Security audit

曙光记忆系统

Security checks across malware telemetry and agentic risk

Overview

This is a persistent local memory skill, but it saves broad user and agent information long term without clear consent, scoping, or accurate storage documentation.

Install only if you deliberately want a local long-term memory system. Before enabling it, require explicit confirmation before saving memories, avoid secrets or regulated data, prefer project/user-specific scopes over the global default, and periodically inspect/delete the generated memory files under the OpenClaw workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly describes local file read/write capabilities and persistent storage behavior, but it does not declare any permissions or present guardrails for those capabilities. Undeclared file access is dangerous because it can surprise the host environment, bypass policy expectations, and enable silent persistence of user data beyond what users or operators intended.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented behavior does not match the analyzed implementation details: the advertised five-layer memory, WAL semantics, and archive flow are overstated relative to the actual storage behavior. This mismatch is security-relevant because operators may approve the skill under false assumptions, while the real implementation writes additional files and retains data in ways not accurately disclosed.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The manifest promises automatic archival, but cleanup permanently deletes memories once decay thresholds are met. In a memory system handling persistent user data, this can cause silent data loss and undermine retention/integrity guarantees users or dependent agents may rely on.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger condition is broad enough to match common conversational needs like remembering preferences or recalling prior context, which can cause the skill to activate unexpectedly. In a persistence-oriented skill, accidental activation is risky because it may lead to unprompted collection and storage of user information across sessions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the system to persist user preferences, decisions, and other potentially sensitive information to local files without any warning about retention, sensitivity, or consent. This is dangerous because it can result in silent long-term storage of personal or behavioral data, increasing privacy, compliance, and data exposure risk if the files are later accessed or exfiltrated.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The engine persistently stores arbitrary text under a user-home workspace path without any consent flow, minimization, or retention warning. In a memory skill specifically designed for cross-session recall, this materially increases the risk of retaining secrets, personal data, and sensitive conversation content beyond user expectations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Error and learning logs append raw context, errors, attempted solutions, and insights to persistent markdown files. These fields can easily contain API keys, personal information, internal prompts, or confidential workflow details, and the logging is automatic with no sanitization or user awareness.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The instruction to write broadly scoped user-provided information to storage before replying creates a default behavior of immediate persistence without validation or consent. This is especially dangerous in a memory skill because transient, mistaken, or sensitive inputs may be permanently recorded before the user can correct them, amplifying privacy and integrity risks.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The examples and category schema encourage durable storage of user preferences, identity-like facts, and decision history, all of which can become sensitive profile data over time. In this skill's context, long-term memory is the core function, so broad category guidance materially increases the chance of over-collection and retention of personal data.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The governance design explicitly encourages broad retention and reuse of user-provided content in learning and memory artifacts. In a persistent-memory skill, such generalized collection expands the attack surface for privacy leakage, prompt data retention, and unintended cross-session reuse of sensitive information.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The error logging flow is designed to record full interaction context and attempted solutions, which are common carriers of secrets, private data, and internal system details. Persisting this by default creates a durable leakage channel and can also preserve unsafe prompts or proprietary content for later retrieval.

Ssd 3

High

Confidence: 98% confidence
Finding: `wal_sync` and related routines funnel arbitrary content directly into persistent global memory and learning logs with elevated importance, making later retrieval likely. In this skill's context—cross-session persistent memory—that means sensitive user content, corrections, or operational details can be durably retained and resurfaced outside the original interaction context.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.