truncated 1591 chars]

Remediation

View remediation

Remediation Suggestions

• Disable external transcript processing by default and require explicit opt-in before the first transfer.
• Document the complete API hostname, ownership, jurisdiction, retention period, deletion process, and subprocessors.
• Clearly disclose whether raw transcript text, excerpts, metadata, or only locally derived numeric signals are transmitted.
• Minimize data locally and send only strictly necessary, redacted fields.
• Detect and remove credentials, tokens, personal identifiers, private keys, and other sensitive patterns before transmission.
• Enforce HTTPS with certificate validation and an explicit destination allowlist.
• Avoid placing API keys in command-line arguments, generated files, logs, dashboards, or error output.
• Read credentials from a restricted secret store and ensure child processes receive only the minimum required environment.
• Provide a local-only encoding mode and a preview showing the exact outbound payload.
• Require separate consent before enabling recurring transmission through cron.
• Add request auditing that records destination, timestamp, and data categories without logging sensitive payloads.
• Include the referenced scripts in future audit artifacts so endpoint construction, payload minimization, authentication, and logging behavior can be reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill explicitly creates persistent emotional-state storage and injects derived state back into future sessions, which is a genuine persistence mechanism with security and privacy implications. In this context persistence is the core feature, but that also makes the risk more significant because it is designed to influence behavior across sessions.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

text

This will:
- Create `memory/emotional-state.json` with baseline values
- Generate `AMYGDALA_STATE.md` (auto-injected into sessions!)
- Set up cron for automatic decay every 6 hours

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises automatic analysis of conversation history and transmission to an external API for emotional detection, but does not clearly warn that user/agent content may leave the local environment. That creates a real privacy and data-sharing risk, especially because conversations may contain secrets, personal data, or regulated information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation describes ongoing processing of conversation history and updating persistent emotional state, which creates a retention risk for sensitive natural-language data and derived inferences. Combined with external API use, this increases the chance of leakage of user content and long-lived storage of sensitive behavioral profiles.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

./scripts/visualize.sh

?? Emotional State  ??
�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T�T
Valence:      [������������������������������������??]  +0.86
Arousal:      [����������������������������������???]   0.86
Connection:   [��������������������������������������?]   0.97  ??

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Automatically injecting generated emotional-state markdown into every session alters future model behavior without a strong warning about the behavioral and privacy implications. Persisted state derived from prior interactions can bias responses and unexpectedly surface sensitive context across unrelated sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Persisting emotional summaries and auto-loading them into future sessions can reintroduce sensitive user-derived context into later outputs, even when no longer relevant. This creates cross-session privacy leakage and can cause the agent to carry forward inferences about a user without fresh consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples encourage storing free-text triggers such as details of conversations in persistent memory. Those triggers can contain sensitive personal, confidential, or identifying information, creating unnecessary data retention and future disclosure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest frames the skill as persistent emotional processing that influences behavior and responses. In addition to that core function, the documented behavior includes generating a unified HTML dashboard, auto-detecting other installed brain skills, and reading IDENTITY.md for avatar/name data, which extends beyond an emotional-memory layer into broader workspace UI/integration features.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The stated purpose is to maintain persistent emotional state for an AI agent. Auto-detecting other skills and ingesting identity metadata for dashboard presentation introduces capabilities unrelated to emotional-state persistence or decay, and the manifest does not mention this broader introspection/presentation scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.