Overkill Memory System

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:58 PM UTC
• Version: 1.9.5

Overview

This memory skill is purpose-aligned, but it needs Review because it can retain sensitive agent history, send transcript snippets to configured model CLIs, and feed unsanitized learned content into future sessions.

Install only if you are comfortable with a broad local memory system. Do not store secrets in it, avoid enabling the ACC cron pipeline with the default Claude model command unless transcript sharing is acceptable, prefer local models or redaction, review ACC_STATE.md before loading it into sessions, and back up diary/daily files before using cleanup.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: acc-error-memory/scripts/haiku-screen.sh:26
• Finding: Conversation Transcript Data Can Be Sent to Network-Backed Model CLIs Without Redaction<![CDATA[ ## Vulnerability Details **File Location**: `acc-error-memory/scripts/preprocess-errors.sh:14-17, 73-168`; `acc-error-memory/scripts/encode-pipeline.sh:121-124`; `acc-error-memory/scripts/haiku-screen.sh:26-101` **Vulnerability Type**: Sensitive-data exposure through external model invocation **Risk Level**: High ### Relevant Code From `acc-error-memory/scripts/preprocess-errors.sh`: ```bash WORKSPACE="${WORKSPACE:-$HOME/.openclaw/workspace}" AGENT_ID="${AGENT_ID:-main}" TRANSCRIPT_DIR="$HOME/.openclaw/agents/$AGENT_ID/sessions" OUTPUT="$WORKSPACE/memory/pending-errors.json" WATERMARK_FILE="$WORKSPACE/memory/acc-watcher-watermark.json" ``` ```python # Collect all messages from all sessions all_messages = [] session_files = glob(os.path.join(transcript_dir, '*.jsonl')) for session_file in session_files: session_name = os.path.basename(session_file) line_num = 0 try: with open(session_file, 'r', encoding='utf-8', errors='replace') as f: for line in f: line_num += 1 line = line.strip() if not line: continue try: data = json.loads(line) except json.JSONDecodeError: continue if data.get('type') != 'message': continue msg = data.get('message', {}) role = msg.get('role', '') if role not in ('user', 'assistant'): continue ts_str = data.get('timestamp', '') if not ts_str: continue try: ts = datetime.fromisoformat(ts_str.replace('Z', '+00:00')) except: continue if not full_mode and watermark_ts and ts <= watermark_ts: continue content = msg.get('content', []) text = '' if isi ...[truncated 6038 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default `ACC_MODELS` to an explicitly local model rather than a potentially network-backed CLI. 2. Require affirmative, informed opt-in before any transcript is processed by a remote provider. 3. Detect whether a configured command is local or remote and block unknown providers by default. 4. Redact API keys, authorization headers, passwords, private keys, email addresses, account identifiers, and other sensitive patterns before constructing prompts. 5. Provide a dry-run mode showing exactly which redacted text and provider would be used. 6. Support per-session, per-directory, and per-message exclusion controls. 7. Process only the minimum text necessary for classification instead of fixed 500-character excerpts from both messages. 8. Avoid writing full candidate exchanges to plaintext intermediate files, or protect them with restrictive permissions and prompt deletion. 9. Document provider transmission, retention, and privacy consequences next to the cron and model configuration instructions. 10. Add automated tests confirming that representative credentials and personal data never reach `subprocess.run`. ]]>

