T06 · System Persistence
Error
- Location
SKILL.md:114- Finding
Recurring Agent Task Creates Cross-Session Persistence
- Content
View full analysis
- Remediation
View remediation
Security audit
memory-compact
Security checks for vulnerabilities and agentic risk
Overview
This memory backup skill is mostly purpose-aligned, but it creates recurring agent runs and writes raw conversation-derived content into persistent memory while overstating its safety.
Review this skill before installing or enabling its cron job. It does not show network exfiltration or hidden remote payloads, but it will process sensitive OpenClaw memory, append selected lines into long-term MEMORY.md, move source files into backups, and may run every day if the cron command is added. Install only if you are comfortable with automatic memory promotion, and consider adding review, deletion, cron removal, symlink-safe path checks, and clearer timezone/language configuration first.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
memory_backup.py:147- Finding
Conversation Content Is Copied Verbatim into Persistent Agent Memory
- Content
View full analysis
= 3: break if not key_points: for line in lines: line = line.strip() if line and len(line) > 20: key_points.append(line) if len(key_points) >= 3: break return key_points[:3] def append_to_memory_md(key_points): """Append key points to MEMORY.md.""" date_str = get_yesterday_date_str() try: with open(MEMORY_MD, "a", encoding="utf-8") as f: f.write(f"## {date_str}\n") for i, point in enumerate(key_points, 1): f.write(f"{i}. {point}\n") f.write("\n") return True ``` The keyword literals and comments above are translated for readability. The audited implementation performs the same raw string matching and verbatim append operations. ### Technical Analysis `extract_key_points()` treats conversation-derived text as ordinary strings but does not establish whether the selected lines are trustworthy. Any matching line is added directly to `key_points`. If no keyword matches, the fallback accepts the first three nonempty lines longer than 20 characters. `append_to_memory_md()` then writes each selected line verbatim into the persistent `MEMORY.md` file. The implementation does not: - distinguish factual memory from instructions; - dete ...[truncated 1720 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
memory_backup.py:121- Finding
Symlink Following Can Redirect Persistent Writes and Backup Moves Outside the Workspace
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
This second mismatch finding is also valid: the skill presents itself as a memory-processing feature, but the visible content indicates a generic wrapper entrypoint that may launch external code via python/script dispatch without declaring that execution model. Hidden indirection through wrapper scripts increases risk because the real logic and side effects may exist outside the reviewed file.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
This second mismatch finding is also valid: the skill presents itself as a memory-processing feature, but the visible content indicates a generic wrapper entrypoint that may launch external code via python/script dispatch without declaring that execution model. Hidden indirection through wrapper scripts increases risk because the real logic and side effects may exist outside the reviewed file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill documentation presents the skill entirely in Chinese and labels it with a Chinese title, while the scheduled configuration later hard-codes the Asia/Shanghai timezone. There is no indication that users may choose another language or locale, nor any explanation that the skill is intended only for a China-specific environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README describes an automated daily job that reads prior memory files, appends extracted content into a long-term memory file, and creates backups, but it does not present this as a clear user-facing privacy/data-handling warning. Because the data involved is memory content, the lack of explicit disclosure and consent can cause silent collection, retention, and duplication of potentially sensitive information.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
查看备份文件
bash ls -la ~/.openclaw/workspace/backup/memory/查看提取结果
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
查看备份文件
bash ls -la ~/.openclaw/workspace/backup/memory/查看提取结果
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
查看备份文件
bash ls -la ~/.openclaw/workspace/backup/memory/查看提取结果
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
查看备份文件
bash ls -la ~/.openclaw/workspace/backup/memory/查看提取结果
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
查看备份文件
bash ls -la ~/.openclaw/workspace/backup/memory/查看提取结果
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool scope or permissions, yet its documentation describes capabilities equivalent to reading files, writing files, and invoking scripts via shell/python execution. This creates an authorization and review gap: operators cannot accurately assess what the skill is allowed to do, and a wrapper script could perform broader actions than users expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description and all user-facing documentation are written exclusively in Chinese, including operational instructions and example output. This imposes a specific language/locale on users without any stated opt-in, fallback, or note that the skill is intended only for a Chinese-speaking or China-region context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The security claims are inaccurate: the script says all file operations are restricted to the workspace, but it writes to MEMORY.md in create_memory_md() and append_to_memory_md() before any explicit path validation. Because WORKSPACE_ROOT is derived from the current user's home directory and then trusted globally, a manipulated environment, symlinked path, or unexpected filesystem layout could cause reads or writes outside the intended workspace boundary, making the documented safety guarantee unreliable.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description says '自动压缩备份' (automatic compressed backup), which implies creating a compressed archive or compacted backup artifact. The implementation in backup_file() merely renames the original markdown file into a backup folder, with no compression logic at all.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The package description is written only in Chinese ("每日记忆自动压缩备份和关键点提取"), which imposes a specific language for understanding the skill metadata. The file does not indicate that language choice is optional or that the skill is intended only for a Chinese-speaking or region-specific audience.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The docstring states that the wrapper 'does not include ... subprocess' and 'does not perform dangerous operations,' yet the module imports subprocess and later uses subprocess.run to launch memory_backup.py. This is an active contradiction between the inline security description and the implementation, not merely an omitted detail.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python try: # 执行目标脚本 result = subprocess.run( [sys.executable or "python3", SCRIPT_PATH], capture_output=True, text=True,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cron configuration fixes the locale-sensitive timezone to Asia/Shanghai, which can violate language/locale policy when presented as the default behavior without offering alternatives. The README does not explain that the skill is limited to that region or tell users to adjust the timezone to their own locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This Python file includes its main docstring and operational messages primarily in Chinese, and does not indicate any user option to select another language. That can violate a language/locale policy when a skill is expected to avoid forcing a specific language without user opt-in.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The documentation minimizes the wrapper as 'only an entry point,' but the code performs process execution control, timeout handling, working-directory selection, and output forwarding. While related to wrapping, the documentation's safety framing understates these concrete side effects and execution capabilities.
- Content