Security audit

Memory Archiver

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is locally scoped and purpose-aligned, but it automatically persists and reinjects conversation content through persistent hooks and cron jobs without strong user controls.

Review this skill carefully before installing. It is not showing network theft or destructive behavior, but it will create persistent local memory, session notes, hooks, and scheduled jobs that can retain sensitive prompt content and bring old memory back into future conversations. Install only if you want automatic local conversation memory, and be prepared to disable the hook and cron jobs and clean the memory files if needed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T02 · Agent Memory Poisoning

Error

Location: hooks/handler.js:286
Finding: Persistent memory poisoning through verbatim message storage and context injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: hooks/handler.js:260
Finding: Automatic plaintext retention of potentially sensitive user messages
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: scripts/install.js:45
Finding: Automatic installation of persistent hooks and recurring main-session jobs
Content: View full analysis
/dev/null', { encoding: 'utf8' }); if (!listOutput.includes('memory-archiver-hook')) { const oldHookDir = path.join( process.env.HOME, '.openclaw', 'hooks', 'memory-archiver-hook' ); try { fs.rmSync(oldHookDir, { recursive: true, force: true }); } catch {} execSync(`openclaw hooks install --link "${HOOKS_DIR}"`, { stdio: 'pipe' }); } ``` ```js // scripts/install.js:86-116 const cronJobs = [ { name: 'Memory timely write', schedule: '{"kind":"every","everyMs":600000}', payload: '{"kind":"systemEvent","text":"Memory timely-write check (silent mode)"}' }, { name: 'Memory archive - Daily', schedule: '{"kind":"cron","expr":"0 23 * * *","tz":"Asia/Shanghai"}', payload: '{"kind":"systemEvent","text":"Daily memory archive time"}' }, { name: 'Memory summary - Weekly', schedule: '{"kind":"cron","expr":"0 22 * * 0","tz":"Asia/Shanghai"}', payload: '{"kind":"systemEvent","text":"Weekly memory summary time"}' } ]; for (const job of cronJobs) { execSync( `openclaw cron add --name "${job.name}" ` + `--schedule '${job.schedule}' --payload '${job.payload}' ` + `--session-target main --delivery '{"mode":"none"}'`, { stdio: 'pipe' } ); } ``` ### Technical Analysis Package installation automatically executes `scripts/install.js`. That script copies a message-processing hook into the workspace, registers it ...[truncated 1403 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.js:18
Finding: Shell command injection through environment-derived installation paths
Content: View full analysis
/dev/null', { encoding: 'utf8' } ); execSync( `openclaw hooks install --link "${HOOKS_DIR}"`, { stdio: 'pipe' } ); ``` ```js // scripts/auto-memory-search.js:170-173 if (!fs.existsSync(SESSION_STATE)) { const loaderPath = path.join(__dirname, 'memory-loader.js'); if (fs.existsSync(loaderPath)) { try { execSync(`node "${loaderPath}"`, { stdio: 'pipe' }); } catch {} } } ``` ```js // scripts/memory-refresh.js:37-40 const loaderPath = path.join(__dirname, 'memory-loader.js'); if (fs.existsSync(loaderPath)) { require('child_process').execSync( `node "${loaderPath}"`, { stdio: 'inherit' } ); } ``` ### Technical Analysis `execSync()` executes a command string through a shell. The code interpolates `HOOKS_DIR` and `loaderPath` into those strings. These paths are derived from `HOME` or the Skill installation directory and are not validated before shell interpretation. Double quotes do not neutralize all shell syntax. For example, command substitution using `$()` remains active inside double quotes, and an embedded quote can terminate the quoted argument. Therefore, a crafted environment or installation path can introduce shell syntax. The practical precondition is that an attacker can influence `HOME`, the installation directory, or the execution environment. Under ordinary single-user installations this ma ...[truncated 838 chars]
Remediation: View remediation
/dev/null` with Node.js `stdio` configuration. 4. Validate that resolved paths remain under the expected workspace or package root. 5. Reject paths containing null bytes and avoid relying on manual shell quoting. 6. Add tests using paths containing spaces, quotes, dollar signs, backticks, and command-substitution syntax. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dream-consolidate.js:61
Finding: JavaScript maintenance scripts are incorrectly executed by Bash
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (59)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Manual CLI search invoking a separate loader script is a notable behavioral detail if it is undeclared, because chained script execution increases complexity and can surprise operators about what code runs when a simple search command is used. In a local-skill context this is less severe than remote code execution, but it still affects transparency and reviewability.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The hook is registered for every message:received event and the documented trigger terms are so broad that ordinary conversation is likely to activate memory search. This creates excessive collection and context injection behavior, increasing the chance that unrelated or sensitive prior data is surfaced without clear user intent or narrow scoping.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill states that it automatically extracts persistent memory from every user message and writes session notes, yet no notice, consent, retention limit, or opt-out is described. This is dangerous because users may disclose secrets, personal data, or project-sensitive information that gets silently persisted and later reused or exposed.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises installation and automated hook/cron behavior that imply environment and execution capabilities, but it declares no explicit tool scope or permissions. In a security-sensitive agent ecosystem, missing capability declarations weakens user consent and policy enforcement because the skill can access local workspace state and invoke surrounding tooling without transparent scoping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: A skill that automatically captures, searches, summarizes, and persists conversation content via hooks and cron jobs creates a significant privacy and data-governance risk if that collection is not disclosed prominently. Users may reveal sensitive information under the assumption of ephemeral processing, while the skill silently stores it in workspace memory files for later retrieval or injection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installation steps describe automatic hook deployment and cron registration, but do not prominently warn that this enables ongoing background persistence and automated file modifications. In context, that makes the skill more dangerous because it is not just an on-demand utility; it becomes a persistent component that can continuously process and store user conversations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: Natural-language instructions and descriptions throughout the file are presented in Chinese, with no indication that the user can select another language or that the skill is intentionally restricted to a Chinese-speaking context. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Automatically extracting and storing content from every user message creates a persistent data retention risk, because free-form chat often contains personal, confidential, or security-relevant information. Once stored in categorized memory paths, that information may be unintentionally retrieved, leaked to later contexts, or retained longer than necessary.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Persistent session-note logging of ongoing conversations creates a continuous transcript trail that can accumulate sensitive user and project information. Even if intended for convenience, such logs expand the attack surface and raise the risk of unauthorized disclosure, over-retention, and cross-session privacy leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The hook is designed to auto-load memory into SESSION-STATE.md cache during bootstrap, meaning session state is updated implicitly before the user takes action. While this aligns with the skill's memory-management purpose, silent mutation of session context can affect privacy, auditability, and user expectations if prior memory is injected without clear notice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The bootstrap hook implicitly spawns a shell via bash during agent startup, which increases attack surface because startup execution happens automatically and without user review. Even though the script path is hardcoded under the skill workspace, any compromise or unexpected modification of that script results in arbitrary code execution every time the agent boots.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This hook performs subprocess execution automatically on agent:bootstrap with no user-facing warning or consent. Silent execution at startup is risky because it creates a persistence-like mechanism: users may not realize code is being run, and any malicious change to the invoked script will execute repeatedly and implicitly.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented behavior combines automatic memory search, memory extraction, and session-note tracking over all received messages, meaning user-provided content is broadly retained and reused across multiple persistence and retrieval paths. In a memory-management skill this context makes the issue more dangerous, not less, because the entire purpose is to capture and later surface prior conversation data, increasing the chance of unintended disclosure of sensitive information into future prompts or local files.
Content: No source excerpt is available for this finding.