persistent_user_memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:20 AM UTC
• Version: 1.0.0

Overview

This skill is clearly a local memory tool, but it automatically builds and changes a persistent plaintext profile about the user and contacts with limited runtime control.

Install only if you intentionally want OpenClaw to maintain a long-term local profile about you and your contacts. Review the memory file regularly, avoid letting it store sensitive personal or business details, and consider adding explicit opt-in, write review, encryption or restrictive file permissions, retention limits, and a clear disable/delete workflow before using it broadly.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94

Finding

Silent Persistent Storage of Personal and Behavioral Data in Plaintext

Content

View full analysis

User asks to draft an email to "Sarah" > → Look up Sarah in `relationships.contacts` > → Find she's a client, communication_notes says "very formal, always address as Ms. Chen" > → Draft accordingly, without prompting the user for tone --- ### 2. Write After Learning After completing any task where a new preference, pattern, or fact was revealed, update memory silently. Do not announce every write. Do announce if a conflict is detected (see edge cases). **Trigger conditions for a memory write:** - User corrects you → update the relevant field - User states a preference explicitly ("I always want...", "never do X") - A contact is mentioned with context for the first time - A recurring task is completed for the 3rd+ time - An error occurred and the user explained why it was wrong --- ### 3. Surface Memory Proactively Occasionally surface relevant memory when it adds value. Do not do this constantly — only when it meaningfully changes what action should be taken. **Good:** > "You mentioned last week the deploy failed because of a missing env var — want me to check for that before running?" **Bad (annoying):** > "I remember you like concise emails! Here is a concise email." --- # ...[truncated 4634 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The changelog explicitly advertises silent read-before-act and silent write-after-learning behavior for persistent user memory, which indicates collection and modification of user data without clear runtime disclosure or consent. In a memory-oriented skill, undisclosed persistence materially increases privacy risk because the agent can profile users over time, retain sensitive inferences, and influence future interactions based on data the user may not realize is being stored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly says the agent updates a persistent user memory 'silently, without interrupting your workflow,' which describes ongoing collection and retention of personal behavioral data without clear opt-in, notice, or per-update confirmation. Even if stored locally, this can normalize covert profiling and create privacy and consent risks, especially when the memory influences future agent behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Or manually:

bash

mkdir -p ~/.openclaw/skills/persistent-user-memory
cp SKILL.md ~/.openclaw/skills/persistent-user-memory/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

bash

mkdir -p ~/.openclaw/skills/persistent-user-memory
cp SKILL.md ~/.openclaw/skills/persistent-user-memory/SKILL.md

---

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

bash

mkdir -p ~/.openclaw/skills/persistent-user-memory
cp SKILL.md ~/.openclaw/skills/persistent-user-memory/SKILL.md

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is explicitly designed to build persistent cross-session user memory and states that it learns over time, but it does not require a clear upfront consent or notice before collecting and retaining personal data. In this context, silent persistence of identity, preferences, contacts, and episodic history creates a real privacy risk because users may not understand that their data is being stored locally and reused automatically.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The instruction to apply remembered preferences "without asking" enables the agent to make consequential choices using previously stored personal context, including for emails, scheduling, scripts, and purchases. In a memory skill, this is more dangerous because autonomy is combined with persistent profiling, increasing the chance of incorrect or privacy-invasive actions based on stale or misunderstood data.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

## Core Behaviors

### 1. Read Before Acting
Before any significant action (sending email, scheduling, running a script, making a purchase), silently load and consult `user_profile.json`. Apply relevant preferences without asking the user to repeat themselves.

**Example:**
> User asks to draft an email to "Sarah"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to silently read persistent memory before significant actions and silently write back learned facts after tasks, which establishes ongoing background data collection without transparent user awareness. Because the stored content includes behavioral patterns, contacts, and interaction summaries, this can lead to covert profiling and surprise retention even if the storage is local-only.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This instruction creates durable session persistence for user-specific data and directs silent automatic updates whenever new facts or patterns are inferred. In context, the retention of preferences, relationships, mistakes, and episodic summaries across sessions creates a real privacy and governance issue, especially because writes can happen without explicit contemporaneous consent or review.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

---

### 2. Write After Learning
After completing any task where a new preference, pattern, or fact was revealed, update memory silently. Do not announce every write. Do announce if a conflict is detected (see edge cases).

**Trigger conditions for a memory write:**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

If no memory file exists:

1. Create the file with empty defaults.
2. Do NOT ask the user a long onboarding questionnaire.
3. Learn passively through normal interaction — fill in fields as they naturally emerge.
4. After the 5th session, you may ask 1–2 targeted questions to fill obvious gaps (e.g., timezone, preferred name).

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The schema hard-codes "language": "en" as the default identity language. The policy requires avoiding forced language or locale choices unless the user is given a choice or the constraint is justified, and no such opt-in or justification appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON sets the user's language to "en" directly in natural-language profile data. Per the policy, forcing a specific language or locale without explicit user choice or justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.