nix-memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:42 AM UTC
• Version: 1.1.0

Overview

The skill’s memory-integrity purpose is coherent, but its installer guidance and quickstart introduce high-impact review concerns around remote shell execution, persistent agent-state changes, and retained copies of private memory files.

Review this before installing. Prefer the local scripts from the reviewed package and do not use the documented curl-to-bash command. Run setup only in a workspace where duplicating identity and memory Markdown files into .nix-memory is acceptable, and inspect or manually edit HEARTBEAT.md if you do not want recurring future execution.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/quickstart.sh:6
• Finding: Unverified Remote Script Execution Through curl-to-Bash Installation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/quickstart.sh:6-8` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash # Usage: # curl -sL https://nixus.pro/memory/install.sh | bash # -- or -- # bash skills/nix-memory/scripts/quickstart.sh ``` ### Technical Analysis The installation instructions recommend piping a response retrieved from `https://nixus.pro/memory/install.sh` directly into Bash. Although this command appears in a comment rather than being automatically executed by the packaged script, it is presented as a supported installation method. The remote installer is not included in the audited project. Its contents, update controls, and relationship to the reviewed scripts therefore cannot be verified. The command provides no version pinning, expected digest, cryptographic signature verification, or opportunity to inspect the downloaded code before execution. This behavior is unnecessary for the declared zero-dependency functionality because the package already contains local setup scripts that can be invoked directly. ### Attack Path 1. A user follows the documented `curl | bash` installation instruction. 2. The remote server, hosting account, DNS resolution, or delivery infrastructure is compromised, or the operator changes the remote installer after this package has been reviewed. 3. The endpoint returns attacker-controlled shell commands. 4. Bash executes the response immediately with the privileges of the invoking user. 5. The payload can read or modify the OpenClaw workspace and any other resources accessible to that user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The potential scope includes: - Reading identity, user, agent, and memory files. - Modifying persistent OpenClaw workspace instructions. - Stealing user-accessible credentials or configuration stored else ...[truncated 361 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl ... | bash` installation instruction. 2. Direct users to execute the installer shipped in the reviewed package: ```bash bash skills/nix-memory/scripts/quickstart.sh ``` 3. If remote distribution is required: - Publish immutable, versioned artifacts. - Require download to a local file rather than piping directly to a shell. - Publish a SHA-256 digest through a separate trusted channel. - Verify the digest or a cryptographic signature before execution. - Display the exact artifact version being installed. 4. Prefer a trusted package registry or signed release mechanism with reproducible source. 5. Document that installers must not be run as root. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:15
• Finding: Plaintext Duplication of Sensitive Identity and Memory Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:15-35` **Vulnerability Type**: Insecure storage of sensitive workspace data **Risk Level**: Medium ### Vulnerable Code ```bash # Identity files to track IDENTITY_FILES=( "SOUL.md" "IDENTITY.md" "USER.md" "AGENTS.md" "MEMORY.md" ) # Hash each identity file echo "" >> "$LOG" echo "Creating identity baselines..." | tee -a "$LOG" HASHED=0 for f in "${IDENTITY_FILES[@]}"; do fpath="${WORKSPACE}/${f}" if [[ -f "$fpath" ]]; then hash=$(sha256sum "$fpath" | cut -d' ' -f1) echo "${hash} ${f}" >> "${BASELINE_DIR}/identity-hashes.txt" # Store full content snapshot for diff later cp "$fpath" "${BASELINE_DIR}/${f}.baseline" echo " [OK] ${f} -> ${hash:0:16}..." | tee -a "$LOG" HASHED=$((HASHED + 1)) else echo " [SKIP] ${f} not found" | tee -a "$LOG" fi done ``` ### Technical Analysis The setup process calculates SHA-256 hashes but also copies the complete contents of `SOUL.md`, `IDENTITY.md`, `USER.md`, `AGENTS.md`, and `MEMORY.md` into `.nix-memory/baselines`. These files can contain personal context, operational instructions, private memory, and agent identity information. No restrictive `umask`, directory mode, or file mode is configured before creating the copies. Their effective permissions therefore depend on the caller's environment and default umask. Full snapshots are useful for textual drift comparisons, but they exceed the minimum storage required for basic integrity verification, which only requires hashes. They also create additional retained copies that may remain after the original content is removed. ### Attack Path 1. A workspace identity or memory file contains sensitive information. 2. The user runs `setup.sh`, directly or through `quickstart.sh` or `continuity-score.sh`. 3. The script copies the complete file into `.nix-memory/baselines`. 4. The copied file receiv ...[truncated 828 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store only cryptographic hashes by default. 2. Make full-content snapshots an explicit, documented opt-in feature. 3. Before creating state files, enforce restrictive permissions: ```bash umask 077 mkdir -p -m 700 "$STATE_DIR" "$BASELINE_DIR" ``` 4. Explicitly set snapshot permissions after creation: ```bash chmod 600 "${BASELINE_DIR}/${f}.baseline" ``` 5. Document what data is copied, how long it is retained, and how users can securely delete it. 6. Consider storing redacted diffs or metadata instead of complete source content. 7. Warn users not to place credentials or authentication tokens in tracked Markdown files. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: scripts/quickstart.sh:224
