Datris Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:59 AM UTC
• Version: 1.0.1

Overview

The skill is openly designed to sync local long-term memory into Datris, but it does so broadly and repeatedly without clear per-user or per-file consent controls.

Review this skill carefully before installing. It should only be used if you are comfortable sending your local long-term memory files to Datris for persistent indexing and recurring synchronization. Before use, confirm the Datris endpoint and tenant, decide which files may be uploaded, exclude sensitive notes or secrets, and make sure there is a way to disable sync and delete indexed data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:27

Finding

Automatic Bulk Disclosure of Long-Term Memory to an External Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–33; related behavior at lines 3, 13–18, 42–50, 66–75, and 88
Vulnerability Type: Excessive external data access and disclosure
Risk Level: High

Vulnerable Code Snippet

markdown

## First-run bootstrap

1. Read the Datris MCP resources and tool descriptions. Understand the pipeline, upload, job-status, and search workflows before acting.
2. Check service health.
3. Reuse an existing vector pipeline for memory in the `openclaw` catalog if one exists. Otherwise create one in the `openclaw` catalog — pgvector is fine. If a memory pipeline exists outside the `openclaw` catalog, surface that to the user before reusing or migrating it.
4. Ingest `MEMORY.md` and each `memory/*.md` file via its own `upload_data` call — one upload per file, no exceptions. Do not concatenate them into a single corpus document, even if the total set is small. Fire the uploads in parallel and collect all the job tokens before polling.
5. Poll all jobs concurrently until every one reports completion.
6. Verify with two or three representative semantic queries. Confirm both that (a) the expected content comes back, and (b) results show real source filenames (`MEMORY.md`, `memory/2026-05-06.md`, etc.) — not a consolidated corpus filename or any other synthetic name. The filename round-trip check is the early-warning signal that the one-file-per-upload rule is being followed; if results show a corpus filename, stop and apply the remediation workflow below.
7. Record the run in `memory/<today>.md`: pipeline used, files ingested, verification queries and results, any failures.

Related instructions broaden activation and establish recurring disclosure:

markdown

Trigger on any work involving long-term memory ingestion, retrieval, or sync.

markdown

A timer-driven sweep runs every 30 minutes by default — diff memory files by `mtime` against the last sync recor
...[truncated 3736 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit informed opt-in before bootstrap. Before any upload, identify Datris as an external destination and show the user the endpoint, catalog, pipeline, retention implications, and exact files proposed for transmission. Continue only after affirmative authorization.

2. Use a file allowlist. Do not upload every memory/*.md file automatically. Let the user select approved files or directories, and persist only that authorization scope.

3. Add sensitivity and secret screening. Scan proposed content for credentials, API keys, authentication tokens, private keys, personal data, and user-defined sensitive patterns. Block or redact matches and request confirmation where classification is uncertain.

4. Default to local retrieval. For memory-shaped questions that do not explicitly mention Datris or remote semantic search, search canonical local Markdown files first. Remote processing should be an opt-in capability rather than the default.

5. Separate retrieval consent from synchronization consent. Permission to answer one question must not implicitly authorize bulk bootstrap or recurring synchronization. Obtain distinct approval before enabling timer-driven or response-driven uploads.

6. Provide granular synchronization controls. Allow users to disable synchronization, configure its cadence, exclude files, pause individual uploads, and inspect pending changes before transfer.

7. Validate the destination and transport. Pin or explicitly approve the MCP endpoint, require authenticated encrypted transport, verify the intended Datris tenant and catalog, and reject unexpected endpoint or certificate changes.

8. Apply server-side least privilege. Use a dedicated service identity restricted to the specific openclaw catalog and memory collection. Prevent access to unrelated pipelines, collections, secrets, and administrative operations.

9. **Define retention and deletion guarantee ...[truncated 615 chars]

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill's trigger conditions are intentionally broad enough to activate on generic phrases about saving, recalling, syncing, or searching notes, even when the user does not explicitly mention Datris. This can cause the agent to invoke external memory/retrieval workflows in ordinary conversations, increasing the chance of unintended data access, unexpected persistence, or unnecessary interaction with the Datris MCP service.

Content

No source excerpt is available for this finding.