Memoria Memory System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:38 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent local memory manager, but its backup and rollback scripts can delete or overwrite broad filesystem paths if configuration or backup names are wrong or abused.

Install only if you are comfortable with local scripts managing persistent memory files. Keep memory and backup paths under a dedicated directory, do not run these scripts as an elevated user, avoid unattended --fix until you understand the writes it can make, and review rollback targets carefully before using --force.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: memory-rollback.sh:14

Finding

Unvalidated storage paths permit destructive filesystem operations

Content

View full analysis

/dev/null || cp -r "$backup_path"/* "$MEMORY_PATH/" fi elif [[ "$backup_path" == *.tar.gz ]]; then # Compressed backup tar -xzf "$backup_path" -C "$(dirname "$MEMORY_PATH")" fi ``` ```bash # memory-backup.sh if [[ -f "$CONFIG_FILE" ]]; then MEMORY_PATH=$(jq -r '.memory.base_path // "./memory"' "$CONFIG_FILE") BACKUP_PATH=$(jq -r '.backup.path // "./backups"' "$CONFIG_FILE") RETENTION_DAYS=$(jq -r '.backup.retention_days // 30' "$CONFIG_FILE") COMPRESSION=$(jq -r '.backup.compression // true' "$CONFIG_FILE") fi ``` ```bash find "$BACKUP_PATH" -name "backup_*" -type d -mtime +$RETENTION_DAYS -exec rm -rf {} + 2>/dev/null || true ``` ### Technical Analysis The scripts read `memory.base_path`, `backup.path`, and `backup.retention_days` from an editable JSON configuration and use those values in recursive deletion operations. The paths are quoted, which prevents shell word splitting and ordinary command injection, but they are not canonicalized or restricted to an approved data directory. In `memory-rollback.sh`, `rm -rf "$MEMORY_PATH"` recursively removes the configured target before restoration. There is no rejection of empty, root-level, home, or unrelated absolute p ...[truncated 1545 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: memory-rollback.sh:48

Finding

Backup traversal and unvalidated archive extraction can overwrite unintended files

Content

View full analysis

/dev/null || cp -r "$backup_path"/* "$MEMORY_PATH/" fi elif [[ "$backup_path" == *.tar.gz ]]; then # Compressed backup tar -xzf "$backup_path" -C "$(dirname "$MEMORY_PATH")" fi ``` ### Technical Analysis The `backup_name` argument is appended directly to `BACKUP_PATH` without a strict filename format or canonical containment check. Values containing `../` can resolve to an archive or directory outside the configured backup directory. The selected archive is then extracted into the parent of `MEMORY_PATH` without validating its members. The script does not inspect archive entries for: - Absolute paths - Parent-directory components - Unsafe symbolic or hard links - Device entries or other special files - Multiple unexpected top-level directories - A required memory-directory layout Archive-tool protections vary by platform an ...[truncated 1548 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-migrate.sh:114

Finding

Unvalidated daily-memory date permits path traversal and file overwrite

Content

View full analysis

"$file_path" << EOF # ${date_str} ## Events - ## Conversations - ## Decisions - ## Learnings - EOF ``` ### Technical Analysis Although the command documentation describes the argument as a date, the implementation accepts any string. The value is inserted directly between the episodic directory and the `.md` suffix. An argument containing slash and parent-directory components can resolve outside `MEMORY_PATH/episodic`. Shell quoting prevents command injection, but it does not prevent filesystem path traversal. The `cat >` redirection creates or truncates the resolved file if its parent directory exists. The existing-file check reduces accidental overwrite of an existing regular file, but it does not provide a security boundary. A traversal value can still create a new Markdown file outside the intended directory, and race conditions or unusual filesystem objects can undermine the check. ### Attack Path 1. An attacker or untrusted caller supplies a value containing traversal components to the `daily` command. 2. For example, a value such as `../../notes` resolves from the episodic directory toward another writable location, with `.md` appended. 3. If the resolved parent directory exists and the target does not already exist, the script writes the daily-memory template there. 4. The attacker causes creation of an unintended file outside the episodic-memory directory. ### Impact Assessment The direct impact is unauthorized creation of a `.md` file at a path writable by the executing account and ...[truncated 411 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

etected issues

• --path PATH - Override memory path

Configuration

Edit config.json to customize behavior:

json

{
  "memory": {
    "base_path": "./memory",
    "structure": { ... }
  },
  "backup": {
    "enabled": true,
    "retention_days": 30,
    "schedule": "0 2 * * *"
  },
  "health_check": {
    "auto_fix": false,
    "check_interval_hours": 24
  }
}

