Agent Memory Patterns

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:48 AM UTC
• Version: 1.0.0

Overview

This skill is a memory automation guide, but its examples can promote untrusted notes into long-term agent memory, so it should be reviewed before use.

Use this only if you intentionally want an agent to maintain persistent workspace memory. Before enabling cron or curation, require human review for anything promoted to MEMORY.md, treat recalled memory as untrusted historical data, replace the shared /tmp file with mktemp, validate search inputs, and keep backups of memory files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:77
• Finding: Attacker-Controlled Entries Can Be Promoted into Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 77-100 and 115-147 **Vulnerability Type**: Persistent memory poisoning through unsanitized input **Risk Level**: High ### Vulnerable Code ```bash log_memory() { local event_type="$1" local description="$2" local importance="${3:-normal}" local date="$(date -I)" local time="$(date '+%H:%M')" local memory_file="/home/bot/.openclaw/workspace/memory/$date.md" # ファイル存在確認・作成 if [[ ! -f "$memory_file" ]]; then create_daily_memory fi # 重要度マーカー local marker="" case "$importance" in "high") marker="🔴 " ;; "medium") marker="🟡 " ;; "low") marker="⚪ " ;; *) marker="📝 " ;; esac # ログエントリ追加 echo "" >> "$memory_file" echo "### $time - $event_type" >> "$memory_file" echo "$marker$description" >> "$memory_file" echo "メモリログ追加: $event_type [$importance]" } ``` ```bash curate_weekly_memories() { local workspace="/home/bot/.openclaw/workspace" local memory_file="$workspace/MEMORY.md" local week_start="$(date -d '7 days ago' -I)" local today="$(date -I)" echo "## 週次メモリキュレーション ($week_start to $today)" >> "$memory_file" # 過去7日間の重要な出来事を抽出 for i in {0..6}; do local check_date="$(date -d "$i days ago" -I)" local daily_file="$workspace/memory/$check_date.md" if [[ -f "$daily_file" ]]; then # 高重要度の出来事を抽出 grep -E "🔴|高重要|重要な" "$daily_file" >> /tmp/important-events.txt fi done # 重要な出来事をMEMORY.mdに統合 if [[ -s /tmp/important-events.txt ]]; then echo "### 重要な出来事" >> "$memory_file" cat /tmp/important-events.txt >> "$memory_file" echo "" >> "$memory_file" fi # 学習したパターンを記録 echo "### 学習したパターン" >> "$memory_file" grep -h "学習" "$workspace/memory"/*.md | tail -10 >> "$memory_file" # クリーンアップ rm -f /tmp/important-events.tx ...[truncated 2224 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all logged and externally sourced content as untrusted data, never as agent instructions. 2. Store memories in a structured format such as JSON with separate fields for content, provenance, trust level, creation time, and reviewer identity. 3. Do not let a caller-controlled importance value automatically qualify content for long-term promotion. 4. Require explicit trusted review before copying untrusted entries into `MEMORY.md`. 5. Escape Markdown headings, code fences, HTML comments, and other document-control syntax before writing user-controlled content. 6. Add a fixed warning to recalled content stating that it is historical data and must not override system, developer, or current-session instructions. 7. Promote entries by immutable record identifier after review rather than by searching for attacker-influenceable text markers. 8. Restrict memory-file permissions and record an audit trail for creation, review, modification, and promotion operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:115
• Finding: Predictable Shared Temporary File Enables Memory Tampering and Symlink Attacks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 115-147 **Vulnerability Type**: Insecure temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash curate_weekly_memories() { local workspace="/home/bot/.openclaw/workspace" local memory_file="$workspace/MEMORY.md" local week_start="$(date -d '7 days ago' -I)" local today="$(date -I)" echo "## 週次メモリキュレーション ($week_start to $today)" >> "$memory_file" # 過去7日間の重要な出来事を抽出 for i in {0..6}; do local check_date="$(date -d "$i days ago" -I)" local daily_file="$workspace/memory/$check_date.md" if [[ -f "$daily_file" ]]; then # 高重要度の出来事を抽出 grep -E "🔴|高重要|重要な" "$daily_file" >> /tmp/important-events.txt fi done # 重要な出来事をMEMORY.mdに統合 if [[ -s /tmp/important-events.txt ]]; then echo "### 重要な出来事" >> "$memory_file" cat /tmp/important-events.txt >> "$memory_file" echo "" >> "$memory_file" fi # 学習したパターンを記録 echo "### 学習したパターン" >> "$memory_file" grep -h "学習" "$workspace/memory"/*.md | tail -10 >> "$memory_file" # クリーンアップ rm -f /tmp/important-events.txt echo "週次キュレーション完了" } ``` ### Technical Analysis The curation function uses the fixed, globally predictable path `/tmp/important-events.txt`. It neither creates the file atomically nor verifies that it is a regular file owned by the expected account. The first operation uses append mode, so stale content from a previous run is retained and subsequently imported. On a multi-user system, another local process can create this path before the scheduled task runs. The path can contain attacker-controlled content or be a symbolic link. Shell redirection follows symbolic links, so the curation process may append data to another file writable by its account. The process later reads the same path and copies its contents into long-term memory. ### Attack Path 1. A loc ...