• Finding: Quickstart Permanently Adds Recurring Commands to Agent Heartbeat State<![CDATA[ ## Vulnerability Details **File Location**: `scripts/quickstart.sh:224-249` **Vulnerability Type**: Persistent modification of agent behavioral state **Risk Level**: Medium ### Vulnerable Code ```bash configure_heartbeat() { step "Configuring HEARTBEAT.md with memory checks..." local HB="${WORKSPACE}/HEARTBEAT.md" # Check if memory section already exists if [[ -f "$HB" ]] && grep -q "Memory Integrity" "$HB" 2>/dev/null; then step "HEARTBEAT.md already has memory checks" return 0 fi local MEMORY_BLOCK=" ## Memory Integrity (every heartbeat) - Run: bash skills/nix-memory/scripts/watch.sh - If NIX_MEMORY_ALERT: run continuity-score.sh and investigate - If NIX_MEMORY_OK: continue normally - Periodically run: bash skills/nix-memory/scripts/drift-detect.sh " if [[ -f "$HB" ]]; then echo "$MEMORY_BLOCK" >> "$HB" step "Appended memory checks to existing HEARTBEAT.md" else echo "# HEARTBEAT.md" > "$HB" echo "$MEMORY_BLOCK" >> "$HB" step "Created HEARTBEAT.md with memory checks" fi } ``` ### Technical Analysis The quickstart installer modifies `HEARTBEAT.md`, a persistent workspace file used to direct future agent behavior. The inserted block instructs future heartbeats to execute Skill scripts repeatedly. Heartbeat integration is related to the advertised functionality and is described in the project documentation. However, the quickstart applies it automatically rather than presenting the exact change and obtaining separate consent. It also provides no managed removal mechanism. This creates recurring execution beyond the initial setup run. If the referenced Skill files are subsequently replaced or compromised, the persistent heartbeat instruction can repeatedly invoke the altered code. ### Attack Path 1. A user runs `scripts/quickstart.sh`. 2. The script appends recurring command instructions to `HEARTBEAT.md`. 3. Future agent sessions load and follow the ...[truncated 928 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make heartbeat integration a separate, explicit opt-in operation. 2. Display the exact block before modifying `HEARTBEAT.md` and require confirmation in interactive use. 3. Support a non-interactive flag such as `--enable-heartbeat` instead of enabling it by default. 4. Surround inserted content with unique managed markers: ```markdown <!-- BEGIN nix-memory managed block --> ... <!-- END nix-memory managed block --> ``` 5. Provide an uninstall or disable command that removes only the managed block. 6. Resolve and verify the referenced script path before adding persistent instructions. 7. Document that heartbeat integration causes recurring execution across future sessions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/quickstart.sh:106
• Finding: Unescaped Workspace and Argument Data Written to JSON and JSONL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/quickstart.sh:106-158,181-189` **Vulnerability Type**: JSON injection and malformed structured-data generation **Risk Level**: Medium ### Vulnerable Code ```bash # Auto-detect identity from workspace files local AGENT_NAME="unknown" local AGENT_HANDLE="@agent" local AGENT_DESC="An AI agent with persistent memory" if [[ -f "${WORKSPACE}/IDENTITY.md" ]]; then AGENT_NAME=$(grep -m1 'Name:' "${WORKSPACE}/IDENTITY.md" | sed 's/.*Name:\*\*//' | sed 's/\*//g' | xargs || echo "unknown") fi if [[ -f "${WORKSPACE}/SOUL.md" ]]; then # Extract first meaningful line - skip comments, headers, empty lines, italics AGENT_DESC=$(grep -v '^#' "${WORKSPACE}/SOUL.md" | grep -v '^$' | grep -v '^\*' | grep -v '^<!--' | grep -v '^\*\*' | head -1 | sed 's/^[- ]*//' || echo "An AI agent") [[ -z "$AGENT_DESC" || "$AGENT_DESC" == *"memory-guard"* ]] && AGENT_DESC="An AI agent with persistent memory" fi cat > "$AGENT_JSON" << CARD { "version": "1.0", "agent": { "name": "${AGENT_NAME}", "handle": "${AGENT_HANDLE}", "description": "${AGENT_DESC}", "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)" }, "owner": { "name": "operator" }, "capabilities": [ "memory-persistence", "identity-verification", "drift-detection" ], "memory": { "architecture": "nix-memory-layer", "tools": ["nix-memory", "memory-guard"], "continuity_scoring": true, "drift_detection": true, "tamper_protection": true }, "trust": { "level": "new", "identity_verified": false, "memory_integrity": "unverified" }, "endpoints": { "card": "/.well-known/agent.json" } } CARD # Also place in .well-known for discovery mkdir -p "$WELLKNOWN" cp "$AGENT_JSON" "${WELLKNOWN}/agent.json" ``` The generated decision logger contains the same class of flaw: ```bash DECISION="${1:?Us ...[truncated 2335 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate JSON with a proper serializer, preferably `jq`: ```bash jq -n \ --arg name "$AGENT_NAME" \ --arg handle "$AGENT_HANDLE" \ --arg description "$AGENT_DESC" \ --arg created "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ '{version:"1.0", agent:{name:$name, handle:$handle, description:$description, created:$created}}' ``` 2. Generate each decision record with `jq -cn --arg` rather than string interpolation. 3. If zero dependencies are mandatory, implement and thoroughly test a JSON-escaping function covering quotes, backslashes, and all control characters. 4. Write output to a temporary file with restrictive permissions, validate it, and atomically move it into place. 5. Validate generated JSON before copying it to `.well-known/agent.json`. 6. Apply reasonable input-length limits to identity descriptions and decision fields. 7. Treat content read from workspace Markdown files as untrusted input. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

