T02 · Agent Memory Poisoning
Error
- Location
install.sh:134- Finding
Untrusted Daily Notes Can Poison Persistent Agent Memory and Behavioral Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Per Agent Compression Universal
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed memory-compression tool, but it automatically creates recurring jobs across all agents that read private notes and write profile-like content into long-term agent memory without a review gate.
Review this carefully before installing. It is not clearly malicious, but installation gives the skill recurring authority to process every discovered agent's memory, move note files, and add personal/profile-derived content to long-term agent memory. Prefer installing only after backing up memory files, limiting affected agents manually, reviewing DingTalk delivery settings, and accepting that uninstall will not undo appended memory entries.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:138- Finding
Unquoted Dynamic Argument Construction Permits OpenClaw CLI Option Injection
- Content
View full analysis
&1; then ``` ### Technical Analysis The installer concatenates externally supplied delivery values into a single string and later expands that string without quotation. The affected values can originate from command-line arguments or environment variables: - `DELIVERY_CHANNEL` - `DELIVERY_TO` - `DELIVERY_ACCOUNT` Unquoted expansion applies shell word splitting and pathname expansion. A value containing spaces is therefore converted into multiple arguments. A value containing additional tokens beginning with `-` or `--` can inject unintended options into the `openclaw cron add` invocation. This is CLI argument injection rather than arbitrary shell-command injection. Shell metacharacters introduced through variable expansion are not reparsed as shell syntax, so the shown code alone does not establish direct execution of commands such as `; command`. Nevertheless, an attacker can alter the argument vector passed to OpenClaw and may affect cron-job configuration according to the options accepted by the installed OpenClaw version. ### Attack Path 1. An attacker influences an installer argument or environment variable, such as `DELIVERY_TO`. 2. The supplied value contains whitespace followe ...[truncated 1254 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (32)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
cp scripts/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
text The hook will now run automatically before each commit. To bypass (not recommended): `git commit --no-verify` **Note**: This hook runs locally only. For team environments, consider using the `pre-commit` framework to manage shared hooks.
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The task instructions direct broad extraction of personal data categories such as preferences, people, relationships, user traits, self-profile, and other contextual details, then persist them into memory/configuration files and include summary announcements via a delivery channel. In this skill context, that is especially dangerous because the process is automated, recurring, and cross-cuts multiple agents, increasing the chance of over-collection, long-term retention, and disclosure of sensitive personal information to external recipients.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Using rm -rf on a root-owned path is dangerous because the script runs a destructive filesystem operation with no interlock, dry-run, or invariant enforcement beyond string interpolation. If the path computation is wrong, the variable changes in future edits, or the script is run in an unexpected environment, it can delete critical files and lead to severe integrity and availability impact.
- Content
sh echo "-----------------------------------------" if [ -d "/root/.openclaw/skills/${SKILL_NAME}" ]; then rm -rf "/root/.openclaw/skills/${SKILL_NAME}" cp -r "." "/root/.openclaw/skills/${SKILL_NAME}/" echo "✅ Synced to /root/.openclaw/skills/${SKILL_NAME}/" else
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
These lines describe systematically extracting and preserving user traits, communication preferences, strengths/weaknesses, and other profile data from notes into persistent memory. That creates a privacy and data-minimization risk because sensitive personal information is being aggregated, made durable, and potentially exposed to later tasks or operators beyond the original context of collection.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This feature description documents extracting personal information, preferences, and decisions from daily notes into persistent memory files. In context, the skill is designed to continuously consolidate user data across notes, which increases sensitivity through aggregation and creates meaningful privacy risk if those memory files are overbroad, insufficiently protected, or later reused for unrelated purposes.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The feature description actively promotes richer long-term profiling of the user over time by accumulating self-profile and behavioral information. In context, this normalizes continuous personal-data aggregation as a product goal, increasing the risk of overcollection, misuse, and unauthorized inference even if no traditional code exploit is present.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs agents to extract, summarize, and persist broad personal information from daily notes into long-term memory files, including preferences, traits, relationships, and self-descriptions. This creates a durable profiling store that can exceed user expectations, amplify privacy harm if accessed by other components, and retain sensitive data longer than necessary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README gives conflicting statements about which agent executes the cron task: the English section says each task runs under its respective agent, while the Chinese section says the
mainagent executes the task. In a multi-agent system, this ambiguity can cause operators to deploy with the wrong trust boundary assumptions, potentially granting broader data access or causing one agent to process another agent's memory.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Chinese documentation says the task performs working-buffer cleanup at completion, while the English documentation explicitly says the skill does not touch