Cron Setup

Add to crontab for automated maintenance:

bash

# Daily backup at 2 AM
0 2 * * * cd /path/to/memoria-system && ./memory-backup.sh

# Weekly health check on Sundays at 3 AM
0 3 * * 0 cd /path/to/memoria-system && ./memory-health-check.sh --fix

Installation

bash

openclaw skill install memoria-system

Requirements

• Bash 4.0+
• jq (for JSON processing)
• tar (for backup compression)

License

MIT

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file instructs users to run initialization, daily creation, backup, and health-check scripts, and later documents rollback and repair capabilities, but provides no warning that these operations may create, modify, restore, or overwrite memory data. For a skill managing persistent memory, omission of user-facing cautions about data integrity and recovery implications is a meaningful safety gap.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The --force option explicitly skips confirmation for rollback, enabling a destructive state restore without an interactive safety check. In the context of memory persistence, that raises the risk of accidental or scripted rollback that discards newer data or restores an unintended backup.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

- `rollback BACKUP_NAME` - Restore to specified backup

**Options:**
- `--force` - Skip confirmation prompt

### memory-health-check.sh
Validates memory integrity and optionally repairs issues.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation advertises rollback and automatic repair capabilities without any explicit warning about possible data loss, overwrite, or corruption risks. In a memory-management skill that operates on persistent user data, encouraging destructive operations without safety guidance increases the chance of accidental harmful use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cron example configures unattended execution of a repair action using --fix with no warning about what files may be modified or how failures are handled. Scheduling autonomous changes to long-term memory data can silently propagate corruption or unintended edits if the script logic is wrong or the environment is misconfigured.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This shell script can create directories and files when AUTO_FIX is enabled, which changes user data on disk. Although the script logs actions after they occur, there is no upfront confirmation prompt or warning comment near the --fix behavior explaining that repair mode will write to the filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

When AUTO_FIX is true, the script writes a new .version file into the target memory path. The action is logged after execution, but the script does not provide advance disclosure that enabling fix mode will alter files in the specified directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script automatically creates index JSON files when they are missing and AUTO_FIX is enabled. This is a filesystem write operation, and while success is logged, there is no prior disclosure or confirmation that the tool will create files in the memory index.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script creates and overwrites multiple memory files that are explicitly intended to store personal information, events, conversations, and other sensitive context, but it does so without prompting the user, checking for an existing initialized structure, or providing a clear warning about overwrite behavior. In an agent-skill context, this is risky because a user may run the script expecting a safe migration and instead silently create or replace sensitive memory artifacts in a configurable path.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · memory-rollback.sh (reported line 129)May include surrounding context.

sh

echo "  rollback BACKUP_NAME    Rollback to specified backup"
        echo ""
        echo "Options:"
        echo "  --force                 Skip confirmation prompt"
        exit 1
        ;;
esac

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language documentation is presented entirely in Chinese, with no indication that the skill is region-specific or that alternative language support is available. This can constitute a language/locale policy issue because the skill imposes a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The top-level documentation describes the script as validating memory integrity and repairing issues, which implies repair is part of its behavior. In practice, write/repair actions only occur when AUTO_FIX is enabled, and several detected issues are never repaired at all, so the comment overstates what the code does.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest is in scope for vague-trigger review, and the description presents the skill as a general-purpose long-term memory management system without any explicit activation conditions, boundaries, or negative examples. That broad wording could overlap with many common memory- or knowledge-related requests, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.