External Script Fetching

High

• Category: Supply Chain

Content

# Zero deps. Pure bash. Works everywhere.
#
# Usage:
#   curl -sL https://nixus.pro/memory/install.sh | bash
#   -- or --
#   bash skills/nix-memory/scripts/quickstart.sh
#

• Confidence: 98% confidence
• Finding: The usage instructions recommend fetching a remote script and piping it directly to bash, which enables arbitrary code execution from a network source with no integrity verification. If the remote host, transport, DNS, or upstream content is compromised, users would immediately execute attacker-controlled shell commands.

Chaining Abuse

High

• Category: Tool Misuse

Content

# Zero deps. Pure bash. Works everywhere.
#
# Usage:
#   curl -sL https://nixus.pro/memory/install.sh | bash
#   -- or --
#   bash skills/nix-memory/scripts/quickstart.sh
#

• Confidence: 98% confidence
• Finding: Piping curl output directly into bash removes any opportunity for inspection and turns network-delivered content into immediate command execution. In an installer for agent skills, this is especially dangerous because it normalizes unsafe operator behavior and can lead to full workspace or account compromise if the fetched content is tampered with.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script automatically runs setup.sh when the expected state directory is missing, which can create or modify files in the workspace without explicit user confirmation. In an agent skill context, implicit filesystem-changing behavior increases risk because initialization may occur as a side effect of a read-like health check, and users may not realize execution will mutate their environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

echo "  Last verification: ${LATEST_AGE} hours ago"
        if [[ $LATEST_AGE -gt 48 ]]; then
            SCORE=$((SCORE - 10))
            echo "    WARNING: No verification in ${LATEST_AGE}h - continuity gap"
        fi
    fi
fi

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The header comments describe this script as an installer that sets up the complete memory architecture and list nix-memory and memory-guard among what it installs. In practice, the code only checks whether those skill directories already exist and, if not, emits warnings and continues, so the documented effect of a complete install is contradicted by the actual behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script executes other shell scripts from the workspace (setup.sh and memory-guard.sh) without verifying integrity, origin, or obtaining confirmation. In this context, the workspace is attacker-influenced input, so a malicious or replaced skill script would execute arbitrary code under the user's account during installation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer creates and modifies multiple files in the user's workspace without an approval step, including agent.json, HEARTBEAT.md, and executable helper scripts. In a skill-install context, silent mutation of persistent workspace state is risky because users may run the installer expecting inspection or limited setup, while the script alters future agent behavior and trust-related metadata.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code creates persistent directories and later writes multiple files under the state directory, including logs, manifests, config, and baseline snapshots. Although the script logs what it is doing, it does not provide a user-facing warning before creating persistent local state or copying tracked markdown files into baseline storage.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: This block saves a continuity report to a file under the state directory, which is a filesystem write affecting persistent user or workspace data. The write is visible in code, but there is no preceding comment, header warning, or stronger user-facing notice explaining that running the script will store a report on disk.

Static analysis

No suspicious patterns detected.