[truncated 1144 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a unique temporary file atomically and remove it through a cleanup trap: ```bash local tmp_file tmp_file="$(mktemp "${TMPDIR:-/tmp}/important-events.XXXXXX")" || return 1 chmod 600 "$tmp_file" trap 'rm -f -- "$tmp_file"' RETURN for i in {0..6}; do check_date="$(date -d "$i days ago" -I)" daily_file="$workspace/memory/$check_date.md" if [[ -f "$daily_file" ]]; then grep -E -- "🔴|高重要|重要な" "$daily_file" >> "$tmp_file" fi done if [[ -s "$tmp_file" ]]; then cat -- "$tmp_file" >> "$memory_file" fi ``` Additionally: 1. Avoid shared fixed names in world-writable directories. 2. Set a restrictive `umask`, such as `umask 077`, before creating temporary data. 3. Do not use append mode on data inherited from a previous run. 4. Reject non-regular files when operating on persistent paths. 5. Use process locking if concurrent curation runs are possible. 6. Prefer a private runtime directory owned by the service account where feasible. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:160
• Finding: Untrusted Search Terms Can Be Interpreted as grep Options<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 160-192 **Vulnerability Type**: Argument and option injection **Risk Level**: Low ### Vulnerable Code ```bash smart_memory_search() { local query="$1" local context_lines="${2:-3}" local workspace="/home/bot/.openclaw/workspace" echo "=== メモリ検索結果: '$query' ===" # MEMORY.md検索（長期記憶） echo "## 長期記憶 (MEMORY.md)" if [[ -f "$workspace/MEMORY.md" ]]; then grep -n -i -C "$context_lines" "$query" "$workspace/MEMORY.md" | head -20 fi echo "" echo "## 最近の記憶 (過去7日)" # 過去7日間の日次ファイルを検索 for i in {0..6}; do local check_date="$(date -d "$i days ago" -I)" local daily_file="$workspace/memory/$check_date.md" if [[ -f "$daily_file" ]]; then local matches="$(grep -l -i "$query" "$daily_file" 2>/dev/null)" if [[ -n "$matches" ]]; then echo "### $check_date" grep -n -i -C 2 "$query" "$daily_file" | head -10 echo "" fi fi done # 関連キーワード提案 echo "## 関連キーワード候補" grep -h -i "$query" "$workspace/MEMORY.md" "$workspace/memory"/*.md 2>/dev/null \ | tr ' ' '\n' | grep -v '^$' | sort | uniq -c | sort -nr | head -5 } ``` ### Technical Analysis Although `query` is quoted against shell word splitting, it is positioned where `grep` continues to recognize command-line options. A value beginning with `-` can therefore be interpreted as a `grep` option instead of a search pattern. The `context_lines` argument is also not validated as a bounded integer before being passed to `grep -C`. These issues do not constitute shell command injection because shell metacharacters inside the quoted variables are not re-evaluated. They do, however, permit argument-level manipulation of the invoked utility. ### Attack Path 1. An attacker controls or influences the query passed to `smart_memory_search`. 2. The attacker sup ...[truncated 895 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Terminate option parsing before every untrusted pattern: ```bash grep -n -i -C "$context_lines" -- "$query" "$workspace/MEMORY.md" grep -l -i -- "$query" "$daily_file" grep -n -i -C 2 -- "$query" "$daily_file" grep -h -i -- "$query" "$workspace/MEMORY.md" "$workspace/memory"/*.md ``` Validate and bound the context argument before use: ```bash if [[ ! "$context_lines" =~ ^[0-9]+$ ]] || (( context_lines > 20 )); then echo "Invalid context line count" >&2 return 2 fi ``` If the function is intended to perform literal-text searches rather than regular-expression searches, add `-F`: ```bash grep -F -n -i -C "$context_lines" -- "$query" "$workspace/MEMORY.md" ``` Apply the same `--` separator and validation rules to `contextual_search`, where caller-provided keywords are combined into an extended regular expression. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

grep -h "学習" "$workspace/memory"/*.md | tail -10 >> "$memory_file"
    
    # クリーンアップ
    rm -f /tmp/important-events.txt
    
    echo "週次キュレーション完了"
}

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The natural-language content, including the description, headings, instructions, and examples, is presented only in Japanese. That can violate language/locale policy when no user opt-in or justification is provided for restricting the skill to a specific language.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file documents multiple file-system modifying behaviors, including creating daily logs, appending to MEMORY.md, moving monthly files into an archive, and deleting temporary files. Although the code snippets print status messages, the markdown description does not clearly warn users that adopting these patterns will automatically alter persistent data and run via cron.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The manifest and document describe patterns for persistent agent memory management, including daily files, long-term memory, search, and curation. The statement at L438 about trading knowledge on agent-state backup strategy is unrelated to implementing or documenting a memory architecture pattern and introduces an unjustified capability/purpose signal outside the declared scope.

Static analysis

No suspicious patterns detected.