ClawHub
Back to skill

Security audit

Three Tier Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill does what it claims broadly, but it can persist personal conversation data and send short-term memory to an external LLM with weak disclosure and controls.

Install only if you are comfortable with conversation memory being saved locally in plaintext and, when summarizing, being sent to the GLM/BigModel service using your OpenClaw Zhipu API key. Avoid storing secrets, tokens, regulated data, or private business content until the skill adds explicit opt-in, redaction, deletion/retention controls, and pinned dependencies.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T02 · Agent Memory Poisoning

Error
Location
scripts/memory_manager.py:273
Finding

Persistent Memory Poisoning Through Untrusted Summary Input

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/memory_manager.py:273
Finding

Undisclosed Transmission of Conversation Content to an External LLM Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/memory_manager.py:120
Finding

Sensitive Memory Content Stored in Plaintext with Default File Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:52
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises operational commands and integrations that imply file I/O, environment access, and optional networked/vector-store capabilities, but it does not declare any tool scope or permissions boundaries. In an agent ecosystem, this can cause overbroad execution authority and makes it harder for users or policy layers to understand what the skill may access, increasing the risk of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states that conversation memory is automatically saved at session end and even provides an example of storing personal data like an email address, but it does not warn about retention, consent, access controls, or sensitive-data handling. This is dangerous because users may unknowingly persist PII or confidential chat content into local summaries/vector stores, creating privacy, compliance, and secondary exposure risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation includes an example that stores personally identifiable information ("用户邮箱: lei@example.com") in long-term memory without any warning, minimization guidance, consent requirements, or retention limits. In a memory-management skill, this is more dangerous than a generic example because the feature is explicitly designed to persist and retrieve user data over time, increasing privacy, compliance, and accidental disclosure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes medium-term memory as '自动摘要(LLM)', and the config even defines a summary_threshold. However, the code never checks the threshold or triggers summarization automatically; summaries are only created when the summary command calls trigger_summary manually.

Content

No source excerpt is available for this finding.

Tainted flow: 'config_json' from os.environ.get (line 74, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 75)May include surrounding context.

python
"""保存配置文件"""
    # 使用 JSON 而非 YAML，减少依赖
    config_json = CONFIG_FILE.with_suffix('.json')
    with open(config_json, 'w') as f:
        json.dump(config, f, indent=2, ensure_ascii=False)
    print(f"✓ 已保存配置: {config_json}")

Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 91)May include surrounding context.

python
# 创建短期记忆文件
    if not SLIDING_WINDOW_FILE.exists():
        with open(SLIDING_WINDOW_FILE, 'w') as f:
            json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False)
        print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")

Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 127)May include surrounding context.

python
# 创建短期记忆文件
    if not SLIDING_WINDOW_FILE.exists():
        with open(SLIDING_WINDOW_FILE, 'w') as f:
            json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False)
        print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")

Tainted flow: 'SLIDING_WINDOW_FILE' from os.environ.get (line 28, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 375)May include surrounding context.

python
# 创建短期记忆文件
    if not SLIDING_WINDOW_FILE.exists():
        with open(SLIDING_WINDOW_FILE, 'w') as f:
            json.dump({'messages': [], 'updated_at': datetime.now().isoformat()}, f, indent=2, ensure_ascii=False)
        print(f"✓ 已创建短期记忆: {SLIDING_WINDOW_FILE}")

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring for add_medium_term_memory says it adds medium-term memory as a summary, which implies summarization behavior. In reality, the function simply stores the caller-provided content verbatim into a daily JSON file and performs no summarization at all, making the documentation materially misleading about the function's behavior.

Content

No source excerpt is available for this finding.

Tainted flow: 'summary_file' from os.environ.get (line 146, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/memory_manager.py (reported line 161)May include surrounding context.

python
}
    data['summaries'].append(new_summary)
    
    with open(summary_file, 'w') as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
    
    print(f"✓ 已添加中期记忆: {summary_file}")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill claims long-term memory uses vector retrieval/RAG, but the implementation simply adds documents to a Chroma collection and even notes that a real embedding pipeline is not implemented. This creates a semantic mismatch between the advertised long-term semantic retrieval design and the simplified storage/query behavior actually present in code.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes long-term memory as vector retrieval/RAG, but this code comment states that it adds content to the vector DB using the raw content itself and notes that real production use would require embeddings. This directly indicates the implementation is not actually performing the intended vectorized long-term memory mechanism described by the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The summarization prompt instructs the model in Chinese and requires the summary to be produced in that language, while the CLI descriptions and usage are also Chinese-centric. There is no indication that users can opt into another language or locale, which creates a language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code sends accumulated conversation content to an external LLM API for summarization with no explicit notice, consent, or redaction step. Because the skill is a memory manager, it is especially likely to contain sensitive personal, conversational, or proprietary data, making silent exfiltration to a third party materially risky.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and core explanatory text are primarily Chinese, which may effectively impose a specific language on users. The file does not indicate that Chinese is optional, nor does it provide a documented reason for limiting the skill's instructions to that locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file title, headings, and descriptions are entirely in Chinese, which imposes a language choice on users without any opt-in or explanation. Under the policy, language constraints should either offer user choice or be clearly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill reads API credentials from a separate config file in the user's home directory without making that capability explicit in the skill's stated behavior. Hidden access to local secrets expands the skill's trust boundary and can surprise users, especially because the same code later uses the credential to send conversation content to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Reading API credentials from a local config file without explicit disclosure is risky because it uses broader ambient authority than users may expect from a memory-management skill. Combined with outbound API calls, this can silently activate external data transfer using credentials the user did not knowingly authorize this script to consume.

Content

No source excerpt is available for this finding.