T02 · Agent Memory Poisoning

Error

• Location: acc-error-memory/scripts/log-error.sh:29
• Finding: Unsanitized Error Records Can Poison Persistent Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `acc-error-memory/scripts/log-error.sh:29-112`; `acc-error-memory/scripts/sync-state.sh:43-107`; `acc-error-memory/SKILL.md:227-243` **Vulnerability Type**: Persistent memory poisoning through untrusted Markdown context **Risk Level**: High ### Relevant Code From `acc-error-memory/scripts/log-error.sh`: ```bash PATTERN="$PATTERN" CONTEXT="$CONTEXT" MITIGATION="$MITIGATION" python3 << 'PYTHON' import json from datetime import datetime, timezone from pathlib import Path import os workspace = os.environ.get('WORKSPACE', os.path.expanduser('~/.openclaw/workspace')) state_file = Path(workspace) / 'memory' / 'acc-state.json' pattern = os.environ.get('PATTERN', '') context = os.environ.get('CONTEXT', '') mitigation = os.environ.get('MITIGATION', '') with open(state_file) as f: state = json.load(f) now = datetime.now(timezone.utc).isoformat() active = state.setdefault('activePatterns', {}) resolved = state.setdefault('resolved', {}) config = state.get('config', {}) stats = state.setdefault('stats', {}) if pattern in resolved: old_data = resolved[pattern] old_lesson = old_data.get('lesson', {}) old_mitigation = '' if isinstance(old_lesson, dict): old_mitigation = old_lesson.get('mitigation', '') if not old_mitigation: old_mitigation = old_data.get( 'lessonLearned', old_data.get('mitigation', '') ) old_data_copy = resolved.pop(pattern) active[pattern] = { 'count': old_data_copy.get('count', 0) + 1, 'severity': 'critical', 'firstSeen': old_data_copy.get('firstSeen', now), 'lastSeen': now, 'context': context or old_data_copy.get('context', ''), 'mitigation': mitigation or old_mitigation, 'regression': True, 'previouslyResolvedOn': old_data_copy.get('resolvedOn'), 'failedLesson': old_lesson if isinstance(old_lesson, dict) else {'mitigation': old_mitiga ...[truncated 5935 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat pattern names, contexts, mitigations, lessons, and model output as untrusted data. 2. Enforce strict schemas, maximum lengths, and permitted character sets before storing records. 3. Escape Markdown metacharacters, table delimiters, headings, HTML, links, and control characters during rendering. 4. Keep raw observations separate from trusted behavioral guidance. 5. Require explicit user review before promoting an observation into session-start context. 6. Do not load raw generated Markdown as instructions. Load structured data under a clear untrusted-data delimiter and instruct the agent not to execute embedded directives. 7. Restrict mitigations to predefined identifiers or approved templates rather than arbitrary prose. 8. Record provenance for every field, including transcript, model, timestamp, and approving user. 9. Add integrity controls so unreviewed processes cannot silently overwrite approved state. 10. Detect and reject imperative prompt-injection phrases in generated context. 11. Run the transcript-analysis agent with minimal tools and no authority to modify trusted startup instructions directly. 12. Add tests using Markdown headings, table breaks, embedded instructions, links, and multiline payloads to verify that generated state remains inert. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (96)

Credential Access

High

• Category: Privilege Escalation

Content

## Environment Setup

```bash
cp .env.example .env
# Edit .env with your ChromaDB/Ollama settings (optional)
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cp .env.example .env
# Edit .env with your ChromaDB/Ollama settings (optional)
```

## Need Help?

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cp .env.example .env
# Edit .env with your ChromaDB/Ollama settings (optional)
```

## Need Help?

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cp .env.example .env
# Edit .env with your ChromaDB/Ollama settings (optional)
```

## Need Help?

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cp .env.example .env
# Edit .env with your ChromaDB/Ollama settings (optional)
```

## Need Help?

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The cleanup routine permanently deletes diary and daily memory files based only on age, with no confirmation prompt, dry-run default, trash/recycle behavior, or backup safeguard. In a system centered on persistent memory, accidental or scripted invocation can cause immediate irreversible data loss of potentially valuable or sensitive user records.

Ssd 3

High

• Confidence: 94% confidence
• Finding: The diary search and retrieval paths return full stored content, including potentially sensitive personal memories, in plain data structures that are easy for upstream agents or plugins to surface, log, or transmit. In a skill context, broad retrieval of intimate stored data materially increases confidentiality risk if the caller is over-privileged, compromised, or prompt-injected.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The CLI commands print full diary entries and all strategy-note content directly to stdout, which can leak sensitive information into terminal history, logs, screen recordings, shared shells, or calling orchestration layers. Because the content is personal and strategic, the context makes this exposure more dangerous than ordinary debug output.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The integration broadens searchable context to include diary entries, daily logs, cron inbox, and related personal records, which increases the chance of over-collection and unintended disclosure. Because this is framed as a core memory/search enhancement, the skill context makes the issue more dangerous: sensitive personal material may be silently retrieved, ranked, and surfaced during normal operation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The diary search design explicitly scans files under a personal diary directory and searches entry contents without any mention of consent flow, scope restriction, redaction, or sensitivity warnings. In an agent skill, making private diary content part of searchable context can expose highly sensitive personal information to unrelated queries, logs, or downstream tools.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The architecture explicitly integrates a cloud backup component but provides no notice that stored memory content may leave the local environment. In a memory system that can contain queries, preferences, diary entries, and internal state, silent cloud sync creates a real privacy and data-governance risk because users may unknowingly transmit sensitive information to third-party infrastructure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The design documents persistent local storage for agent memory, including preferences, projects, daily notes, and internal state, but provides no privacy, retention, or sensitivity guidance. This creates a realistic risk that sensitive user or agent data will be stored long-term in plaintext-like local locations and later accessed by other local users, processes, or backup systems.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The sample code appears to ignore the documented shared/private selection semantics when creating collections, and it also namespaces collections with AGENT_ID even for shared usage. In a multi-agent memory design, this can cause data to be written to or read from unintended stores, weakening isolation guarantees and potentially exposing private data or breaking expected sharing boundaries.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Migration

