Back to skill

Security audit

๐Ÿฉบ memory-health-check

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory diagnostic tool, but its repair mode can permanently delete local memory files without the confirmation its docs imply.

Install only if you are comfortable with a tool reading your OpenClaw memory files and databases. Avoid running --auto-repair or --remove-orphans unless you have a backup and have previewed exactly what will be removed, because the current implementation can delete memory files permanently without an interactive confirmation or restore path.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 ยท Insecure Skill Coding Practices

Warning
Location
scripts/auto_repair.py:65
Finding

Auto-Repair Permanently Deletes Memory Files Without Enforcing Confirmation or Configured Safety Controls

Content
View full analysis
dict: """Remove orphaned entries and temp files (user-approved).""" if verbose: logger.setLevel(logging.DEBUG) if not MEMORY_DIR.exists(): logger.warning("memory directory not found") return {"repaired": [], "errors": [], "summary": "No memory directory found"} repaired = [] errors = [] # .DS_Store cleanup if remove_ds_store: for f in get_ds_store_files(MEMORY_DIR): if dry_run: logger.info(f"[dry-run] Would remove .DS_Store: {f}") repaired.append(f"[dry-run] Remove: {f}") else: try: f.unlink() repaired.append(f"Removed .DS_Store: {f}") logger.info(f"Removed: {f}") except Exception as e: errors.append(f"Failed to remove {f}: {e}") logger.error(f"Failed: {f}: {e}") # Empty file cleanup if remove_empty: for f in get_empty_files(MEMORY_DIR): if dry_run: repaired.append(f"[dry-run] Remove empty: {f}") logger.info(f"[dry-run] Would remove empty file: {f}") else: try: f.unlink() repaired.append(f"Removed empty: {f}") logger.info(f"Removed empty file: {f}") except Exception as e: errors.app ...[truncated 4049 chars]
Remediation
View remediation
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The design defines the core coverage taxonomy entirely with Chinese labels, which effectively bakes a specific language choice into a scoring dimension. Because the document does not indicate user opt-in, locale selection, or justification for a China-specific deployment, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest-style configuration specifies knowledge domains and matching keywords primarily in Chinese, which enforces a particular language/locale in the skill's behavior. There is no accompanying note that users can choose another locale or that the skill is region-specific, so this conflicts with the policy requirement to avoid forced language constraints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The design explicitly says the B-layer SQLite schema is 'what we inspect, not modify' and later states 'Never delete from B-layer directly' and 'Only archive, never hard delete.' However, the auto-repair API is documented to accept arbitrary file paths and 'execute auto-repair' by deleting them, with orphan detection covering '.sqlite' and other file types. This creates an intent-level contradiction between the safety claims and the documented repair behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README advertises auto-repair and orphan-removal commands that can delete files or modify memory contents, but it does not clearly warn users about destructive side effects. In an agent skill context, documentation often drives automated or semi-automated execution, so understated destructive behavior increases the risk of unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises an "Auto-repair" feature that performs orphan cleanup, but the documentation does not clearly warn that cleanup may delete data or alter stored state irreversibly. In a memory/database maintenance context, users may enable auto-repair without understanding the destructive consequences, increasing the risk of accidental data loss or corruption if the orphan detection is imperfect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring says 'Integrity scan โ€” DB corruption / checksum checks.', implying both database corruption checks and checksum validation. The code only discovers SQLite databases and runs SQLite integrity-related operations; there is no checksum computation or verification anywhere in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The integrity_scan docstring states that scan_files enables checksum verification as part of a 'full integrity scan across all memory storage'. In the actual code, scan_files is never used and no file checksum or non-database integrity verification logic exists, so the documented behavior materially overstates what the function does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The default knowledge_domains and coverage_keywords values are primarily Chinese-language strings, which imposes a specific locale assumption in the skill's natural-language behavior. The file does not indicate user opt-in, language selection, or region-specific justification for this constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt ยท scripts/generate_report.py (reported line 42)May include surrounding context.

python
"""Run a bin script and parse its JSON output."""
    script_path = SKILL_BIN / script_name
    try:
        result = subprocess.run(
            [sys.executable, str(script_path), "--json"],
            capture_output=True, text=True, timeout=120
        )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The quick reference table uses Chinese field labels while the rest of the document is primarily in English. This creates an implicit language constraint or inconsistency without telling users what language to expect or offering an alternative, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code creates a reports directory and saves a JSON health report under the user's home directory, which is a file-write operation affecting user data. While the script logs the save path after writing, there is no prior warning, confirmation, or docstring/comment disclosing that running the skill will persist data to ~/.openclaw/workspace/memory/health-reports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code file contains multiple natural-language string literals in Chinese (for example at L112, L115, L135-L138, L148-L150) that implicitly force a specific language context for test data. Under the policy rule, language-specific behavior should either offer user opt-in/choice or be clearly justified as locale-specific; that justification is not present in this file.

Content

No source excerpt is available for this finding.