Awublack Personal Memory System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:03 AM UTC
• Version: 1.2.0

Overview

This personal memory skill is useful in concept, but it gives a persistent Git sync process access to private notes while also claiming the data stays local.

Review this carefully before installing. Do not run the Git sync daemon unless you have inspected its script, verified the remote repository is yours and private, and are comfortable having memory notes committed to durable Git history. Avoid storing secrets or sensitive personal data in files that may be synchronized.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: README.md:11

Finding

Misleading Local-Only Claims and Unreviewed Remote Git Synchronization

Content

View full analysis

Vulnerability Details

File Location: README.md:11-22, README.md:47-50, and SKILL.md:24-32,55-64
Vulnerability Type: Unreviewed external dependency and misleading privacy disclosure
Risk Level: High

The skill instructs users to execute a persistent git_sync_on_save.sh daemon that is not included in the audited package. The documented daemon repeatedly commits and pushes the contents of the Obsidian vault to a remote Git repository, while the skill is presented as a local-only system whose information remains on the user's machine.

Vulnerable Documentation

markdown

2. Ensure you have the following files and directories in your workspace root (`/home/awu/.openclaw/workspace-work/`):
   - `MEMORY.md`
   - `obsidian-vault/`
   - `git_sync_on_save.sh`
   - `git_sync.log`
   - `auto_sync_memory.py`
   - `query_memory.py`
3. **Start the Git sync daemon** (if not already running):
   ```bash
   cd /home/awu/.openclaw/workspace-work/
   nohup ./git_sync_on_save.sh > git_sync.log 2>&1 &
   ```

The same README makes the following privacy claim:

markdown

- Your knowledge is yours, and stays on your machine.
- **Your memory is protected by 3 independent backups: local workspace, Obsidian vault, and remote Git repo.**

SKILL.md additionally identifies the remote destination as:

text

https://github.com/awublack/obsidian-vault

Technical Analysis

The synchronization script is a required operational dependency, but it is absent from the package. Consequently, its implementation, command construction, credential handling, file-selection rules, remote configuration, and update behavior cannot be reviewed.

The documented behavior checks for changes every ten seconds and pushes Obsidian content to a remote Git repository. This is materially inconsistent with claims that the system is completely local, does not upload or share data, and does not access cloud ...[truncated 2092 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle git_sync_on_save.sh with the skill so its complete behavior can be audited.
2. Require explicit, informed opt-in before enabling any remote synchronization.
3. Remove claims that all data stays local when remote Git synchronization is enabled.
4. Make the Git remote user-configurable rather than documenting an account-specific destination.
5. Validate and display the effective remote URL before the first push.
6. Require confirmation that the user controls the destination and understands its visibility settings.
7. Restrict synchronized content through a default-deny file allowlist.
8. Run secret scanning before each commit and abort synchronization when likely credentials are detected.
9. Pin external components to reviewed versions and verify them using cryptographic hashes or signed releases.
10. Provide clear commands for stopping, inspecting, and disabling the background daemon.
11. Avoid automatically recommending persistent background execution until all configuration and consent checks have completed.

T09 · Insecure Skill Coding Practices

Warning

• Location: auto_sync_memory.py:33

Finding

Destructive and Insufficiently Validated Database Rebuild

Content

View full analysis

Vulnerability Details

File Location: auto_sync_memory.py:33-49
Vulnerability Type: Unsafe destructive data synchronization
Risk Level: Medium

The synchronization process deletes every existing database record before rebuilding the index from MEMORY.md. It does not validate that parsing produced a reasonable number of records, preserve a backup, or build the replacement data in a staging table before swapping it into service.

Vulnerable Code

python

cursor.execute('''
CREATE TABLE IF NOT EXISTS memories (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    title TEXT,
    content TEXT,
    created_at TEXT
)
''')

# Clear old data
cursor.execute('DELETE FROM memories')

# Insert new data
for block in blocks[1:]:
    lines = block.split('\n', 1)
    if len(lines) < 2:
        continue
    title = lines[0].strip()
    content = '\n'.join([line.strip() for line in lines[1].split('\n') if line.strip()])

    cursor.execute('''
    INSERT INTO memories (title, content, created_at)
    VALUES (?, ?, ?)
    ''', (title, content, datetime.datetime.now().isoformat()))

conn.commit()

Technical Analysis

A modification-time comparison is used to decide when to rebuild the database. Once the Markdown file is newer, the script parses blocks separated by a newline followed by ### , opens the database, and deletes all existing rows.

