Memory Fusion Lite

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:28 AM UTC
• Version: 1.0.0

Overview

This memory skill is open about its goal, but it automatically scans private session history and changes persistent agent memory with weak safeguards.

Install only if you are comfortable with an automated memory tool reading conversation logs and editing persistent agent memory. Before use, fix the redaction bug, restrict file permissions and allowed paths, run the scanner in a preview mode first, keep backups of MEMORY.md, and require review before promoting or deleting memory entries.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scan_sessions_incremental.py:41

Finding

Ineffective Secret Redaction Due to Literal Backspace Characters in Regular Expressions

Content

View full analysis

str: s = _RE_SK.sub("sk-***REDACTED***", s) s = _RE_TG_BOT.sub("", s) s = _RE_GOOGLE_API_KEY.sub("AIza***REDACTED***", s) s = _RE_BEARER.sub("Bearer ***REDACTED***", s) return s ``` ### Technical Analysis The characters surrounding each credential pattern are literal U+0008 backspace control characters rather than the regular-expression word-boundary escape `\b`. Consequently, the expressions only match credentials that are surrounded by literal backspace characters. Normal OpenAI-style keys, Telegram bot tokens, Google API keys, and bearer tokens in session messages will not satisfy these patterns and will pass through `_redact_secrets()` unchanged. The scanner subsequently renders extracted message content to JSON or Markdown. The documented workflow sends that output to an LLM for summarization and may write selected information into persistent memory. This defeats the stated security objective of preventing secrets from entering the LLM prompt. The implementation is also inherently best-effort and only recognizes a narrow set of credential formats. Even after correcting the control characters, other common secrets such as private keys, cloud credentials, GitHub tokens, ...[truncated 1514 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: scripts/scan_sessions_incremental.py:545

Finding

Untrusted Session Content Can Poison Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/scan_sessions_incremental.py (reported line 97)May include surrounding context.

python

state[k] = {}
        return state
    except Exception:
        # Corrupt state: start fresh (safer than crashing cron).
        return {
            "version": STATE_VERSION,
            "updated_at": None,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill describes behavior that reads and writes user workspace files, including MEMORY.md and state files, but it does not declare an explicit tool scope or permissions boundary. That creates an authorization ambiguity: a host may grant broader file capabilities than users expect, increasing the risk of unintended modification of persistent memory or other local files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is entirely in Chinese, and the rest of the skill instructions are also written only in Chinese, with no indication that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill persistently stores scan cursors, execution timestamps, weekly flags, and derived memory artifacts under ~/.openclaw/workspace/memory/. Persistent session-derived state can accumulate sensitive behavioral history and inferred personal information, and if access controls are weak or retention is indefinite, compromise of the workspace exposes more data than a transient workflow would.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

2. memory/_state/ 目录已创建

bash

mkdir -p ~/.openclaw/workspace/memory/_state

3. memory/weekly/ 目录已创建

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document instructs the system to scan session JSONL data and automatically append, promote, and delete entries in MEMORY.md, but it does not require explicit user notice or consent for this data processing and file modification. Because session logs can contain sensitive or unexpected personal/project information, this creates a privacy and integrity risk through silent collection, retention, and alteration of memory content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file is entirely written in Chinese and does not provide any indication that language selection is optional or region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented workflow explicitly promotes and deletes memory entries from persistent records without any accompanying confirmation, backup, or warning about irreversible loss. In a memory-management skill, this is operationally dangerous because routine automated execution could silently remove user-important context or auditability, especially when driven by cron rather than an interactive session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This script emits extracted session messages directly to stdout in JSON or Markdown, and those messages come from user and assistant conversation logs. Although the code applies some best-effort redaction for a few token formats, the protection is incomplete and cannot reliably prevent secrets, personal data, or sensitive conversation content from being exposed to terminals, logs, pipes, cron mail, or downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The retention table states that weekly archives are automatically kept for only 90 days, but it does not clearly warn users that historical records will be deleted after that period. While lower severity than immediate record deletion, this can still cause unnoticed loss of audit history, rollback capability, and user expectations around persistence.

Content

No source excerpt is available for this finding.