ClawHub
Back to skill

Security audit

Procedural Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent, but it gives the agent broad memory, backup, cleanup, and self-modification authority beyond a normal workflow-memory feature.

Install only if you intentionally want cross-session procedural memory and are comfortable reviewing generated skills. Avoid using it around secrets, credentials, private business workflows, or regulated data, and disable or remove the autonomous backup, cleanup, external research, and startup/self-improvement maintenance instructions unless you explicitly need them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file defines a broad autonomous-operation policy that materially exceeds the declared purpose of a procedural-memory skill, which should be limited to saving successful workflows as reusable skills. Granting the agent permission to act after 30 minutes of user silence creates an implicit standing authorization for unrelated maintenance, self-modification, and data-handling actions, increasing the chance of unintended or unsafe behavior.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Allowing autonomous external information gathering and collection of new skill information is unrelated to procedural memory and expands the agent's authority into network-facing and potentially untrusted inputs. In the context of a self-evolving skill system, this can introduce prompt injection, unreviewed capability expansion, and privacy or policy violations.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The SOP authorizes updates to corrections, heartbeat state, and self-improving indexes, which are broader agent-state and self-modification artifacts rather than procedural-memory outputs. Even if intended for maintenance, these actions let the skill alter operational context and future behavior without clear user approval or review.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The title and framing present this as a general autonomous-operation SOP, which conflicts with the manifest's narrower description of when the skill should trigger and what it should do. This mismatch is dangerous because agents and reviewers may rely on the benign manifest while the file quietly expands authority to perform unrelated autonomous actions.

Vague Triggers

High
Confidence
92% confidence
Finding
The skill description and trigger model encourage broad, proactive activation based on loosely defined success conditions rather than narrowly scoped user intent. In an agentic environment, this can cause the skill to run in contexts where the user did not clearly consent to memory formation, increasing privacy and policy-bypass risk.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The proactive review trigger includes vague invocation conditions such as end-of-day or a generic 'review', which can be interpreted too broadly by an autonomous agent. That ambiguity increases the chance of unsolicited scanning, summarization, and persistence of user interactions.

Vague Triggers

Medium
Confidence
88% confidence
Finding
Auto-triggering on repeated workflow success without tight scope or exclusions lets the agent infer authorization from behavioral patterns rather than explicit consent. This can lead to persistence of workflows derived from sensitive or context-specific conversations that should not be stored.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The SOP permits autonomous file modifications, cleanup, and backup operations without clear user-facing warning, consent, or impact disclosure. These actions can affect data integrity, overwrite important state, or replicate sensitive content, especially because they are triggered merely by user inactivity rather than explicit authorization.

Ssd 3

Medium
Confidence
95% confidence
Finding
This section explicitly permits auto-creating a skill without asking after repeated success, meaning conversation-derived content can be persisted to disk without explicit user consent. That creates a real semantic data-retention risk because workflows, summaries, and embedded references may include secrets, personal data, or confidential business context.

Ssd 3

Medium
Confidence
96% confidence
Finding
The skill instructs scanning conversation history to identify reusable workflows and storing summaries on disk, which creates durable retention of user-derived semantic content beyond the original session. Even if logs avoid raw transcripts, summarized workflows can still leak sensitive intents, internal processes, credentials, or regulated information.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- ✅ Not one-time / context-specific
- ✅ User would benefit

**Auto-trigger:** If the same workflow succeeds 3+ times, auto-create skill WITHOUT asking (记录到日志即可)。

Otherwise: ask user "我可以把这个 workflow 存为 skill 吗？"
Confidence
93% confidence
Finding
The instruction to auto-create a skill 'WITHOUT asking' authorizes autonomous state-changing behavior based on the agent's own judgment rather than explicit user approval. In this context, autonomy is risky because it directly triggers persistence and changes future agent behavior.

Session Persistence

Medium
Category
Rogue Agent
Content
## Directory Prerequisites

```bash
mkdir -p ~/self-improving
mkdir -p ~/.openclaw/workspace/skills
```
Confidence
91% confidence
Finding
Automatically creating persistent directories and a log file establishes a durable storage channel for conversation-derived data across sessions. In combination with broad triggers and history scanning, this increases privacy exposure and the blast radius of any sensitive content inadvertently captured.

Session Persistence

Medium
Category
Rogue Agent
Content
**Limitations**: [when NOT to use]
```

### Step 4 — Create Skill File

Create `~/.openclaw/workspace/skills/[skill-name]/SKILL.md`:
Confidence
94% confidence
Finding
Creating reusable skill files from prior conversations causes cross-session persistence of derived user data and agent behavior. This is risky here because the stored content can influence future actions and may embed sensitive operational knowledge that outlives the original context.

Static analysis

No suspicious patterns detected.