SQLite transaction rollback protects against some failures before commit(), but it does not protect against valid yet destructive input states. For example, an empty, truncated, or structurally malformed MEMORY.md can produce no valid blocks. The script will still execute DELETE FROM memories and commit an empty database.

The implementation lacks:

• Validation that the source file is complete and structurally valid.
• A minimum expected record count or suspicious-reduction threshold.
• A staging table for validating replacement content ...[truncated 1806 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the complete Markdown file before opening a write transaction or deleting existing records.
2. Reject a rebuild that unexpectedly produces zero records or a substantial unexplained reduction in record count.
3. Build replacement records in a staging table.
4. Validate the staging table before atomically replacing the active table.
5. Wrap the complete replacement process in an explicit transaction and roll it back on every validation or insertion failure.
6. Preserve a timestamped backup of the last known-good database before destructive changes.
7. Write source files atomically by creating a temporary file, flushing it, and renaming it over MEMORY.md.
8. Introduce file locking or another synchronization mechanism to avoid reading MEMORY.md while another process is writing it.
9. Log old and new record counts and require explicit confirmation for suspiciously destructive changes.
10. Add automated tests for empty files, truncated files, malformed headings, concurrent writes, and interrupted rebuilds.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This second mismatch finding similarly indicates the skill overstates automatic sync, Obsidian/Git integration, recovery guarantees, and the sophistication of its query engine. Overclaiming security and resilience properties can cause unsafe user behavior, especially when handling personal memory data that users believe is redundantly protected and intelligently searchable.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This second mismatch finding similarly indicates the skill overstates automatic sync, Obsidian/Git integration, recovery guarantees, and the sophistication of its query engine. Overclaiming security and resilience properties can cause unsafe user behavior, especially when handling personal memory data that users believe is redundantly protected and intelligently searchable.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The markdown says data is local and not uploaded, yet elsewhere states that notes are pushed to a remote GitHub repository. This contradiction creates a real privacy and data-exfiltration risk because users may place sensitive personal information into the system believing it never leaves the machine, when it may actually be transmitted and stored remotely.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions describe a persistent process that automatically performs git add/commit/push every 10 seconds without a clear warning about remote transmission or accidental publication. In the context of a personal memory system, this is particularly dangerous because highly sensitive notes may be committed and pushed automatically before the user can review or redact them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly describes automatic syncing of personal memory data into a local SQLite database and onward to a remote Git repository, but does not clearly warn users that sensitive notes may be persistently stored and transmitted off-host. In the context of a personal memory system, this increases the risk of unintentionally committing private thoughts, credentials, or other sensitive content to durable local storage and a remote service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The README instructs users to launch a background daemon with nohup so it continues running independently and checks/pushes changes every 10 seconds. In this skill's context, persistent background execution combined with automated Git syncing can continuously process and transmit personal data without clear lifecycle control, increasing the chance of unnoticed over-collection or unintended publication.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

3. Start the Git sync daemon (if not already running):

   bash

   cd /home/awu/.openclaw/workspace-work/
   nohup ./git_sync_on_save.sh > git_sync.log 2>&1 &
   

4. Verify the daemon is running:

   bash

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md

| Component | Check Command | Expected Result |
|----------|---------------|-----------------|
| `MEMORY.md` | `ls -l /home/awu/.openclaw/workspace-work/MEMORY.md` | File exists and is writable |
| `memory.db` | `ls -l /home/awu/.openclaw/workspace-work/memory.db` | File exists |
| `git_sync_on_save.sh` | `ls -l /home/awu/.openclaw/workspace-work/git_sync_on_save.sh` | File exists and is executable |
| Git Daemon | `ps aux | grep git_sync_on_save.sh` | Process running (not just the grep command) |

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

md

| Component | Check Command | Expected Result |
|----------|---------------|-----------------|
| `MEMORY.md` | `ls -l /home/awu/.openclaw/workspace-work/MEMORY.md` | File exists and is writable |
| `memory.db` | `ls -l /home/awu/.openclaw/workspace-work/memory.db` | File exists |
| `git_sync_on_save.sh` | `ls -l /home/awu/.openclaw/workspace-work/git_sync_on_save.sh` | File exists and is executable |
| Git Daemon | `ps aux | grep git_sync_on_save.sh` | Process running (not just the grep command) |

