Per Agent Compression Universal

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.4.0

Overview

The skill is coherent and not malicious, but it installs recurring jobs that automatically read old agent notes and persist personal profile information across every discovered agent workspace.

Install only if you want all discovered OpenClaw agents to automatically process older daily notes into persistent memory files. Before installing, back up agent workspaces, verify the DingTalk or other delivery recipient, consider editing the installer to target only selected agents, and plan to manually review or undo changes to long-term memory files if extraction is wrong or too sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The Chinese section materially contradicts the English behavior by stating tasks run under the main agent and mentioning working-buffer cleanup, which changes the documented trust boundary and scope of file access. In an agent skill, inconsistent instructions can cause operators to deploy the skill with incorrect assumptions or implement it in a less-isolated way, increasing risk of cross-agent data exposure or unintended file modification.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The script's comments and user-facing output say it removes 'peragent_compression_*' tasks, but the actual deletion filter matches '^per_agent_compression_'. This mismatch can cause operators to believe the intended cron jobs were removed when they were not, leaving scheduled tasks active and creating a misleading uninstall state.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README describes automated reading, summarization, appending, and moving of user memory files before prominently disclosing that user data will be modified. When a skill processes personal notes and persists derived content, weak up-front disclosure can lead to uninformed deployment and unintended data handling, especially in multi-agent environments with sensitive memory stores.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The installation instructions are overly broad for a skill that auto-discovers agents and registers recurring cron jobs across multiple workspaces. A user following 'just run ./install.sh' may unintentionally grant the skill persistent, cross-agent modification capability without understanding that it will schedule automated tasks and alter memory files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation does not clearly warn that installation creates persistent scheduled tasks across discovered agents and modifies or moves memory files. In this context, the absence of explicit notice undermines informed consent and increases the risk of unintended persistence, data alteration, and broader-than-expected access across agent workspaces.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Sending a DingTalk summary introduces external network transmission of operational metadata and potentially sensitive memory-processing information, yet the documentation does not clearly warn users about this outbound communication. In a memory consolidation skill handling personal info and decisions, undisclosed external delivery materially raises privacy and data leakage risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer embeds discovered workspace paths and delivery routing metadata into cron job definitions and announcement arguments without any explicit consent or privacy warning. In this skill's context, those jobs are also instructed to process memory files containing personal details, so routing metadata plus workspace identifiers can expose sensitive operational and personal information to the OpenClaw system and downstream delivery targets.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script unconditionally deletes and replaces a root-owned deployment directory with rm -rf and cp -r, without confirmation, backup, ownership checks, or path safety guards. In release automation, this can destroy an existing installation or propagate unintended contents into a privileged runtime location, especially if run from the wrong directory or with modified variables.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly states it extracts user preferences, decisions, and personal information into long-term memory files and sends summaries to DingTalk, but it does not present a clear privacy warning, consent requirement, or data-handling notice. In this context, the omission is dangerous because the skill performs automated cross-agent collection and persistence of sensitive data, increasing the risk of unnoticed retention and external disclosure.

Natural-Language Policy Violations

Low

• Confidence: 73% confidence
• Finding: Hard-coding scheduling relative to Shanghai time can cause jobs to run at unexpected times in other environments, which may lead to accidental execution during business hours, maintenance windows, or compliance-restricted periods. While not directly a security bug by itself, in a skill that processes personal information and sends notifications, incorrect timing can increase privacy and operational risk.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The changelog explicitly expands extraction to include 'User Traits & Self-Profile' and systematic preservation of personality, preferences, strengths, weaknesses, and self-descriptions from daily notes. That materially increases collection of sensitive personal data beyond operational memory, creating privacy, profiling, and secondary-use risk if the stored files are exposed, reused by other agents, or processed without informed consent and minimization.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: This feature set describes broad extraction of personal information, preferences, decisions, and domain-specific content from daily notes into persistent memory files across agents. In context, this is more dangerous because the skill is designed to automate recurring collection and retention at scale, potentially consolidating intimate user data into long-lived stores that may exceed user expectations or least-privilege data handling.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill instructs agents to extract and retain broad categories of personal information, preferences, traits, and relationship/context data from conversations into long-term memory files and summaries. This creates a persistent profiling mechanism that can amplify privacy harm, over-collection, and secondary use of sensitive personal data beyond what is necessary for task execution.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Promoting accumulation of a self-profile over time from conversations encourages longitudinal profiling of the user, including personality and behavioral preferences. In the context of an autonomous memory skill, this increases the blast radius of any misuse or compromise because the system centralizes high-value personal context across sessions.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The scheduled prompt instructs agents to read full daily notes, extract broad categories of personal and sensitive information, persist them into long-lived files, and send a summary to an external delivery target. This creates a clear data exfiltration and privacy amplification path: sensitive conversation content is consolidated, made more durable, and then announced outside the local workspace, increasing exposure and making abuse or accidental leakage far more damaging.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Upload assets (optional - tarball)
TARBALL="/root/.openclaw/workspace/skills/per-agent-compression-universal/per-agent-compression-universal.tar.gz"
if [ -f "$TARBALL" ]; then
  curl -s -X POST \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/gzip" \
    --data-binary @"$TARBALL" \

• Confidence: 81% confidence
• Finding: curl -s -X POST \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/gzip" \ --data-binary

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.