Security audit

Agent Memory Patterns

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory automation guide, but its examples can promote untrusted notes into long-term agent memory, so it should be reviewed before use.

Use this only if you intentionally want an agent to maintain persistent workspace memory. Before enabling cron or curation, require human review for anything promoted to MEMORY.md, treat recalled memory as untrusted historical data, replace the shared /tmp file with mktemp, validate search inputs, and keep backups of memory files.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:77
Finding: Attacker-Controlled Entries Can Be Promoted into Persistent Agent Memory
Content: View full analysis
> "$memory_file" echo "### $time - $event_type" >> "$memory_file" echo "$marker$description" >> "$memory_file" echo "メモリログ追加: $event_type [$importance]" } ``` ```bash curate_weekly_memories() { local workspace="/home/bot/.openclaw/workspace" local memory_file="$workspace/MEMORY.md" local week_start="$(date -d '7 days ago' -I)" local today="$(date -I)" echo "## 週次メモリキュレーション ($week_start to $today)" >> "$memory_file" # 過去7日間の重要な出来事を抽出 for i in {0..6}; do local check_date="$(date -d "$i days ago" -I)" local daily_file="$workspace/memory/$check_date.md" if [[ -f "$daily_file" ]]; then # 高重要度の出来事を抽出 grep -E "🔴|高重要|重要な" "$daily_file" >> /tmp/important-events.txt fi done # 重要な出来事をMEMORY.mdに統合 if [[ -s /tmp/important-events.txt ]]; then echo "### 重要な出来事" >> "$memory_file" cat /tmp/important-events.txt >> "$memory_file" echo "" >> "$memory_file" fi # 学習したパターンを記録 echo "### 学習したパターン" >> "$memory_file" grep -h "学習" "$workspace/memory"/*.md | tail -10 >> "$memory_file" # クリーンアップ rm -f /tmp/important-events.tx ...[truncated 2224 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:115
Finding: Predictable Shared Temporary File Enables Memory Tampering and Symlink Attacks
Content: View full analysis
> "$memory_file" # 過去7日間の重要な出来事を抽出 for i in {0..6}; do local check_date="$(date -d "$i days ago" -I)" local daily_file="$workspace/memory/$check_date.md" if [[ -f "$daily_file" ]]; then # 高重要度の出来事を抽出 grep -E "🔴|高重要|重要な" "$daily_file" >> /tmp/important-events.txt fi done # 重要な出来事をMEMORY.mdに統合 if [[ -s /tmp/important-events.txt ]]; then echo "### 重要な出来事" >> "$memory_file" cat /tmp/important-events.txt >> "$memory_file" echo "" >> "$memory_file" fi # 学習したパターンを記録 echo "### 学習したパターン" >> "$memory_file" grep -h "学習" "$workspace/memory"/*.md | tail -10 >> "$memory_file" # クリーンアップ rm -f /tmp/important-events.txt echo "週次キュレーション完了" } ``` ### Technical Analysis The curation function uses the fixed, globally predictable path `/tmp/important-events.txt`. It neither creates the file atomically nor verifies that it is a regular file owned by the expected account. The first operation uses append mode, so stale content from a previous run is retained and subsequently imported. On a multi-user system, another local process can create this path before the scheduled task runs. The path can contain attacker-controlled content or be a symbolic link. Shell redirection follows symbolic links, so the curation process may append data to another file writable by its account. The process later reads the same path and copies its contents into long-term memory. ### Attack Path 1. A loc ...[truncated 1144 chars]
Remediation: View remediation
> "$tmp_file" fi done if [[ -s "$tmp_file" ]]; then cat -- "$tmp_file" >> "$memory_file" fi ``` Additionally: 1. Avoid shared fixed names in world-writable directories. 2. Set a restrictive `umask`, such as `umask 077`, before creating temporary data. 3. Do not use append mode on data inherited from a previous run. 4. Reject non-regular files when operating on persistent paths. 5. Use process locking if concurrent curation runs are possible. 6. Prefer a private runtime directory owned by the service account where feasible. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:160
Finding: Untrusted Search Terms Can Be Interpreted as grep Options
Content: View full analysis
/dev/null)" if [[ -n "$matches" ]]; then echo "### $check_date" grep -n -i -C 2 "$query" "$daily_file" | head -10 echo "" fi fi done # 関連キーワード提案 echo "## 関連キーワード候補" grep -h -i "$query" "$workspace/MEMORY.md" "$workspace/memory"/*.md 2>/dev/null \ | tr ' ' '\n' | grep -v '^$' | sort | uniq -c | sort -nr | head -5 } ``` ### Technical Analysis Although `query` is quoted against shell word splitting, it is positioned where `grep` continues to recognize command-line options. A value beginning with `-` can therefore be interpreted as a `grep` option instead of a search pattern. The `context_lines` argument is also not validated as a bounded integer before being passed to `grep -C`. These issues do not constitute shell command injection because shell metacharacters inside the quoted variables are not re-evaluated. They do, however, permit argument-level manipulation of the invoked utility. ### Attack Path 1. An attacker controls or influences the query passed to `smart_memory_search`. 2. The attacker sup ...[truncated 895 chars]
Remediation: View remediation
20 )); then echo "Invalid context line count" >&2 return 2 fi ``` If the function is intended to perform literal-text searches rather than regular-expression searches, add `-F`: ```bash grep -F -n -i -C "$context_lines" -- "$query" "$workspace/MEMORY.md" ``` Apply the same `--` separator and validation rules to `contextual_search`, where caller-provided keywords are combined into an extended regular expression. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
grep -h "学習" "$workspace/memory"/*.md | tail -10 >> "$memory_file" # クリーンアップ rm -f /tmp/important-events.txt echo "週次キュレーション完了" }

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The natural-language content, including the description, headings, instructions, and examples, is presented only in Japanese. That can violate language/locale policy when no user opt-in or justification is provided for restricting the skill to a specific language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file documents multiple file-system modifying behaviors, including creating daily logs, appending to MEMORY.md, moving monthly files into an archive, and deleting temporary files. Although the code snippets print status messages, the markdown description does not clearly warn users that adopting these patterns will automatically alter persistent data and run via cron.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest and document describe patterns for persistent agent memory management, including daily files, long-term memory, search, and curation. The statement at L438 about trading knowledge on agent-state backup strategy is unrelated to implementing or documenting a memory architecture pattern and introduces an unjustified capability/purpose signal outside the declared scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.