Memory Transfer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:03 AM UTC
• Version: 2.1.1

Overview

This skill is a local memory-transfer utility, but it overstates its privacy protections and can modify persistent agent memory with weak path scoping.

Install only if you are comfortable manually controlling local memory movement between trusted same-user OpenClaw agents. Use dry-run first, inspect the source memory files for secrets or private context, avoid untrusted agent IDs or path-like values, and assume transfers are verbatim replacements rather than filtered sharing or safe merges.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: memory-transfer.js:20

Finding

Unvalidated Agent IDs Permit Workspace Path Traversal

Content

View full analysis

Vulnerability Details

File Location: memory-transfer.js, lines 20-35
Vulnerability Type: Filesystem path traversal and workspace-boundary bypass
Risk Level: High

Vulnerable Code

js

function getWorkspacePath(agentId) {
  // Check if it's a known agent
  const workspaceName = AGENT_WORKSPACES[agentId];
  if (workspaceName) {
    return path.join(WORKSPACE_BASE, workspaceName);
  }
  
  // Try to find workspace
  const workspacePath = path.join(WORKSPACE_BASE, `workspace-${agentId}`);
  if (fs.existsSync(workspacePath)) {
    return workspacePath;
  }
  
  // Direct path
  return path.join(WORKSPACE_BASE, agentId);
}

The resulting target path is subsequently used for destructive filesystem operations:

js

if (fs.existsSync(targetPath)) {
  const backupPath = targetPath + '.backup';
  fs.renameSync(targetPath, backupPath);
  console.log(`   ⚠️ Backed up existing: ${m.name} → ${m.name}.backup`);
}

// Copy file
fs.copyFileSync(m.path, targetPath);

Technical Analysis

The sourceId and targetId command-line arguments reach getWorkspacePath() without validation. An unrecognized ID is incorporated into a path using path.join(). Inputs containing traversal components such as ../ can normalize to locations outside /home/node/.openclaw.

The implementation checks only whether the resulting path exists. It does not use path.resolve() or fs.realpathSync() to verify that the canonical path remains inside the permitted workspace base. It also does not reject symbolic links. Consequently, the same problem affects both source and target workspaces:

• A crafted source ID can make the program inspect and copy qualifying files from an unintended directory.
• A crafted target ID can make the program rename and replace MEMORY.md or files under a memory directory outside an authorized agent workspace.
• A symlinked workspace or memory directory can ...[truncated 1663 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an explicit allowlist and reject any agent ID not present in AGENT_WORKSPACES.

2. If dynamic IDs are required, enforce a restrictive identifier pattern such as ^[A-Za-z0-9_-]+$ and reject dots, slashes, backslashes, absolute paths, and empty values.

3. Resolve and canonicalize every workspace path before use:

   js

   const base = fs.realpathSync(WORKSPACE_BASE);
   const candidate = path.resolve(base, `workspace-${agentId}`);
   const canonical = fs.realpathSync(candidate);
   
   if (canonical !== base &&
       !canonical.startsWith(base + path.sep)) {
     throw new Error('Workspace path escapes the permitted base');
   }
   

4. Repeat containment validation for the final source file, target directory, and target file rather than checking only the workspace path.

5. Reject symbolic links for workspaces, memory directories, and destination files, or safely open files using platform facilities that prevent symlink following.

6. Avoid check-then-use races by using safe file descriptors and exclusive creation semantics where possible.

7. Run the utility under a dedicated, least-privileged account that can access only approved OpenClaw workspaces.

8. Add tests covering ../, absolute paths, nested traversal, alternate separators, symlink escapes, and traversal attempts in both source and target IDs.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:3

Finding

Advertised Privacy Filtering Is Absent and Memory Is Copied Verbatim

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 3; memory-transfer.js, lines 148-153
Vulnerability Type: Missing privacy controls and misleading security behavior
Risk Level: Medium

Vulnerable Code

The skill metadata promises privacy filtering and agent-identity adaptation:

yaml

description: Transfer memory between OpenClaw agents with advanced features: topic-specific filtering, user info privacy protection, and intelligent agent identity adaptation. Use when: (1) Migrating context between agents, (2) Sharing knowledge without leaking user personal info, (3) Backing up agent memory. Supports share mode (filters user data + adapts to target agent) and clone mode (verbatim copy).

However, the implementation always performs a direct file copy:

js

if (fs.existsSync(targetPath)) {
  const backupPath = targetPath + '.backup';
  fs.renameSync(targetPath, backupPath);
  console.log(`   ⚠️ Backed up existing: ${m.name} → ${m.name}.backup`);
}

// Copy file
fs.copyFileSync(m.path, targetPath);
console.log(`   ✅ Copied: ${m.name}`);
transferred++;

Technical Analysis

No share-mode or clone-mode argument is implemented. The program contains no topic-specific selection, personal-information redaction, secret detection, content transformation, or agent-identity adaptation. It selects entire memory files and copies their bytes directly with fs.copyFileSync().

The documentation also states that memory can optionally be merged, but the implementation instead renames an existing destination file to a .backup file and replaces it. The security-relevant discrepancy is that users may rely on promised privacy protection which is not present.

Because memory files can contain personal data, credentials, private conversation details, project information, or identity-specific instructions, a transfer conducted under the assumption of share-mode filtering can expose the complete sourc ...[truncated 1340 chars]

Remediation

View remediation

Remediation Suggestions

1. Until privacy controls exist, remove all claims of filtering, privacy protection, identity adaptation, and merge support from SKILL.md.
2. Implement explicit, mutually exclusive share and clone modes. Do not infer the less safe mode silently.
3. Make share mode the default and require explicit confirmation before any verbatim clone.
4. Parse and transform memory content before writing it in share mode. Define concrete rules for removing personal identifiers, credentials, tokens, contact details, private conversation content, and source-agent identity instructions.
5. Use fail-closed behavior: if content cannot be parsed or classified safely, stop the transfer rather than copying it unchanged.
6. Generate a preview of the exact transformed content and list all redactions before obtaining user approval.
7. Clearly warn that automated redaction may be incomplete and provide a manual review step.
8. Implement identity adaptation using an explicit, documented transformation policy rather than unconstrained text replacement.
9. Add automated tests containing representative personal information, secrets, identity-specific instructions, malformed content, and false-positive cases.
10. If merge functionality is retained in the documentation, implement conflict-aware merging and preserve existing data safely; otherwise, document the actual backup-and-replace behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly enables copying and merging agent memory across workspaces, including backup and migration use cases, but does not present a clear warning that this can transfer sensitive user data, secrets, or prior conversation context between agents. Because the documented paths and commands make cross-workspace access straightforward, operators may use it in unsafe contexts and unintentionally violate data-minimization or privacy boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool accepts arbitrary agent IDs and resolves them into filesystem paths under the base directory, including a fallback that directly joins unvalidated user input. This exceeds the stated purpose of transferring memory between known agents and can enable unauthorized access to other directories, especially if path traversal segments or unexpected workspace names are supplied.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The transfer operation modifies target agent data by renaming existing files to .backup and copying new content without an explicit confirmation prompt or safety guard. In a multi-agent memory context, this can silently overwrite important state, corrupt workflows, or import untrusted memory into another agent, making the skill context more dangerous than a normal file copy helper.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The inline documentation suggests operations are based on a fixed set of known agent workspaces, but getWorkspacePath subsequently searches for any 'workspace-' directory and finally accepts a direct path component under the base directory. That documentation creates a misleading impression of a constrained target set while the implementation is intentionally broader.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.