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md

| Component | Check Command | Expected Result |
|----------|---------------|-----------------|
| `MEMORY.md` | `ls -l /home/awu/.openclaw/workspace-work/MEMORY.md` | File exists and is writable |
| `memory.db` | `ls -l /home/awu/.openclaw/workspace-work/memory.db` | File exists |
| `git_sync_on_save.sh` | `ls -l /home/awu/.openclaw/workspace-work/git_sync_on_save.sh` | File exists and is executable |
| Git Daemon | `ps aux | grep git_sync_on_save.sh` | Process running (not just the grep command) |

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

md

| Component | Check Command | Expected Result |
|----------|---------------|-----------------|
| `MEMORY.md` | `ls -l /home/awu/.openclaw/workspace-work/MEMORY.md` | File exists and is writable |
| `memory.db` | `ls -l /home/awu/.openclaw/workspace-work/memory.db` | File exists |
| `git_sync_on_save.sh` | `ls -l /home/awu/.openclaw/workspace-work/git_sync_on_save.sh` | File exists and is executable |
| Git Daemon | `ps aux | grep git_sync_on_save.sh` | Process running (not just the grep command) |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs users to start a background process with nohup so it persists independently of the current session. Persistent unattended automation increases risk because it can continue monitoring and transmitting note changes without ongoing user awareness, compounding privacy, integrity, and operational issues if misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- `git_sync.log`
   - `auto_sync_memory.py`
   - `query_memory.py`
3. **运行**：确保 `git_sync_on_save.sh` 已通过 `nohup ./git_sync_on_save.sh > git_sync.log 2>&1 &` 启动并常驻后台。
   - 检查：`ps aux | grep git_sync_on_save.sh`
   - 重启：`pkill -f git_sync_on_save.sh && nohup ./git_sync_on_save.sh > git_sync.log 2>&1 &`
4. **查询**：直接向 AI 助手提问，例如：“我过去对 Obsidian 的看法是什么？” 系统会自动调用 `query_memory.py` 脚本检索并回答。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The restart guidance reinforces use of a persistent background sync daemon while the document simultaneously downplays remote-sharing risk. In this context, session persistence is more dangerous because the process is tied to automatic Git operations on personal knowledge data, allowing ongoing unintended commits or pushes after the initiating session ends.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- `query_memory.py`
3. **运行**：确保 `git_sync_on_save.sh` 已通过 `nohup ./git_sync_on_save.sh > git_sync.log 2>&1 &` 启动并常驻后台。
   - 检查：`ps aux | grep git_sync_on_save.sh`
   - 重启：`pkill -f git_sync_on_save.sh && nohup ./git_sync_on_save.sh > git_sync.log 2>&1 &`
4. **查询**：直接向 AI 助手提问，例如：“我过去对 Obsidian 的看法是什么？” 系统会自动调用 `query_memory.py` 脚本检索并回答。
## 安全与隐私
- **完全本地化**：所有数据（`MEMORY.md`, `memory.db`, `query_memory.py`, `obsidian-vault/`, `git_sync_on_save.sh`, `git_sync.log`）均存储在你的本地工作区，不上传、不共享。

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a broad 'personal memory system' with natural-language query support, Git version control, Obsidian synchronization, daemon/log monitoring, and multi-location recoverability. In this file, the implemented behavior is limited to checking timestamps, reading MEMORY.md, deleting all rows, and repopulating a local SQLite table; none of the claimed Git, Obsidian, daemon, logging, or recovery behavior appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script unconditionally executes 'DELETE FROM memories' before repopulating the table, so any parse failure, partial read, malformed markdown split, or interruption after deletion can destroy previously indexed data. In the skill context, this is more dangerous because the manifest markets the system as high-reliability, auto-syncing, and non-lossy, which may encourage unattended execution and false confidence in recoverability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This file's natural-language docstrings and user-facing strings are Chinese-only, which can amount to a language policy violation when the skill does not provide user opt-in or an alternative locale. The file does not state that it is intended only for Chinese-speaking users or a region-specific deployment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Comments and printed status messages are written only in Chinese, which imposes a specific language on users without any opt-in or documented justification. The policy requires avoiding forced language or locale constraints unless choice or rationale is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The inline comment says '清空旧数据（或可选：只更新变化）', implying an optional incremental-update mode. However, the actual code unconditionally executes 'DELETE FROM memories' and performs a full rebuild, so the comment describes behavior that does not exist.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.