Karpathy LLM Memory Wiki

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 1.0.9

Overview

The skill is a coherent wiki/memory tool, but it gives agents durable automation, arbitrary URL ingestion, and persistent memory writes without enough scoping or review controls.

Install only if you want an agent-maintained persistent wiki. Keep cron and SuperMemory sync disabled until you review the exact scheduled prompts and data-sharing implications, and avoid queued URLs from untrusted sources unless the runtime enforces safe fetching and you review generated wiki changes before relying on them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wiki-ingest.md:8

Finding

Unrestricted URL Retrieval Permits Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/wiki-ingest.md:8-12; the same behavior is also specified in templates/WIKI-SCHEMA.md:78-80 and enabled by the URL-capable queue format in templates/queue-template.md:4
Vulnerability Type: Server-Side Request Forgery through unrestricted source retrieval
Risk Level: High

Vulnerable Code:

markdown

2. Read `work/wiki-sources/ingestion-queue.md` for pending items.
3. If the queue is empty, reply `NO_REPLY`.
4. For each pending source (max 3 per run):
   a. Read the source from `work/wiki-sources/` (or fetch URL if web source).
   b. Extract: key claims, facts, entities, relationships, dates.
   c. Check `memory/wiki/index.md` to see if an existing page covers the topic.

The schema repeats the unsafe retrieval requirement:

markdown

1. Check `work/wiki-sources/ingestion-queue.md` for pending items
2. Read each source from `work/wiki-sources/` (or fetch URL)
3. Extract key claims, facts, entities, relationships

Technical Analysis

The ingestion workflow accepts arbitrary URLs from a writable Markdown queue and instructs an agent to fetch them. It does not impose an HTTPS-only policy, trusted-host allowlist, URL normalization, redirect limit, DNS/IP validation, response-size limit, or restrictions against loopback, link-local, private-network, and cloud metadata addresses.

Consequently, an attacker who can add or influence a queue entry may cause the ingestion agent to issue requests from the OpenClaw host or its network context. URLs such as loopback services, RFC1918 addresses, IPv6 local addresses, or cloud metadata endpoints could be reached if the agent's web-fetching tool permits them. Redirects and DNS rebinding could potentially bypass validation performed only on the original URL.

This behavior is not necessary at its current privilege level. Remote-source ingestion is part of the declared functionality, but unrestricted acc ...[truncated 1663 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before fetching each remote source, especially during scheduled or unattended ingestion.
2. Permit only https:// URLs and reject URLs containing embedded credentials, nonstandard schemes, malformed hostnames, or ambiguous numeric IP representations.
3. Resolve the hostname before connecting and reject loopback, link-local, multicast, unspecified, private, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
4. Repeat destination validation after every redirect and DNS resolution. Apply a small redirect limit and prevent redirects from public hosts to private destinations.
5. Prefer an allowlist of approved public domains where operationally practical.
6. Route retrieval through a sandboxed fetcher with no access to the local network, host credentials, cookies, or authenticated browser sessions.
7. Enforce response-size, content-type, and timeout limits.
8. Keep remotely fetched content out of cloud synchronization until a user reviews and approves the generated wiki changes.
9. Log the normalized URL, resolved address, redirects, and final destination for security review without logging credentials or sensitive response bodies.

other

Error

• Location: scripts/wiki-ingest.md:10

Finding

Untrusted Source Content Is Processed Without Indirect Prompt-Injection Isolation

Content

View full analysis

Vulnerability Details

File Location: scripts/wiki-ingest.md:10-19
Vulnerability Type: Indirect prompt injection through attacker-controlled documents and web pages
Risk Level: High

Vulnerable Code:

markdown

4. For each pending source (max 3 per run):
   a. Read the source from `work/wiki-sources/` (or fetch URL if web source).
   b. Extract: key claims, facts, entities, relationships, dates.
   c. Check `memory/wiki/index.md` to see if an existing page covers the topic.
   d. If existing page: read it, update it (bump `updated` date, add new claims, add source to frontmatter sources list).
   e. If new topic: create new page in `memory/wiki/` using the template from WIKI-SCHEMA.md.
   f. Scan other wiki pages for cross-reference opportunities. Add `[[wikilinks]]` in both directions.
   g. Update `memory/wiki/index.md` (add/update row in table, bump stats).
   h. Append entry to `memory/wiki/log.md`.
   i. Mark source as processed in `work/wiki-sources/ingestion-queue.md` (move to Processed section with `[x]`).

Technical Analysis

The same agent context is instructed to read untrusted local documents or remote web content and then exercise persistent file-write capabilities. The workflow does not tell the agent that instructions embedded in sources are untrusted data, does not prohibit executing source-supplied commands or tool requests, and does not separate extraction from privileged mutation.

A malicious source can contain text crafted as agent instructions, such as directions to ignore the ingestion workflow, read unrelated files, reveal information, create misleading wiki entries, or invoke available tools. Because the source is introduced directly into the model's active context, the model may interpret this content as instructions rather than evidence to summarize.

