ClawHub
Back to skill

Security audit

Three Tier Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local memory skill, but it needs review because it can persist arbitrary conversation data in plaintext without clear consent, retention, deletion, or access-control safeguards.

Install only if you are comfortable with the skill storing conversation and preference data on disk. Avoid storing secrets, credentials, regulated personal data, or confidential business information unless you add your own consent, deletion, retention, encryption, and file-permission controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/memory_manager.py:165
Finding

Unpinned Third-Party Dependency Installation Guidance

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/memory_manager.py:93
Finding

Conversation and Memory Data Persisted in Plaintext with Inherited Filesystem Permissions

Content
View full analysis
window_size: messages = messages[-window_size:] data['messages'] = messages data['updated_at'] = datetime.now().isoformat() with open(SLIDING_WINDOW_FILE, 'w') as f: json.dump(data, f, indent=2, ensure_ascii=False) print(f"✓ 已添加短期记忆，当前窗口: {len(messages)}/{window_size}") return True ``` Medium-term summaries are also persisted as plaintext JSON: ```python def add_medium_term_memory(content: str, summary_type: str = 'auto'): """添加中期记忆（摘要）""" date_str = datetime.now().strftime('%Y-%m-%d') summary_file = SUMMARIES_DIR / f'{date_str}.json' if summary_file.exists(): with open(summary_file, 'r') as f: data = json.load(f) else: ...[truncated 3382 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises commands that read configuration and write persistent memory files, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, this can cause the skill to be invoked with broader file and environment access than users expect, increasing the chance of unintended data exposure or modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation guidance is broad enough to encourage use whenever an agent wants context optimization, knowledge base construction, or persistence, which can lead to this skill being applied to sensitive conversations by default. That increases the likelihood that private or regulated data will be stored into local files or a vector database without a clear necessity or user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly stores conversation content in persistent JSON summaries and a long-term vector store, yet provides no warning that sensitive user data may be retained and later retrieved. In this context, the omission is dangerous because the skill's core purpose is memory persistence, so users and downstream agents may unknowingly retain secrets, personal data, or confidential business information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples explicitly store personal data such as user preferences and a real-looking personal name into short-, medium-, and long-term memory without any warning about persistence, consent, retention, or sensitivity. In a memory-management skill, this normalizes capturing personally identifiable or preference data and can lead downstream integrators to persist user data indefinitely without adequate privacy controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The OpenClaw integration example directly passes user_message into a memory storage command, effectively instructing developers to capture and persist arbitrary user input without any user-facing notice, consent flow, filtering, or sensitivity checks. Because this skill is specifically designed for persistent multi-tier memory, the context makes the issue more dangerous: accidental storage of secrets, personal data, regulated data, or prompt contents is a foreseeable outcome.

Content

No source excerpt is available for this finding.

Tainted flow: 'config_json' from os.environ.get (line 74, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 75)May include surrounding context.

python
"""保存配置文件"""
    # 使用 JSON 而非 YAML，减少依赖
    config_json = CONFIG_FILE.with_suffix('.json')
    with open(config_json, 'w') as f:
        json.dump(config, f, indent=2, ensure_ascii=False)
    print(f"✓ 已保存配置: {config_json}")

Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 91)May include surrounding context.

python
# 创建短期记忆文件
    if not SLIDING_WINDOW_FILE.exists():
        with open(SLIDING_WINDOW_FILE, 'w') as f:
            json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False)
        print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")

Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 127)May include surrounding context.

python
# 创建短期记忆文件
    if not SLIDING_WINDOW_FILE.exists():
        with open(SLIDING_WINDOW_FILE, 'w') as f:
            json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False)
        print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")

Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 303)May include surrounding context.

python
# 创建短期记忆文件
    if not SLIDING_WINDOW_FILE.exists():
        with open(SLIDING_WINDOW_FILE, 'w') as f:
            json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False)
        print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill stores arbitrary supplied memory content to local JSON files without any consent prompt, sensitivity check, retention control, or warning that the content becomes persistent on disk. In the context of an AI memory manager, users may supply secrets, personal data, or internal conversation history, so silent persistence materially increases confidentiality and privacy risk if the host is shared, backed up, or later compromised.

Content

No source excerpt is available for this finding.

Tainted flow: 'summary_file' from os.environ.get (line 146, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 161)May include surrounding context.

python
}
    data['summaries'].append(new_summary)
    
    with open(summary_file, 'w') as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
    
    print(f"✓ 已添加中期记忆: {summary_file}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manual summary operation clears the short-term memory file immediately after archiving, with no confirmation, dry-run mode, backup, or undo path. This creates a real integrity/availability risk because a user can lose recent conversation state unexpectedly, especially if the generated summary is poor or incomplete.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

Most of the operational description and usage guidance are written in Chinese, while the file title and some headings are in English. This effectively imposes a language requirement on users without an explicit opt-in or justification, which can conflict with language or locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file content, headings, and descriptions are presented in Chinese only, which can impose a language constraint on users without opt-in. There is no indication that the skill is intentionally region-specific or that alternative language support is available.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

User-facing descriptions, usage examples, and CLI help text are predominantly presented in Chinese, and the file does not indicate that another language is supported or that Chinese is required for a specific region or compliance reason. This can be a locale policy issue when a skill imposes one language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.