Security audit

hippocampus

Security checks for vulnerabilities and agentic risk

Overview

This is a local memory skill, but it automatically stores and reuses conversation history across sessions with broad triggers and scheduled-job setup that users should review carefully.

Install only if you intentionally want long-term local memory. Before enabling it, consider disabling AUTO_SAVE, proactive triggers, ReadingBetweenTheLines, cron jobs, and session hooks until you understand exactly what will be stored and recalled. Avoid using it with secrets, credentials, private customer data, or confidential conversations unless you add your own retention, review, and deletion process.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: scripts/memory.py:1191
Finding: Persistent Prompt Injection Through Proactive Memory Recall
Content: View full analysis
threshold: topic = context.get('topic', 'General') if context else 'General' save_monograph(topic, content, token_count) result = ( f"Auto-saved to Monograph " f"(trigger: {trigger_type}, tokens: {token_count})" ) else: save_chronicle(content) result = ( f"Auto-saved to Chronicle " f"(trigger: {trigger_type}, tokens: {token_count})" ) ``` ### Technical Analysis The Skill stores raw session context and recent history without preserving a meaningful trust boundary between user instructions, external ...[truncated 2319 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: scripts/memory.py:1813
Finding: Cross-Session Persistence Through Scheduled Jobs and Session Hooks
Content: View full analysis
str: """Generate cron/hook setup commands""" skill_path = str(SKILL_DIR) return f"""# Add these cron jobs for automatic memory saving: # 1. Time-based trigger (every {get_config().get('TIME_HOURS', 6)} hours) cron add --name "hippocampus-autosave-time" \ --schedule "0 */{get_config().get('TIME_HOURS', 6)} * * *" \ --session-target isolated \ --payload 'Run: python3 {skill_path}/scripts/memory.py autocheck' # 2. Session end hook (automatic save on session close) # Note: This requires OpenClaw hook configuration # Alternative: Use heartbeat to trigger periodic checks # Run this command to test: python3 {skill_path}/scripts/memory.py autocheck """ ``` It also generates commands for three recurring tasks: ```python return f"""# Execute these cron job creations: ## 1. Auto-save (every 6 hours) ``` cron add --name "hippocampus-autosave" --schedule "0 */6 * * *" --session-target isolated --payload "Run: python3 {skill_path}/scripts/memory.py autocheck" --delivery-mode none ``` ## 2. Daily-create (midnight) ``` cron add --name "hippocampus-daily-create" --schedule "0 0 * * *" --session-target isolated --payload "Run: echo \\"$(date +%Y-%m-%d)\\"" --delivery-mode none ``` ## 3. Daily-analyze (23:00) ``` cron add --name "hippocampus-analyze" --schedule "0 23 * * *" --session-target isolated --payload "Run: python3 {skill_path}/scripts/memory.py analyze" --delivery-mode none ``` """ ``` A session-end hook is also proposed: ```python return f"""# Hook Configuration ## Required Configuration To enable automatic memory save on session end, add this to your `{config_path}`: ...[truncated 2656 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/memory.py:853
Finding: Automatic Indefinite Plaintext Storage of Sensitive Conversation Content
Content: View full analysis
str: """Save temporal memory to Chronicle""" _lazy_init() config = get_config() extractor = KeywordExtractor() keywords = extractor.extract(content) timestamp = datetime.now().strftime("%Y-%m-%d-%H-%M") date = datetime.now().strftime("%Y-%m-%d") filename = f"{timestamp}.md" filepath = get_chronicle_path() / filename keyword_str = ",".join( list(keywords["word_frequency"].keys())[:10] ) md_content = f"""# Chronicle - {date} ## Metadata - **Timestamp**: {timestamp} - **Session**: {session_id or 'N/A'} - **Keywords**: {keyword_str} ## Content {content} ## Analysis | Keyword | Frequency | |---------|-----------| """ for kw, cnt in list(keywords["word_frequency"].items())[:15]: md_content += f"| {kw} | {cnt} |\n" filepath.write_text(md_content, encoding='utf-8') conn = sqlite3.connect(str(get_db_path())) cursor = conn.cursor() cursor.execute(''' INSERT INTO chronicle_index (file_name, file_path, timestamp, date, keywords, content_preview, session_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ''', ( filename, str(filepath), timestamp, date, keyword_str, content[:200], session_id, datetime.now().isoformat() )) conn.commit() conn.close() return str(filepath) ``` Monograph records use the same plaintext design: ```python md_content = f"""# {topic} ## Metadata - **Created**: {datetime.now().isoformat()} - **User**: {meta.ge ...[truncated 3078 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
python3 scripts/memory.py init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
python3 scripts/memory.py init

