Security audit

Aegis Shield

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-built for memory safety, but its reviewed artifacts can still write lightly sanitized untrusted text into persistent agent memory and execute an unpinned local module outside the package.

Review this skill carefully before installing. It should only be used in an environment where the external aegis-shield library path is trusted and locked down, and where memory writes require explicit user approval. Do not rely on it as a strong sanitizer for untrusted web, email, or social content until it validates all fields strictly and bundles or verifies its scanner dependency.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: openclaw-safe-memory-append.js:60
Finding: Insufficient sanitization permits persistent Agent memory poisoning
Content: View full analysis
800 ? (t.slice(0, 800) + '…') : t; } ``` ```js const sanitized = sanitizeToDeclarative(text); const tagStr = tags.length ? ` [${tags.join(', ')}]` : ''; const entry = `- [${nowUtcISO()}]${tagStr} ${sanitized}\n Source: ${source}\n`; ``` ```js let outPath; if (target === 'longterm') { outPath = path.join(wsRoot, 'MEMORY.md'); } else { outPath = path.join(memDir, `${day}.md`); } fs.appendFileSync(outPath, entry, 'utf8'); ``` ### Technical Analysis The function named `sanitizeToDeclarative()` does not transform untrusted input into a safe declarative representation. It only normalizes line endings, removes leading and trailing whitespace, and truncates content after 800 characters. Consequently, accepted input retains embedded instructions, Markdown structures, role-like text, multiline directives, and other prompt-injection syntax. The preceding lint logic is a limited keyword blacklist, so semantically equivalent instructions can avoid its specific regular expressions. The behavior of the separately loaded scanner cannot be established from the audited project. If the scanner and lint checks accept a crafted input, the substantially unchanged content is appended to either a daily memory file or the long-term `MEMORY.md` file. These are persistent Agent state locations and may later be loaded into an Agent context. ### Attack Path 1. An attacker places disguised instructions in web, email, social, or ...[truncated 1105 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: openclaw-safe-memory-append.js:74
Finding: Unvalidated source and tag metadata permits memory-entry injection
Content: View full analysis
s.trim()).filter(Boolean); ``` ```js const sanitized = sanitizeToDeclarative(text); const tagStr = tags.length ? ` [${tags.join(', ')}]` : ''; const entry = `- [${nowUtcISO()}]${tagStr} ${sanitized}\n Source: ${source}\n`; ``` ### Technical Analysis The `source` and `tags` command-line values are interpolated directly into the persistent memory entry. These metadata fields are not passed through the scanner or lint function and have no restrictions on length, newlines, control characters, Markdown syntax, or permitted tag characters. A malicious caller can therefore provide benign `text` while placing the actual payload in `--source` or `--tags`. Embedded newline characters can terminate the expected metadata line and create additional Markdown entries or instruction-like blocks. This bypasses the controls applied to the primary text field. ### Attack Path 1. An attacker or untrusted integration controls arguments supplied to the script. 2. The attacker supplies benign text that passes scanning and linting. 3. The attacker places multiline Markdown or instruction text in the `--source` or `--tags` argument. 4. The script does not scan, lint, escape, or reject the malicious metadata. 5. Template interpolation writes the injected lines into a daily or long-term memory file. 6. A later Agent session reads the injected entry as part of persistent memory. ### Impact Assessment Exploitation permits arbitrary textual content to be inserted into Agent memory through metadata fields, subject to the caller's ability to invoke the script or infl ...[truncated 303 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: openclaw-safe-memory-append.js:88
Finding: Unpinned external workspace module is executed outside the audited package boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a shell command (node scripts/openclaw-safe-memory-append.js ...) but does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and can let the runtime or calling agent use shell access without a clear, reviewable declaration, which is especially relevant in a security-focused skill that processes untrusted text and may be used in sensitive workflows like memory writes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.