working-buffer.mdor unrelated files. That contradiction is security-relevant because users may approve installation believing only memory files are modified, while the alternate locale suggests broader file mutation behavior.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly states it extracts personal information, appends content into long-term memory files, and moves originals into a processed folder, but it does not present a clear warning about privacy impact, data rewriting, or retention changes. In a multi-agent automation context, silent modification of memory files containing personal data increases the risk of unintended disclosure, loss of provenance, and user surprise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains natural-language requirements that enforce bilingual/Chinese content, including a mandatory Chinese scroll notice. Under the policy rule, forcing a specific language or locale without user opt-in is a reportable violation unless the regional constraint is explicitly justified, which is not stated here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The installer presents itself as a compression-task registrar, but the actual embedded cron messages instruct agents to extract, transform, and persist broad categories of user information, including traits, preferences, and identity-relevant facts, into long-lived memory files. This mismatch reduces informed consent and makes operators more likely to install a workflow that materially changes data retention behavior beyond what the headline description suggests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The scheduled tasks are autonomous and explicitly instructed to read daily note files, append content-derived summaries to persistent files, move the original notes into a processed directory, and update state, yet the installer provides no explicit warning or confirmation about these file modifications. That creates a risk of silent integrity-impacting changes to user workspaces and unexpected retention or relocation of sensitive notes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The embedded release body states that this is a documentation-only release with no functional changes. However, the script's actual behavior is to create a GitHub release via the GitHub API and optionally upload a tarball asset, which are functional side effects affecting a remote repository.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # Create release RESPONSE=$(curl -s -X POST \ -H "Authorization: Bearer $TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ "https://api.github.com/repos/$REPO/releases" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -X POST \ -H "Authorization: Bearer $TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ "https://api.github.com/repos/$REPO/releases" \ -d "{\"tag_name\":\"$TAG\",\"target_commitish\":\"master\",\"name\":\"$TITLE\",\"body\":\"$BODY\",\"draft\":false,\"prerelease\":false}") RELEASE_ID=$(echo "$RESPONSE" | jq -r '.id')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The script uploads a local tarball from a fixed filesystem path to a remote GitHub release without verifying the archive contents or requiring explicit user confirmation. In a skill/agent context, this increases the risk of unintentionally publishing sensitive workspace contents or packaged secrets if that tarball was built from an unsafe source or contains more than intended.
- Content
sh # Upload assets (optional - tarball) TARBALL="/root/.openclaw/workspace/skills/per-agent-compression-universal/per-agent-compression-universal.tar.gz" if [ -f "$TARBALL" ]; then curl -s -X POST \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/gzip" \ --data-binary @"$TARBALL" \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script fails the release if
CHANGELOG.mdlacks Chinese sections and warns on short Chinese content, making a specific language requirement mandatory. This is a natural-language policy concern because it forces a locale-specific documentation constraint without offering user choice or explaining a region-specific compliance need in the file.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The inline comment says 'Build release notes from CHANGELOG entry', which implies the notes are derived from the contents of
CHANGELOG.md. In practice, the script interpolates${CHANGELOG_ENTRY}from the command-line argument and does not read or extract the actual changelog text here, so the documentation materially misstates the source of release content.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script recursively deletes an existing deployment directory under /root without confirmation, backup, or sanity checks. In a privileged execution context, an operator mistake or unexpected variable value could cause destructive local data loss and disrupt the installed skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is explicitly a 'Bilingual Completeness Validator' and later hard-codes validation of '( Chinese )' sections and minimum Chinese content length. This imposes a specific language/locale requirement, and the file does not provide user opt-in or explain a justified region-specific compliance need.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description advertises zero-config auto-discovery and automatic registration of staggered cron tasks across multi-agent deployments without defining boundaries, exclusions, or operator approval. In a skill that affects memory/state and multiple agents, broad automatic activation increases the risk of unintended cross-agent changes, surprise persistence, and unsafe deployment in environments where not all agents should be modified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes cron-based automation across discovered agents but does not provide a prominent warning in the manifest about scheduled background task creation, persistence, or the operational effects of modifying multiple agents. Because the skill installs an installer script and advertises full state tracking, the lack of clear warning makes it easier for users to authorize persistent automation without understanding the blast radius.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states it extracts and consolidates user preferences, decisions, and personal information, and also sends summaries to DingTalk, but it does not warn users about the privacy implications or outbound transmission of potentially sensitive data. This creates a real transparency and consent problem because operators may install or run it without understanding that personal data will be processed and shared externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill describes automatic appending to long-term memory files, moving processed notes, and updating state files, but it does not clearly warn that running it will modify and relocate user data automatically. This is dangerous because users may assume it is read-only maintenance, while it actually changes persistent records and file locations, increasing the risk of accidental data loss, integrity issues, or operational confusion.
- Content
Static analysis
No suspicious patterns detected.