```bash
# Create folders
mkdir -p ~/.openclaw/memory/chroma_{cody,nova,content,data,marketing,researcher,scholar,seo,social,startup,orchestrator}
mkdir -p ~/.openclaw/memory/chroma_shared
```

• Confidence: 78% confidence
• Finding: The migration step explicitly creates persistent directories for multi-agent memory, enabling session persistence across runs without discussing security controls. Persistence itself is not inherently malicious, but in this context it increases the blast radius of any sensitive data written by agents because the data remains available for later recovery, misuse, or cross-session leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The integration advertises continuous logging of errors, corrections, feature requests, and context into persistent local files but does not warn users that their inputs and operational context will be retained. In a memory/agent integration, this omission is risky because users may provide sensitive prompts, command output, filesystem paths, tokens, or proprietary information that gets stored without informed consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Implementation

### 1. Create self_improving.py

```python
from pathlib import Path

• Confidence: 88% confidence
• Finding: The implementation creates a persistent memory location under the user's home directory and is explicitly designed to retain data across sessions. In this skill's context, persistence is intentional, but it is still security-relevant because it extends the lifetime of potentially sensitive agent interactions and increases exposure to local compromise, accidental sharing, or later reuse without user awareness.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The code persistently records user corrections, feature descriptions, reasons, and free-form context in plain language markdown files. That creates a semantic data leak because the stored text can contain sensitive prompts, confidential business information, credentials pasted by mistake, or personal data, all retained in an easily readable format.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The design reads all accumulated learnings and injects 'relevant' items back into future task context, which can resurface previously captured sensitive content into unrelated interactions. This increases the danger beyond passive storage because old secrets, confidential context, or user corrections may be propagated to later prompts, tools, or models, potentially causing unintended disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The 'Auto-capture failures' and feedback capture behavior is described as an integration feature without warning that exception messages, command output, and context strings can contain secrets or sensitive user data. Because the capture is automatic, users and integrators may not realize that failures during auth, API calls, shell commands, or file operations could be written to disk verbatim.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger conditions are described at a high level ('After task completion', 'End of session', 'Daily') without clear gating, scoping, or consent requirements, which can cause the reflection process to run on more data and in more situations than intended. In a memory/reflection skill, unintended activation can lead to over-collection of sensitive task context, recursive behavior, noisy self-modification inputs, or privacy issues if logs are reviewed automatically.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The overview promotes persistent contextual memory across sessions and cloud backup in broad terms, encouraging retention and replication of user-provided conversational data without clear constraints. This is dangerous because it normalizes large-scale accumulation and backup of potentially sensitive content, increasing the blast radius of compromise, accidental disclosure, or over-collection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly advertises capture of platform posts, cross-session messages, diary entries, and user corrections, but does not present an up-front privacy warning, consent flow, minimization policy, or sensitivity boundaries before describing these collection features. This creates a real privacy and security risk because users may enable broad persistent logging of sensitive conversational and behavioral data without understanding retention, exposure, or downstream sync implications.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Tracking user corrections and interaction history is a real privacy issue when done without sensitivity controls, purpose limitation, or exclusion rules. Corrections often contain clarifications about identity, preferences, confidential projects, or mistakes, so storing them long-term can build a sensitive behavioral profile.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The feature list directs automated logging of cross-session messages, platform posts, diary entries, and proactive maintenance, which materially expands surveillance and retention of user activity. Automation makes this more dangerous because collection can continue without a fresh user decision each time, causing silent accumulation of sensitive data over time.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Daily & Diary

```bash
# Create daily note entry
python3 cli.py daily "What happened today"

# Create diary entry (prompts for date)

• Confidence: 90% confidence
• Finding: The daily and diary commands are explicit mechanisms for persisting session and reflective content across time, which is a real retention risk in a memory skill handling conversational data. In context, this is more dangerous because the skill is designed for broad long-term memory capture, so diary features can accumulate highly sensitive personal or project information.

Static analysis

No suspicious patterns detected.