The declared feature requires extracting facts from sources, but it does not require granting source content influenc ...[truncated 1749 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an explicit instruction that all source content is untrusted data and that instructions, commands, tool requests, role declarations, or policy text found inside a source must never be followed.
2. Split ingestion into two security stages:
   • A read-only extraction stage that emits a constrained structured representation.
   • A validation and write stage that consumes only the validated representation.
3. Run source parsing in a sandbox without shell access, credentials, authenticated browser state, unrelated filesystem access, or permission to modify persistent memory.
4. Restrict writes to canonicalized paths under memory/wiki/, plus the specific index, log, and queue files required by the workflow. Reject traversal and symlink escapes.
5. Require human review before committing changes produced from remote or previously untrusted sources.
6. Validate generated pages against a strict schema and reject unexpected instructions, executable blocks, external resource inclusions, or content that attempts to redefine agent behavior.
7. Preserve clear provenance for each claim, including the source and extraction time, so poisoned content can be identified and rolled back.
8. Use transactional updates and maintain backups or version control for persistent wiki files.
9. Ensure scheduled ingestion runs with a dedicated least-privilege tool profile rather than the agent's general-purpose permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

bash

openclaw cron delete <ingest-job-id>    # Get IDs: openclaw cron list | grep Wiki
openclaw cron delete <lint-job-id>
rm -rf memory/wiki/ work/wiki-sources/ WIKI-SCHEMA.md

Usage

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to run setup and uninstall commands that create, modify, and delete files under memory/, work/, and the workspace root, but it does not present a clear upfront warning about those side effects. This is dangerous because users may execute the commands without realizing they will alter persistent knowledge files or remove accumulated wiki data during uninstall.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation advertises optional SuperMemory cloud sync for wiki content but does not include a clear privacy warning that locally compiled knowledge may be transmitted to a third-party cloud service. This can expose sensitive notes, source-derived summaries, or internal knowledge to external systems if users enable sync without understanding the data flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to fetch arbitrary web sources and modify multiple local files, but provides no user-facing consent, trust boundary, or restrictions on allowed destinations. In an agent setting, this can enable unintended network access, ingestion of adversarial remote content, and broad filesystem changes driven by untrusted queue entries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to modify wiki files, trim logs, and archive pages automatically, but it provides no confirmation gate, dry-run mode, or warning that running the lint will mutate stored knowledge. In an agent setting, a task labeled as a 'health check' is expected to be primarily read-only, so these hidden write operations can cause unintended data loss, integrity issues, or silent content changes if triggered automatically.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup script performs actions beyond simple local wiki bootstrapping by optionally creating persistent OpenClaw cron jobs and modifying a separate SuperMemory sync script. Even though these behaviors are opt-in, they expand the skill's operational scope into scheduled agent execution and cross-tool persistence, which can surprise users and create unintended automation pathways if the skill or downstream ingest/lint prompts are later changed or abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script provisions recurring agent-scheduled executions using openclaw cron create, causing the agent to repeatedly execute skill-controlled instructions from wiki-ingest.md and wiki-lint.md. This establishes durable autonomous behavior that can process future untrusted content from the ingestion queue, increasing the blast radius of prompt injection or later skill modification beyond a one-time local setup task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The schema explicitly instructs the agent to fetch remote URLs and then create or update multiple local wiki files, index files, logs, and queue state, but it does so without any requirement for user confirmation, visibility, or scope restriction. In an agent setting, this creates a real risk of silent network access and automated persistence of externally sourced content, which can lead to unreviewed data ingestion, prompt-injection propagation from fetched content, and unintended file modifications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The query workflow instructs the agent to persist new state by adding entries to work/wiki-sources/ingestion-queue.md based solely on conversational knowledge gaps. That means a read-like query operation can silently mutate session/project state, creating durable artifacts from normal user interaction and potentially allowing adversarial prompts to steer future ingestion behavior.

Content

Scanner excerpt · templates/WIKI-SCHEMA.md (reported line 92)May include surrounding context.

md

1. Read `memory/wiki/index.md` to check if relevant pages exist
2. Use `memory_search` or read matched pages directly
3. Synthesize answer from wiki content, citing the wiki page
4. If answer reveals a knowledge gap, add entry to `work/wiki-sources/ingestion-queue.md`

### Lint
1. Check all wiki pages for:

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The provided manifest context says this skill is named "karpathy-wiki" and is specifically described as a compilation-over-retrieval wiki for OpenClaw agents. In _meta.json, the slug and name instead identify it as "wiki-system" / "Karpathy LLM Memory Wiki," which is a semantic mismatch in what the skill claims to be. While not direct code behavior, this is an intent-level inconsistency in the skill's declared identity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script edits an external SuperMemory sync script to add wiki content to another tool's synchronization scope. Although limited to one path insertion and gated by --with-sync, modifying another automation script creates hidden cross-tool coupling and may broaden data exposure or persistence in ways not obvious from the wiki skill's stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.