T09 · Insecure Skill Coding Practices
Error
- Location
handler.js:52- Finding
Unsanitized Project Names Allow Filesystem Path Traversal and Recursive Deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
project-memory
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent project-memory purpose, but unsafe path handling can let project names escape the intended folder and delete, move, or write unintended local files.
Review carefully before installing. The main risk is not the memory concept itself, but the implementation: do not use this version with untrusted or arbitrary project names, and avoid deletion/archive operations until project-name validation, path containment checks, and real backup behavior are added. Also treat saved memories as persistent shared local data that may be visible to other agents.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
handler.js:247- Finding
Persisted Current-Project and Entry Metadata Can Escape the Memory Storage Boundary
- Content
View full analysis
或 /project create <项目名>' }; } const projectDir = path.join(PROJECTS_DIR, index.currentProject); const entriesFile = path.join(projectDir, 'memory', 'entries.json'); ensureDir(path.join(projectDir, 'memory')); let entries = { entries: [] }; if (fs.existsSync(entriesFile)) { entries = JSON.parse(fs.readFileSync(entriesFile, 'utf8')); } const entryId = `mem_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`; const now = new Date().toISOString(); const entry = { id: entryId, title, tags, createdAt: now, updatedAt: now, agent: process.env.OPENCLAW_AGENT_ID || 'unknown' }; entries.entries.unshift(entry); fs.writeFileSync(entriesFile, JSON.stringify(entries, null, 2)); const contentFile = path.join(projectDir, 'memory', `${entryId}.md`); fs.writeFileSync( contentFile, `# ${title}\n\n${content}\n\n---\n创建时间: ${now}\n标签: ${tags.join(', ')}` ); } ``` ```js function memorySearch(query, limit = 10) { const index = readIndex(); if (!index.currentProject) { return { success: false, error: '请先选择一个项目' }; } const projectDir = path.join(PROJECTS_DIR, index.currentProject); const entriesFile = path.join(projectDir, 'memory', 'entries.json'); if (!fs.existsSync(entriesFile)) { return { success: true, results: [], message: '暂无记忆' }; ...[truncated 3513 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:151- Finding
Documented Automatic Backup Safety Control Is Not Implemented
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The markdown file documents
/project delete <名称>as well as memory save functionality and states that all project data is stored under~/.openclaw/projects/, but it does not warn users about deletion consequences, persistence, or shared-access privacy implications. For markdown files, safety-relevant behaviors affecting user data should be accompanied by clear warnings.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
项目管理
text /project list # 列出所有项目 /project create <名称> # 创建新项目 /project use <名称> # 切换到项目 /project info # 显示当前项目 /project archive <名称> # 归档项目
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs agents to automatically save conversation content in several situations, but it does not require clear user notice or consent before persisting potentially sensitive data. In a cross-agent shared memory system, this increases the chance that private, regulated, or security-relevant information is stored and later retrieved by other agents without the user's informed awareness.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims 'complete isolation' between projects while also stating that all agents can access all projects by default. This contradiction can mislead users and downstream agents into assuming stronger confidentiality boundaries than actually exist, creating a real risk of cross-project data exposure in a shared memory system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code persistently writes project metadata and memory content into files under the user's home directory, which affects user data storage and privacy. Although the behavior is part of the feature set, there is no visible confirmation prompt or user-facing disclosure in the code indicating that content will be stored locally.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The display name, description, tool descriptions, and all trigger patterns are presented only in Chinese, which effectively constrains use to a specific language. There is no indication that the skill is region-specific or that users can opt into another language, which conflicts with the policy against forcing a specific language without user choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest explicitly describes a cross-agent project memory system with shared access, but it does not present a clear warning that user data may persist and be accessible across agents or sessions. This creates a meaningful confidentiality risk because users may reveal sensitive information assuming it is ephemeral or isolated when it is not.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger set is broad and generic, including common phrases like switching projects, creating projects, and saving/searching memory. In an agent environment, this increases the chance of unintended activation and accidental execution of memory or project-management actions based on normal conversation rather than explicit user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The configuration enables autoSave by default, implying content may be written to persistent storage automatically without a visible consent step. In a memory-management skill, this is especially dangerous because users may unknowingly persist credentials, internal notes, or other sensitive project data to disk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The README presents all operational instructions in Chinese, which effectively forces a specific language for users without any opt-in or explanation that the skill is intended for a Chinese-speaking audience. The policy requires avoiding language or locale constraints unless the user is given a choice or the limitation is clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
All user-facing instructions, commands, and prompts in the skill are presented in Chinese, and the document does not indicate that the language is optional or region-specific. This can constitute a language policy issue when users are not given a choice or informed of the locale constraint.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The archive operation renames and relocates a project directory into an archived area, which changes the user's filesystem state. The code returns a success message after completion, but it does not provide advance disclosure or an in-code warning that the operation will move files on disk.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
With no manifest or stated purpose available, reading process environment is not justified by documented intent in this file. The code accesses OPENCLAW_AGENT_ID to persist agent identity into saved memory entries, which is an extra capability beyond the otherwise local project/memory file management behavior.
- Content