T08 · Insecure Dependencies
Warning
- Location
scripts/memory_manager.py:146- Finding
Unpinned Third-Party Dependency Installation Guidance
- Content
View full analysis
- Remediation
View remediation
Security audit
Monica Memory Manager
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is not overtly malicious, but it should be reviewed because it persistently stores conversation data and feeds stored content back to agents without enough controls.
Install only in an isolated workspace where local memory files are acceptable. Do not store secrets or sensitive personal data unless you add retention, deletion, permission hardening, and redaction controls. Treat retrieved memories as untrusted reference data, not instructions, and pin/review the ChromaDB dependency before enabling long-term memory.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory_manager.py:105- Finding
Conversation Data Persisted in Plaintext Without Access-Control Hardening
- Content
View full analysis
window_size: messages = messages[-window_size:] data['messages'] = messages data['updated_at'] = datetime.now().isoformat() with open(SLIDING_WINDOW_FILE, 'w') as f: json.dump(data, f, indent=2, ensure_ascii=False) ``` Medium-term summaries are also written directly to JSON: ```python with open(summary_file, 'w') as f: json.dump(data, f, indent=2, ensure_ascii=False) ``` Long-term memories are stored as original documents in the persistent vector store: ```python collection.add( documents=[content], ids=[memory_id], metadatas=[metadata or {'timestamp': datetime.now().isoformat()}] ) ``` ### Technical Analysis The Skill accepts arbitrary conversation content and persists it in plaintext JSON files or as original text documents in ChromaDB. The implementation does not: - Encrypt records at rest. - Explicitly create files and directories with owner-only permissions. - Detect or redact credentials, access tokens, or other secrets. - Obtain confirmation before persisting potentially sensitive content. - Apply expiration or deletion controls to long-term records. - Distinguish sensitive data from ordinary conversational content. The default filesystem location is derived from `WORKSPACE_DIR`, or from the hardcoded fallback `/Users/scott/.openclaw/workspace`. Security therefore depends on the surrounding f ...[truncated 1155 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
scripts/memory_manager.py:164- Finding
Persistent Memory Poisoning Through Untrusted Long-Term Content
- Content
View full analysis
list: """搜索长期记忆""" try: import chromadb except ImportError: print("✗ 需要安装 chromadb: pip install chromadb") return [] client = chromadb.PersistentClient(path=str(VECTOR_STORE_DIR)) try: collection = client.get_collection("memory") except: return [] # 搜索 results = collection.query( query_texts=[query], n_results=top_k ) memories = [] if results and results.get('documents'): for i, doc in enumerate(results['documents'][0]): memories.append({ 'content': doc, ...[truncated 2729 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill describes and demonstrates filesystem-backed memory features and likely access to environment/configuration, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can cause the skill to receive broader file and environment access than users expect, increasing the chance of unintended data exposure or unsafe writes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is explicitly designed to retain conversation data across short-, medium-, and long-term storage layers, but the description does not clearly warn users that their prompts and derived summaries may persist on disk. This creates a privacy and consent risk because users may disclose sensitive information without realizing it will be stored and reused later.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The medium-term memory design states that automatic summarization uses a model such as glm-4-flash or gpt-3.5-turbo, which implies conversation content may be sent to an external service. Without an explicit warning, users may unknowingly transmit confidential chat history to third-party providers, creating privacy, compliance, and data-handling risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file's headings, descriptions, and usage guidance are presented in Chinese only, which effectively forces a specific language for users of the skill documentation. No opt-in, alternative language, or justification for a Chinese-only locale constraint is provided.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly demonstrates storing personally identifiable information and user preferences in short-, medium-, and long-term memory, but provides no warning about persistence, consent, retention, access controls, or deletion. In a memory-management skill, this is especially risky because the purpose of the skill is to retain conversation-derived data over time, increasing the chance of privacy violations, over-collection, and accidental disclosure.
- Content
Tainted flow: 'config_json' from os.environ.get (line 74, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python """保存配置文件""" # 使用 JSON 而非 YAML，减少依赖 config_json = CONFIG_FILE.with_suffix('.json') with open(config_json, 'w') as f: json.dump(config, f, indent=2, ensure_ascii=False) print(f"✓ 已保存配置: {config_json}")
Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python # 创建短期记忆文件 if not SLIDING_WINDOW_FILE.exists(): with open(SLIDING_WINDOW_FILE, 'w') as f: json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False) print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")
Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python # 创建短期记忆文件 if not SLIDING_WINDOW_FILE.exists(): with open(SLIDING_WINDOW_FILE, 'w') as f: json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False) print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")
Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python # 创建短期记忆文件 if not SLIDING_WINDOW_FILE.exists(): with open(SLIDING_WINDOW_FILE, 'w') as f: json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False) print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function persists short-term conversation content directly to disk without any warning, consent flow, retention control, or protection for potentially sensitive prompts and responses. In an agent memory skill, this context makes the issue more dangerous because users may reasonably assume 'short-term' means ephemeral, while the code durably stores data in plaintext JSON on the local filesystem.
- Content
Tainted flow: 'summary_file' from os.environ.get (line 146, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python } data['summaries'].append(new_summary) with open(summary_file, 'w') as f: json.dump(data, f, indent=2, ensure_ascii=False) print(f"✓ 已添加中期记忆: {summary_file}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Long-term memory stores arbitrary user content durably in a vector database without any user-facing disclosure, sensitivity filtering, or retention controls. In the context of an AI memory system, this is particularly risky because users may place secrets, personal data, or proprietary information into memory, and long-term semantic storage increases the blast radius of later disclosure or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Triggering summary clears the short-term memory file after archiving, but the interface gives no explicit warning that stored messages will be deleted. In a memory-management skill this can cause silent data loss and break user expectations around recoverability and retention.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file presents usage comments, help strings, and runtime output primarily in Chinese, while no option is provided for users to select another language or locale. This can violate language/locale policy when a skill imposes a specific language without explicit user opt-in or documented regional scope.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill documentation and function docstrings present long-term memory as vector-based retrieval (RAG). Yet the inline comment explicitly says the implementation is using the content directly and that a production embedding-based approach is not implemented, contradicting the stated intent of true vector memory.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a three-tier memory system with automatic summary generation for medium-term memory. However, the code explicitly states that real LLM API integration is still TODO and instead creates a simple preview string from recent messages, which falls short of the claimed behavior.
- Content