Agent Progressive Memory

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:46 PM UTC
• Version: 1.2.3

Overview

This skill is a disclosed local group-memory tool with optional hooks that write local memory state, with no evidence of exfiltration, credential use, or destructive behavior.

Install this only in workspaces where persistent group memory is acceptable. Review the hook code before copying it into ~/.openclaw/hooks, enable precompact-remem only if you want automatic memory-state updates, and periodically inspect or prune memory files and memory/flush-state.json for sensitive or stale information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a read-side 'progressive disclosure' protocol, but it also introduces automated write-back, event hooks, cron-driven behavior, and session/state persistence. That mismatch is security-relevant because operators may enable it expecting scoped memory reads, while it actually changes runtime behavior and stores additional session-derived metadata, increasing data retention and attack surface.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs automatic memory modification via message hooks and cron jobs without a prominent user-facing warning or consent flow. In a collaborative memory context, silent automated writes can retain sensitive conversation details, create inaccurate records, and surprise users who believed memory updates were manual or contextual.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The installation instructions modify the user's hook directory and runtime behavior, but the documentation does not clearly warn that this changes local event handling and may intercept future messages/session lifecycle events. Even without malicious code shown here, hidden persistence into a hooks path is a meaningful trust and safety concern.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The hook persists session metadata such as session_key, message_count, token_count, group counts, and recent delta paths into memory/flush-state.json without any consent, minimization, or retention controls. In a collaborative memory skill, this creates a privacy and observability risk because operational session details are written to disk and may be accessible to other local users, tools, backups, or later processes even if the user did not expect that metadata to be retained.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The hook is documented to trigger on any received message containing `/remem`, and the wording is broad enough that it may activate outside the intended scoped collaboration context described by the parent skill. Because the behavior includes extracting session context and updating memory files, ambiguous triggering can cause unintended memory processing or writes from ordinary chat input, increasing the risk of unauthorized or accidental state changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The markdown states that the hook updates `memory/flush-state.json` and `memory/groups/{group}/*.md` but gives no warning that a user message can trigger persistent data modification. In a memory-management skill, silent writes are especially risky because users may not realize that invoking or even mentioning the command can alter shared historical records, leading to integrity issues, accidental disclosure propagation, or destructive overwrites.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The hook performs a silent write to workspace memory state whenever a user sends /remem, without any user-facing notice or explicit confirmation. Even though the data written is operational metadata rather than secrets, it records session identifiers, context usage, and filesystem-derived state in the background, which can violate user expectations, create unintended audit trails, and be abused for covert persistence if users assume /remem is read-only.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The auto-flush design persists conversation-derived content such as pending items, role assignments, contact information, session IDs, timestamps, and context usage into memory files and flush-state tracking. In a group-chat skill, that creates a real data retention and leakage risk because sensitive user-provided details may be stored longer than expected and later surfaced across sessions or to the wrong context.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.