T09 · Insecure Skill Coding Practices
Error
- Location
acc-error-memory/scripts/haiku-screen.sh:26- Finding
Conversation Transcript Data Can Be Sent to Network-Backed Model CLIs Without Redaction
- Content
View full analysis
- Remediation
View remediation
Security audit
Overkill Memory System
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is purpose-aligned, but it needs Review because it can retain sensitive agent history, send transcript snippets to configured model CLIs, and feed unsanitized learned content into future sessions.
Install only if you are comfortable with a broad local memory system. Do not store secrets in it, avoid enabling the ACC cron pipeline with the default Claude model command unless transcript sharing is acceptable, prefer local models or redaction, review ACC_STATE.md before loading it into sessions, and back up diary/daily files before using cleanup.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
acc-error-memory/scripts/log-error.sh:29- Finding
Unsanitized Error Records Can Poison Persistent Agent Context
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (96)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Environment Setup
bash cp .env.example .env # Edit .env with your ChromaDB/Ollama settings (optional)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash cp .env.example .env # Edit .env with your ChromaDB/Ollama settings (optional)Need Help?
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash cp .env.example .env # Edit .env with your ChromaDB/Ollama settings (optional)Need Help?
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash cp .env.example .env # Edit .env with your ChromaDB/Ollama settings (optional)Need Help?
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash cp .env.example .env # Edit .env with your ChromaDB/Ollama settings (optional)Need Help?
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The cleanup routine permanently deletes diary and daily memory files based only on age, with no confirmation prompt, dry-run default, trash/recycle behavior, or backup safeguard. In a system centered on persistent memory, accidental or scripted invocation can cause immediate irreversible data loss of potentially valuable or sensitive user records.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The diary search and retrieval paths return full stored content, including potentially sensitive personal memories, in plain data structures that are easy for upstream agents or plugins to surface, log, or transmit. In a skill context, broad retrieval of intimate stored data materially increases confidentiality risk if the caller is over-privileged, compromised, or prompt-injected.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI commands print full diary entries and all strategy-note content directly to stdout, which can leak sensitive information into terminal history, logs, screen recordings, shared shells, or calling orchestration layers. Because the content is personal and strategic, the context makes this exposure more dangerous than ordinary debug output.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The integration broadens searchable context to include diary entries, daily logs, cron inbox, and related personal records, which increases the chance of over-collection and unintended disclosure. Because this is framed as a core memory/search enhancement, the skill context makes the issue more dangerous: sensitive personal material may be silently retrieved, ranked, and surfaced during normal operation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The diary search design explicitly scans files under a personal diary directory and searches entry contents without any mention of consent flow, scope restriction, redaction, or sensitivity warnings. In an agent skill, making private diary content part of searchable context can expose highly sensitive personal information to unrelated queries, logs, or downstream tools.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The architecture explicitly integrates a cloud backup component but provides no notice that stored memory content may leave the local environment. In a memory system that can contain queries, preferences, diary entries, and internal state, silent cloud sync creates a real privacy and data-governance risk because users may unknowingly transmit sensitive information to third-party infrastructure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The design documents persistent local storage for agent memory, including preferences, projects, daily notes, and internal state, but provides no privacy, retention, or sensitivity guidance. This creates a realistic risk that sensitive user or agent data will be stored long-term in plaintext-like local locations and later accessed by other local users, processes, or backup systems.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The sample code appears to ignore the documented shared/private selection semantics when creating collections, and it also namespaces collections with AGENT_ID even for shared usage. In a multi-agent memory design, this can cause data to be written to or read from unintended stores, weakening isolation guarantees and potentially exposing private data or breaking expected sharing boundaries.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The migration step explicitly creates persistent directories for multi-agent memory, enabling session persistence across runs without discussing security controls. Persistence itself is not inherently malicious, but in this context it increases the blast radius of any sensitive data written by agents because the data remains available for later recovery, misuse, or cross-session leakage.
- Content
Migration
bash # Create folders mkdir -p ~/.openclaw/memory/chroma_{cody,nova,content,data,marketing,researcher,scholar,seo,social,startup,orchestrator} mkdir -p ~/.openclaw/memory/chroma_shared
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The integration advertises continuous logging of errors, corrections, feature requests, and context into persistent local files but does not warn users that their inputs and operational context will be retained. In a memory/agent integration, this omission is risky because users may provide sensitive prompts, command output, filesystem paths, tokens, or proprietary information that gets stored without informed consent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The implementation creates a persistent memory location under the user's home directory and is explicitly designed to retain data across sessions. In this skill's context, persistence is intentional, but it is still security-relevant because it extends the lifetime of potentially sensitive agent interactions and increases exposure to local compromise, accidental sharing, or later reuse without user awareness.
- Content
Implementation
1. Create self_improving.py
python from pathlib import Path
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code persistently records user corrections, feature descriptions, reasons, and free-form context in plain language markdown files. That creates a semantic data leak because the stored text can contain sensitive prompts, confidential business information, credentials pasted by mistake, or personal data, all retained in an easily readable format.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The design reads all accumulated learnings and injects 'relevant' items back into future task context, which can resurface previously captured sensitive content into unrelated interactions. This increases the danger beyond passive storage because old secrets, confidential context, or user corrections may be propagated to later prompts, tools, or models, potentially causing unintended disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The 'Auto-capture failures' and feedback capture behavior is described as an integration feature without warning that exception messages, command output, and context strings can contain secrets or sensitive user data. Because the capture is automatic, users and integrators may not realize that failures during auth, API calls, shell commands, or file operations could be written to disk verbatim.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger conditions are described at a high level ('After task completion', 'End of session', 'Daily') without clear gating, scoping, or consent requirements, which can cause the reflection process to run on more data and in more situations than intended. In a memory/reflection skill, unintended activation can lead to over-collection of sensitive task context, recursive behavior, noisy self-modification inputs, or privacy issues if logs are reviewed automatically.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The overview promotes persistent contextual memory across sessions and cloud backup in broad terms, encouraging retention and replication of user-provided conversational data without clear constraints. This is dangerous because it normalizes large-scale accumulation and backup of potentially sensitive content, increasing the blast radius of compromise, accidental disclosure, or over-collection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly advertises capture of platform posts, cross-session messages, diary entries, and user corrections, but does not present an up-front privacy warning, consent flow, minimization policy, or sensitivity boundaries before describing these collection features. This creates a real privacy and security risk because users may enable broad persistent logging of sensitive conversational and behavioral data without understanding retention, exposure, or downstream sync implications.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Tracking user corrections and interaction history is a real privacy issue when done without sensitivity controls, purpose limitation, or exclusion rules. Corrections often contain clarifications about identity, preferences, confidential projects, or mistakes, so storing them long-term can build a sensitive behavioral profile.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The feature list directs automated logging of cross-session messages, platform posts, diary entries, and proactive maintenance, which materially expands surveillance and retention of user activity. Automation makes this more dangerous because collection can continue without a fresh user decision each time, causing silent accumulation of sensitive data over time.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The daily and diary commands are explicit mechanisms for persisting session and reflective content across time, which is a real retention risk in a memory skill handling conversational data. In context, this is more dangerous because the skill is designed for broad long-term memory capture, so diary features can accumulate highly sensitive personal or project information.
- Content
Daily & Diary
bash # Create daily note entry python3 cli.py daily "What happened today" # Create diary entry (prompts for date)
Static analysis
No suspicious patterns detected.