TalonForge Memory System (EN/AR)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:02 AM UTC
• Version: 1.0.0

Overview

This skill openly sets up an AI memory system, but it also creates a recurring unattended job that reviews conversations and stores long-term user facts without clear limits or removal guidance.

Install only if you want an ongoing local memory system that automatically reviews conversations and keeps long-term notes. Before enabling the nightly cron, confirm where MEMORY.md and memory/ will live, what conversations it can review, how to inspect or remove the cron job, and how to delete or correct stored facts.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Warning

• Location: SKILL.md:56

Finding

Persistent Nightly Conversation-Extraction Task

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:56-64
Vulnerability Type: Persistent scheduled task
Risk Level: Medium

Vulnerable Code

bash

### Nightly Extraction Cron

```bash
openclaw cron add \
  --name "nightly-extraction" \
  --cron "0 23 * * *" \
  --tz "[YOUR_TIMEZONE]" \
  --session isolated \
  --message "Review today's conversations. Extract durable facts (relationships, decisions, status changes, milestones). Skip small talk. Update memory/YYYY-MM-DD.md with timeline. Update MEMORY.md with new patterns or preferences." \
  --announce

text

### Technical Analysis

The Skill directs the Agent to install an OpenClaw scheduled task that remains active after the initial setup operation. At 11:00 p.m. each day, the task launches an isolated Agent session, reviews conversation information, and modifies persistent memory files.

This creates cross-session persistence through a scheduled task. Although the behavior is documented as part of the Skill's intended functionality, the instructions do not provide a retention limit, a consent-renewal mechanism, a command to disable or remove the task, or a requirement to confirm individual writes. The isolated session does not eliminate the persistence risk because it is still instructed to access conversation information and update files automatically.

### Attack Path

1. A user installs the Skill and asks the Agent to set up the memory system.
2. The Agent executes the documented `openclaw cron add` command using its existing permissions.
3. OpenClaw registers `nightly-extraction` as a recurring scheduled task.
4. At 11:00 p.m. each day, the task starts an unattended Agent session.
5. The session reviews available conversations and writes extracted information into `memory/YYYY-MM-DD.md` and `MEMORY.md`.
6. The processing and persistent file modifications continue across sessions until the task is explicitly removed.

### Impact Assess
...[truncated 620 chars]

Remediation

View remediation

Remediation Suggestions

• Make conversation extraction manual by default and require explicit informed consent before creating any recurring task.
• Display the exact schedule, information sources, destination files, and retention behavior before installation.
• Require confirmation before promoting extracted information into long-term memory.
• Apply data minimization and configurable retention limits to daily notes and long-term memory.
• Restrict the scheduled session to the minimum required files and conversation scope.
• Provide documented commands to inspect, pause, and permanently remove the scheduled task.
• Add an installation receipt that identifies the task name and records the user's consent.
• Prefer a staged workflow in which proposed memory changes are presented for approval rather than written automatically.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:63

Finding

Unvalidated Conversation Content Promoted to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63-72
Vulnerability Type: Persistent memory poisoning
Risk Level: Medium

Vulnerable Code

markdown

  --message "Review today's conversations. Extract durable facts (relationships, decisions, status changes, milestones). Skip small talk. Update memory/YYYY-MM-DD.md with timeline. Update MEMORY.md with new patterns or preferences." \
  --announce

Memory Rules

1. If it matters, WRITE IT DOWN. Mental notes don't survive sessions.
2. Never delete facts — supersede them instead.
3. Update MEMORY.md when you notice new patterns about your user.
4. Daily notes are raw logs. MEMORY.md is curated wisdom.
5. Review and clean MEMORY.md weekly.

text

### Technical Analysis

The extraction prompt treats conversation-derived claims as candidates for durable storage without defining provenance checks, trust boundaries, confidence levels, conflict resolution, or user approval. Conversation content can originate from mistaken statements, untrusted participants, copied material, or prompt-injection text.

The instruction to update `MEMORY.md` with patterns and preferences permits unvalidated content to affect persistent Agent state. The rule stating that facts should never be deleted further increases persistence by discouraging complete removal of false or malicious entries. Because the supplied `MEMORY.md` template includes sections such as working style, preferences, and hard rules, poisoned entries may influence decisions in later sessions.

### Attack Path

1. An attacker or untrusted content source introduces a false claim, preference, decision, or behavioral instruction into a conversation available to the Agent.
2. The nightly extraction task reviews that conversation.
3. The Agent interprets the content as a durable fact, pattern, or preference because no source-validation or approval process is required.
4. The Agent writes the extracted content in
...[truncated 769 chars]

Remediation

View remediation

Remediation Suggestions

• Treat all conversation text as untrusted input and never execute instructions found inside material being summarized.
• Require explicit user confirmation before promoting an extracted item into long-term memory.
• Store provenance for every entry, including source conversation, timestamp, author, confidence level, and approval status.
• Separate factual notes from preferences, behavioral rules, and authorization decisions.
• Prohibit automatically generated content from modifying “Hard Rules” or equivalent high-authority memory sections.
• Detect and quarantine imperative text, embedded prompts, authorization claims, and content requesting persistent behavioral changes.
• Implement conflict detection and present contradictory claims to the user for resolution.
• Replace the “never delete facts” rule with a correction policy that supports deletion, revocation, version history, and audit logging.
• Use an approval queue so extraction produces proposed changes rather than directly modifying trusted memory.
• Ensure future sessions distinguish verified user-approved memory from unverified daily notes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation phrase "Set up the memory system" is broad and directly triggers multi-step side effects including file creation and scheduled task installation. Because it lacks explicit scope constraints or a confirmation boundary, a user may invoke persistent system changes without understanding the full extent of what will happen.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes automatic setup behavior that creates files, a directory, and a nightly cron job, but does not present a clear user warning or consent checkpoint before making persistent changes. This is dangerous because scheduled execution and data persistence can outlive the immediate session and surprise users with ongoing collection or modification of local data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the AI to extract conversation-derived facts, relationships, decisions, status changes, and preferences into long-term files. This creates a real data retention risk because personal or sensitive information may be persistently stored in natural language without minimization, access controls, or a retention policy.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The memory rules encourage continuous observation, broad recording, and effectively indefinite retention of user facts and behavioral patterns, including a rule to never delete facts. In context, this increases the risk of over-collection, stale or incorrect profiling, and accidental disclosure of accumulated personal information over time.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.