Memoria Memory System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:38 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent local memory manager, but its backup and rollback scripts can delete or overwrite broad filesystem paths if configuration or backup names are wrong or abused.

Install only if you are comfortable with local scripts managing persistent memory files. Keep memory and backup paths under a dedicated directory, do not run these scripts as an elevated user, avoid unattended --fix until you understand the writes it can make, and review rollback targets carefully before using --force.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: memory-rollback.sh:14
• Finding: Unvalidated storage paths permit destructive filesystem operations<![CDATA[ ## Vulnerability Details **File Location**: `memory-rollback.sh:14-17, 93-110`; `memory-backup.sh:14-19, 96` **Vulnerability Type**: Unrestricted filesystem path usage **Risk Level**: High ### Vulnerable Code ```bash # memory-rollback.sh if [[ -f "$CONFIG_FILE" ]]; then MEMORY_PATH=$(jq -r '.memory.base_path // "./memory"' "$CONFIG_FILE") BACKUP_PATH=$(jq -r '.backup.path // "./backups"' "$CONFIG_FILE") fi ``` ```bash # memory-rollback.sh # Perform rollback rm -rf "$MEMORY_PATH" mkdir -p "$MEMORY_PATH" if [[ -d "$backup_path" ]]; then # Directory backup if [[ -f "$backup_path/memory.tar.gz" ]]; then tar -xzf "$backup_path/memory.tar.gz" -C "$(dirname "$MEMORY_PATH")" else cp -r "$backup_path/memory"/* "$MEMORY_PATH/" 2>/dev/null || cp -r "$backup_path"/* "$MEMORY_PATH/" fi elif [[ "$backup_path" == *.tar.gz ]]; then # Compressed backup tar -xzf "$backup_path" -C "$(dirname "$MEMORY_PATH")" fi ``` ```bash # memory-backup.sh if [[ -f "$CONFIG_FILE" ]]; then MEMORY_PATH=$(jq -r '.memory.base_path // "./memory"' "$CONFIG_FILE") BACKUP_PATH=$(jq -r '.backup.path // "./backups"' "$CONFIG_FILE") RETENTION_DAYS=$(jq -r '.backup.retention_days // 30' "$CONFIG_FILE") COMPRESSION=$(jq -r '.backup.compression // true' "$CONFIG_FILE") fi ``` ```bash find "$BACKUP_PATH" -name "backup_*" -type d -mtime +$RETENTION_DAYS -exec rm -rf {} + 2>/dev/null || true ``` ### Technical Analysis The scripts read `memory.base_path`, `backup.path`, and `backup.retention_days` from an editable JSON configuration and use those values in recursive deletion operations. The paths are quoted, which prevents shell word splitting and ordinary command injection, but they are not canonicalized or restricted to an approved data directory. In `memory-rollback.sh`, `rm -rf "$MEMORY_PATH"` recursively removes the configured target before restoration. There is no rejection of empty, root-level, home, or unrelated absolute p ...[truncated 1545 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve configured paths with `realpath -m` before any operation. 2. Define an explicit approved data root and verify that both memory and backup paths remain beneath it. 3. Reject empty paths, `/`, the user's home directory, the project root, and other protected locations. 4. Place a dedicated ownership marker in initialized memory directories and refuse recursive deletion unless the marker is present and valid. 5. Validate `retention_days` against a strict bounded integer expression, such as `^[0-9]+$`, and enforce a reasonable maximum. 6. Print the canonical deletion target and require confirmation for destructive operations unless operating under an explicitly configured unattended policy. 7. Prefer renaming the current memory directory to a temporary recovery location and deleting it only after restoration succeeds. 8. Run scheduled maintenance under a dedicated, unprivileged account with access limited to the intended memory and backup directories. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: memory-rollback.sh:48
• Finding: Backup traversal and unvalidated archive extraction can overwrite unintended files<![CDATA[ ## Vulnerability Details **File Location**: `memory-rollback.sh:48-68, 101-110` **Vulnerability Type**: Path traversal and unsafe archive extraction **Risk Level**: High ### Vulnerable Code ```bash rollback() { local backup_name="$1" local force="${2:-false}" if [[ -z "$backup_name" ]]; then echo "❌ Error: Backup name required" list_backups exit 1 fi # Find backup local backup_path="" if [[ -d "$BACKUP_PATH/$backup_name" ]]; then backup_path="$BACKUP_PATH/$backup_name" elif [[ -f "$BACKUP_PATH/${backup_name}.tar.gz" ]]; then backup_path="$BACKUP_PATH/${backup_name}.tar.gz" elif [[ -f "$BACKUP_PATH/$backup_name" ]]; then backup_path="$BACKUP_PATH/$backup_name" else echo "❌ Error: Backup not found: $backup_name" list_backups exit 1 fi ``` ```bash if [[ -d "$backup_path" ]]; then # Directory backup if [[ -f "$backup_path/memory.tar.gz" ]]; then tar -xzf "$backup_path/memory.tar.gz" -C "$(dirname "$MEMORY_PATH")" else cp -r "$backup_path/memory"/* "$MEMORY_PATH/" 2>/dev/null || cp -r "$backup_path"/* "$MEMORY_PATH/" fi elif [[ "$backup_path" == *.tar.gz ]]; then # Compressed backup tar -xzf "$backup_path" -C "$(dirname "$MEMORY_PATH")" fi ``` ### Technical Analysis The `backup_name` argument is appended directly to `BACKUP_PATH` without a strict filename format or canonical containment check. Values containing `../` can resolve to an archive or directory outside the configured backup directory. The selected archive is then extracted into the parent of `MEMORY_PATH` without validating its members. The script does not inspect archive entries for: - Absolute paths - Parent-directory components - Unsafe symbolic or hard links - Device entries or other special files - Multiple unexpected top-level directories - A required memory-directory layout Archive-tool protections vary by platform an ...[truncated 1548 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict backup names to the generated format, for example: ```bash [[ "$backup_name" =~ ^backup_[0-9]{8}_[0-9]{6}$ ]] || exit 1 ``` 2. Canonicalize both the backup root and selected backup and verify that the selected path remains beneath the backup root. 3. Reject symbolic links when selecting backup directories and archives. 4. List archive members before extraction and reject absolute paths, `..` components, special files, unsafe links, and unexpected top-level entries. 5. Extract into a newly created temporary directory beneath a trusted root. 6. Validate the extracted structure, file types, ownership expectations, and required top-level memory directory. 7. Atomically replace the current memory directory only after extraction and validation succeed. 8. Preserve the current memory directory until the replacement has been fully verified. 9. Apply restrictive permissions and avoid executing rollback with elevated privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-migrate.sh:114
• Finding: Unvalidated daily-memory date permits path traversal and file overwrite<![CDATA[ ## Vulnerability Details **File Location**: `memory-migrate.sh:114-127` **Vulnerability Type**: Path traversal through an unvalidated filename **Risk Level**: Medium ### Vulnerable Code ```bash create_daily() { local date_str="${1:-$(date +%Y-%m-%d)}" local file_path="$MEMORY_PATH/episodic/${date_str}.md" if [[ -f "$file_path" ]]; then echo "⚠️ Daily file already exists: $file_path" return 0 fi cat > "$file_path" << EOF # ${date_str} ## Events - ## Conversations - ## Decisions - ## Learnings - EOF ``` ### Technical Analysis Although the command documentation describes the argument as a date, the implementation accepts any string. The value is inserted directly between the episodic directory and the `.md` suffix. An argument containing slash and parent-directory components can resolve outside `MEMORY_PATH/episodic`. Shell quoting prevents command injection, but it does not prevent filesystem path traversal. The `cat >` redirection creates or truncates the resolved file if its parent directory exists. The existing-file check reduces accidental overwrite of an existing regular file, but it does not provide a security boundary. A traversal value can still create a new Markdown file outside the intended directory, and race conditions or unusual filesystem objects can undermine the check. ### Attack Path 1. An attacker or untrusted caller supplies a value containing traversal components to the `daily` command. 2. For example, a value such as `../../notes` resolves from the episodic directory toward another writable location, with `.md` appended. 3. If the resolved parent directory exists and the target does not already exist, the script writes the daily-memory template there. 4. The attacker causes creation of an unintended file outside the episodic-memory directory. ### Impact Assessment The direct impact is unauthorized creation of a `.md` file at a path writable by the executing account and ...[truncated 411 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require the argument to match the documented format: ```bash [[ "$date_str" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || { echo "Invalid date format" exit 1 } ``` 2. Validate that the supplied value represents a real calendar date rather than only matching a pattern. 3. Reject all slash characters, backslashes, control characters, and parent-directory components. 4. Canonicalize the episodic directory and verify that the target's canonical parent is exactly that directory. 5. Open the output with no-clobber semantics or an atomic exclusive-create operation. 6. Ensure the episodic directory is initialized and trusted before creating the file. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