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The ReadingBetweenTheLines feature performs autonomous memory loading based on repeated topic discussion in a sliding window, which is a broad behavioral trigger rather than an explicit user command. This substantially increases the chance of prompt-context poisoning, unintentional retrieval of sensitive material, and manipulation by an attacker who can steer conversation toward trigger thresholds to force memory injection.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes very common words such as 'remember', 'recall', 'warn', 'learn', and 'workflow', which are likely to appear in ordinary conversation. In an instruction-first skill with read/write/exec permissions, this can cause unintended activation and execution of memory-related actions without clear user intent, increasing the risk of accidental data storage, retrieval, or side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly instructs users to configure automatic saving and analysis of session content, but it does not provide a clear privacy notice, consent model, retention policy, or warning that potentially sensitive conversation data will be stored and processed. In a memory skill, this omission is materially risky because users may unknowingly persist secrets, personal data, or proprietary information to disk and scheduled jobs may continue processing it unattended.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README openly describes persistent capture of session content and long-term reuse through chronicle and monograph memory features. Persistent storage of conversational data meaningfully increases the blast radius of accidental secret capture, user profiling, and later unintended retrieval, especially when paired with exact timestamps and long-term importance tracking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The proactive trigger feature is described as reading recent user messages, counting terms, and automatically loading memories, but the documentation does not clearly warn users that their messages are being continuously monitored for behavioral triggers. This creates a surveillance-like behavior that can expose sensitive topics, infer intent, and increase accidental processing of confidential data without informed consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This feature combines scanning recent user messages with automatic memory activation, which turns passive chat history into a continuously reused behavioral signal. In context, that makes the skill more dangerous because it can surface old sensitive material based on repeated keywords and encourage hidden stateful behavior that the user may not anticipate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow examples use generic phrases like "deploy" and "send report" as implicit triggers for multi-step actions. In an agent context, broad natural-language triggers can cause unintended execution or expansion of sensitive workflows when those phrases appear in ordinary conversation, especially if the system automatically retrieves and acts on stored procedures.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The proactive triggers are keyed on common, high-frequency words like "database" and "api", causing memory to be loaded automatically whenever those terms appear. That creates a context-injection and privacy risk: irrelevant or sensitive stored memory may be prepended to future prompts without clear user intent, influencing outputs or disclosing prior information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation states that session content is auto-saved and loaded memory is prepended to future responses, but it does not present this as a prominent warning or informed-consent mechanism. Users may unknowingly persist sensitive data and have it silently reintroduced into later contexts, increasing privacy, confidentiality, and prompt-manipulation risk.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The skill explicitly advertises behavior "without asking," meaning it autonomously scans messages and injects memory into context before responding. In a memory-augmented agent, autonomous hidden context changes are dangerous because they bypass explicit user intent, can expose sensitive prior data, and make prompt behavior easier to manipulate through crafted conversation.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
