Security audit
Security checks for vulnerabilities and agentic risk
This memory skill is purpose-aligned but needs Review because it stores and shares conversation content broadly, sends unredacted memory to a configured LLM endpoint, and contains an agent-id code-execution flaw.
Review this skill carefully before installing. It is not clearly malicious, but it can retain private conversation content long term, share selected content across agents, index it for later retrieval, and send recent memory text to the configured model provider. Avoid using it with secrets or confidential data unless the scripts are fixed to redact before persistence and network use, require confirmation for shared writes, validate agent identifiers, and pin the installer version.
weekly-distill.sh:29Arbitrary Python Code Execution Through Unvalidated Agent Identifier
smart-summarize.sh:42Unredacted Conversation Memory Is Transmitted to a Configured LLM Endpoint
extract-memory.sh:106Unredacted Session Content Is Persisted and Propagated Across Agents
README.md:19Installation Guidance Executes an Unpinned Mutable Package Release
The skill claims semantic understanding, intelligent summarization, and sensitive-data protection, but the file provides no auditable implementation evidence for those protections. Security-relevant overclaiming is a real risk because users may expose confidential content believing the system meaningfully filters or protects it when it may not.
The skill claims semantic understanding, intelligent summarization, and sensitive-data protection, but the file provides no auditable implementation evidence for those protections. Security-relevant overclaiming is a real risk because users may expose confidential content believing the system meaningfully filters or protects it when it may not.
The skill claims semantic understanding, intelligent summarization, and sensitive-data protection, but the file provides no auditable implementation evidence for those protections. Security-relevant overclaiming is a real risk because users may expose confidential content believing the system meaningfully filters or protects it when it may not.
The skill claims semantic understanding, intelligent summarization, and sensitive-data protection, but the file provides no auditable implementation evidence for those protections. Security-relevant overclaiming is a real risk because users may expose confidential content believing the system meaningfully filters or protects it when it may not.
The skill’s stated behavior explicitly includes persistent collection, summarization, reuse, and cross-agent sharing of conversation content across multiple stores. In the context of a memory-management skill, persistence is expected, but the breadth of reuse and sharing without strict minimization, consent, and sensitivity controls makes this materially dangerous.
The script stores user and assistant messages into a persistent memory file using broad heuristics such as length and keyword presence, which will capture ordinary plain-language content including potentially sensitive information. There is no effective redaction beyond skipping a couple of system-like prefixes, so confidentiality-sensitive text can be retained long term.
The code copies user message content into error, learning, and best-practice logs and shares selected entries into common cross-agent files based on simple keyword matching like API, network, config, or permissions. This is especially dangerous because those categories are exactly where users often mention tokens, endpoints, internal architecture, access problems, or security-sensitive troubleshooting details, making accidental propagation of secrets and confidential data likely.
The README states that all conversations are automatically recorded to session files and that the skill extracts important dialogue into persistent memory files, but it does not prominently warn users about retention, privacy, or possible capture of sensitive data. In the context of an automatic memory system, this increases the chance that credentials, personal data, or confidential business information will be stored and propagated without informed consent or operator safeguards.
The README instructs users to execute npx clawhub@latest install auto-memory, which fetches and runs the latest remote package code without pinning to a specific version. This creates a supply-chain risk: a compromised upstream package, malicious publish, or breaking update could result in unintended code execution during installation.
The skill documentation instructs creation and execution of local scripts that read/write workspace memory and appear to invoke LLM-backed analysis, but the manifest declares no explicit tool scope or permissions. That mismatch prevents users and platforms from understanding that the skill can persist conversation-derived data, access files, and potentially make networked model calls.
The skill is explicitly designed to persist conversation-derived memory into daily logs, long-term memory files, and an index, yet the description does not provide a clear user warning about automatic persistent storage. This can lead to unintentional retention of sensitive or regulated data far beyond the current session.
The installation instructions create persistent directories under the user's home/workspace for scripts, archives, and shared learnings, confirming session-to-session data retention. Persistent storage is not automatically malicious, but in a memory skill it increases privacy risk because conversation-derived content may accumulate, be shared across runs, and remain after the user expects it to be gone.
# 创建目录
mkdir -p ~/.openclaw/scripts
mkdir -p ~/.openclaw/workspace/memory/archive
mkdir -p ~/.openclaw/workspace/.learnings/shared
Comments and runtime messages are predominantly in Chinese, which effectively imposes a language choice on users and operators of the script. The file does not indicate that Chinese is optional, configurable, or required for a justified region-specific use case.
The script is designed to copy extracted conversation-derived content into shared cross-agent files under a common workspace, which expands access beyond the originating agent. Because the content is derived from user and assistant sessions using broad heuristics and no consent gate or sanitization, this creates a real confidentiality and data-boundary violation.
The code writes session-derived user content into persistent memory, learning, error, and shared files without any explicit warning, consent, or review step. This is dangerous because users may disclose secrets, personal data, credentials, or confidential project details in ordinary conversation, and the script persists and redistributes them automatically.
The script invokes external commands that update indexes and optionally run a weekly maintenance script, creating side effects outside simple extraction. In a security review, hidden or undocumented secondary execution paths are risky because they increase trust assumptions and may process or transform sensitive memory further than expected.
Running an unrelated weekly external script from a memory-extraction workflow widens the attack surface and introduces behavior not clearly tied to the core function. If the maintenance script is replaced, misconfigured, or more permissive than expected, it can access or transform accumulated memory without clear user awareness.
The comments and user-facing echo messages in this script are written in Chinese, which imposes a specific language on users without any opt-in or locale selection. The policy requires either user choice or clear justification for locale constraints; neither is present here.
The runtime output shown via echo uses Chinese-only text such as status and completion messages. This can violate language/locale policy because the script does not offer users a language choice or state that the tool is region- or language-specific.
The script transmits up to ~1500 characters of the memory file to a remote LLM endpoint using credentials and a base URL from local configuration. Because this skill is specifically positioned as a memory/protection component, exporting memory contents off-host without explicit consent or robust redaction creates a real confidentiality risk, especially if the memory file contains prompts, secrets, personal data, or operational context.
The code sends memory content to an external model API without any explicit warning, consent prompt, or indication in the shell script output that local memory is being exfiltrated to a third party. This is dangerous because users may reasonably expect a memory-management skill to operate locally, and the transmitted content may include sensitive internal notes or user data.
The script appends to or creates MEMORY.md based on recent note contents, which modifies user data on disk. Although there are status messages after the write, there is no prior confirmation prompt, no warning comment/docstring describing the write impact, and no indication that the user is being alerted before the modification occurs.
The user-facing skill description is presented entirely in Chinese, which can impose a language constraint without user opt-in. Under the policy, forcing a specific language is a natural-language policy concern unless the file offers alternatives or clearly documents a justified locale limitation.
The manifest description and the entire user-facing documentation are presented in Chinese, with no indication that other languages are supported or that the locale is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy issue.
The script runs state-changing external commands without a clear operator-facing warning or approval point. While not inherently malicious, this can surprise users and administrators by modifying indexes or triggering maintenance tasks that affect retained memory artifacts.
No suspicious patterns detected.