etected issues
- `--path PATH` - Override memory path

## Configuration

Edit `config.json` to customize behavior:

```json
{
  "memory": {
    "base_path": "./memory",
    "structure": { ... }
  },
  "backup": {
    "enabled": true,
    "retention_days": 30,
    "schedule": "0 2 * * *"
  },
  "health_check": {
    "auto_fix": false,
    "check_interval_hours": 24
  }
}
```

## Cron Setup

Add to crontab for automated maintenance:

```bash
# Daily backup at 2 AM
0 2 * * * cd /path/to/memoria-system && ./memory-backup.sh

# Weekly health check on Sundays at 3 AM
0 3 * * 0 cd /path/to/memoria-system && ./memory-health-check.sh --fix
```

## Installation

```bash
openclaw skill install memoria-system
```

## Requirements

- Bash 4.0+
- jq (for JSON processing)
- tar (for backup compression)

## License

MIT

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file instructs users to run initialization, daily creation, backup, and health-check scripts, and later documents rollback and repair capabilities, but provides no warning that these operations may create, modify, restore, or overwrite memory data. For a skill managing persistent memory, omission of user-facing cautions about data integrity and recovery implications is a meaningful safety gap.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- `rollback BACKUP_NAME` - Restore to specified backup

**Options:**
- `--force` - Skip confirmation prompt

### memory-health-check.sh
Validates memory integrity and optionally repairs issues.

• Confidence: 85% confidence
• Finding: The `--force` option explicitly skips confirmation for rollback, enabling a destructive state restore without an interactive safety check. In the context of memory persistence, that raises the risk of accidental or scripted rollback that discards newer data or restores an unintended backup.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation advertises rollback and automatic repair capabilities without any explicit warning about possible data loss, overwrite, or corruption risks. In a memory-management skill that operates on persistent user data, encouraging destructive operations without safety guidance increases the chance of accidental harmful use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cron example configures unattended execution of a repair action using `--fix` with no warning about what files may be modified or how failures are handled. Scheduling autonomous changes to long-term memory data can silently propagate corruption or unintended edits if the script logic is wrong or the environment is misconfigured.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This shell script can create directories and files when AUTO_FIX is enabled, which changes user data on disk. Although the script logs actions after they occur, there is no upfront confirmation prompt or warning comment near the --fix behavior explaining that repair mode will write to the filesystem.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: When AUTO_FIX is true, the script writes a new .version file into the target memory path. The action is logged after execution, but the script does not provide advance disclosure that enabling fix mode will alter files in the specified directory.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script automatically creates index JSON files when they are missing and AUTO_FIX is enabled. This is a filesystem write operation, and while success is logged, there is no prior disclosure or confirmation that the tool will create files in the memory index.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script creates and overwrites multiple memory files that are explicitly intended to store personal information, events, conversations, and other sensitive context, but it does so without prompting the user, checking for an existing initialized structure, or providing a clear warning about overwrite behavior. In an agent-skill context, this is risky because a user may run the script expecting a safe migration and instead silently create or replace sensitive memory artifacts in a configurable path.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

echo "  rollback BACKUP_NAME    Rollback to specified backup"
        echo ""
        echo "Options:"
        echo "  --force                 Skip confirmation prompt"
        exit 1
        ;;
esac

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language documentation is presented entirely in Chinese, with no indication that the skill is region-specific or that alternative language support is available. This can constitute a language/locale policy issue because the skill imposes a specific language without user opt-in or justification.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The top-level documentation describes the script as validating memory integrity and repairing issues, which implies repair is part of its behavior. In practice, write/repair actions only occur when AUTO_FIX is enabled, and several detected issues are never repaired at all, so the comment overstates what the code does.

Vague Triggers

Low

• Confidence: 89% confidence
• Finding: This manifest is in scope for vague-trigger review, and the description presents the skill as a general-purpose long-term memory management system without any explicit activation conditions, boundaries, or negative examples. That broad wording could overlap with many common memory- or knowledge-related requests, increasing the chance of unintended invocation.

Static analysis

No suspicious patterns detected.