1. Before each response, hippocampus scans your message 2. If a trigger keyword is found, it loads the associated memory file 3. The loaded memory is prepended to context for this response 4. You get relevant context without asking for it This is configured via `PROACTIVE_KEYWORDS` in USER_CONFIG.md.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The proactive keyword triggers use common terms like 'project', 'database', 'api', and 'error' to automatically load memory. In a conversational agent, these broad triggers can activate on routine discussion and cause unintended context injection, which may bias responses, surface irrelevant stored data, or expose prior memory content without an explicit user request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instant and threshold trigger rules automatically react to frequent everyday words on a 1-minute heartbeat, which increases the chance of accidental or adversarial activation through normal conversation. This creates a prompt-injection-like pathway where a user can deliberately repeat benign terms to force memory loading and influence subsequent agent behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The state loader and related status functions are documented as handling persistent word counts and sliding-window analysis, and readingbetweenthelines_stat() reports tracked words from state['word_counts']. However, readingbetweenthelines() only tokenizes the current messages in memory and updates cooldowns; it never writes computed counts back to state['word_counts'], so the documented persistent counting behavior does not actually occur.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: Persisting reading-state data to disk is not inherently unsafe, but in this skill it contributes to cross-session retention of user-derived behavioral/contextual data without strong user controls. Combined with other memory features, this expands the privacy footprint and may retain patterns about user discussions longer than expected.
Content: Scanner excerpt · scripts/memory.py (reported line 268)May include surrounding context.
python
def _save_reading_state(state: Dict): """Persist state to disk""" fpath = _reading_state_path() fpath.parent.mkdir(parents=True, exist_ok=True) with open(fpath, 'w', encoding='utf-8') as f:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/memory.py (reported line 1017)May include surrounding context.
python
def _update_keyword_index(topic: str, keywords: Dict, source_path: Path): """Update keyword index files — index_dir already created by _lazy_init()""" index_dir = get_index_path() # No mkdir needed: _lazy_init() already ran via save_monograph() or save_chronicle() for kw in list(keywords.keys())[:10]: kw_file = index_dir / f"{kw}.md"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The auto-save flow persists conversation/context data to disk without any consent gate, warning, or content minimization. In a memory skill that handles arbitrary user conversation, this creates a realistic privacy and sensitive-data retention risk, especially if secrets, personal data, or internal project details are present in context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is intentionally designed to retain natural-language conversation content and later reuse it, which creates a data retention and secondary disclosure channel. Even without malice, storing free-form context in markdown and SQLite makes accidental leakage of confidential prompts, credentials, or personal information more likely through later recall or file access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The recall path returns previews of previously saved content in response to ordinary queries, which can surface sensitive information that was stored earlier. In this skill's context, memory retrieval is a core feature, so any secret or private data written into Chronicle can later be echoed back with minimal friction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: _cmd_autocheck() can automatically collect recent content or history and write it to Chronicle/Monograph based on thresholds, again without an explicit warning at the point of save. Because this path may run from hooks/cron and process accumulated session history, it increases the chance of silently retaining sensitive material beyond user expectations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/memory.py (reported line 1849)May include surrounding context.
python
- Execute: python3 {skill_path}/scripts/memory.py autocheck ### 2. Daily memory file creation (midnight) - Name: hippocampus-daily-create - Schedule: 0 0 * * * - Execute: create ~/.openclaw/workspace/memory/heartbeat-YYYY-MM-DD-HHMM.md

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/memory.py (reported line 1897)May include surrounding context.
python
**I will execute as follows:** 1. Detected hippocampus needs hook configuration 2. Explicitly ask user: "Do you consent to configure auto-save hooks?" 3. After user says "yes", auto-execute hook configuration ---

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The sync-to-memory feature propagates stored user-derived content into a shared MEMORY.md, broadening exposure from this skill's private store into a potentially wider agent context. That increases the blast radius of any sensitive content previously captured, because other components or future sessions may read and reuse it.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The sync command docstring and user-facing text say it will gather recent monographs and build a preview summary. But list_monographs() returns only topic, user, keywords, created_at, and updated_at, so _cmd_sync_memory() reads m['content_preview'] from records that do not contain that field, causing the advertised summary behavior to fail.
Content: No source excerpt is available for this finding.