Operational Heartbeat

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches an operational health-check purpose, but it includes an under-scoped optional step to read and promote learnings from recent memory files.

Review this before installing if your OpenClaw memory can contain private or sensitive information. The basic heartbeat behavior is reasonable, but the optional memory-promotion feature should be disabled or explicitly scoped unless you are comfortable with scheduled access to recent memory files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:7

Finding

Overbroad Access to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-9 and 18
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Complete Relevant Snippet:

markdown

1. Ensure memory file exists for today:
   - Path: memory/YYYY-MM-DD.md
   - If missing, create with minimal template

markdown

3. Optional: promote learnings from recent memory files (if configured)

Technical Analysis

The Skill instructs the Agent to write to persistent memory and optionally process recent memory files. Creating a fixed, current-day health-check file is consistent with the stated operational purpose, but “promote learnings from recent memory files” is broader than a file-presence check.

The instructions do not define which memory files may be read, what information qualifies as a learning, where selected content will be written, how sensitive data must be filtered, or what authorization is required. Consequently, a scheduled health-check execution could receive access to conversation-derived information unrelated to cron or file-health monitoring. The issue is a least-privilege violation rather than evidence of deliberate exfiltration.

Attack Path

1. The Skill runs automatically through an authorized scheduler.
2. The optional memory-promotion feature is enabled.
3. The Agent discovers and reads recent persistent memory files.
4. Those files contain sensitive or untrusted conversation-derived content.
5. Based on the undefined instruction to “promote learnings,” the Agent selects and copies content into another persistent context or state location.
6. The promoted content becomes available to or influences future Agent sessions.

This path is conditional because the document states that promotion is optional and must be configured. The audited file does not contain an external transmission mechanism or an explicit instruction to poison memory.

Impact Asses

...[truncated 612 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the memory-promotion operation from this health-check Skill and implement it as a separate, explicitly authorized workflow.
2. Restrict the health check to an existence or metadata check for the exact current-day path, memory/YYYY-MM-DD.md.
3. Prohibit reading the contents of current or historical memory files when only presence must be verified.
4. Define a fixed, non-sensitive template for newly created files and prevent user-controlled content from becoming persistent instructions.
5. If promotion remains necessary, define an allowlist of readable files, a fixed destination, sensitivity filters, retention rules, and explicit user approval requirements.
6. Run the scheduled task with filesystem permissions limited to the minimum required memory path and read-only access to cron metadata.
7. Record which files were accessed or modified without logging their sensitive contents.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file describes creating a memory file if it is missing, which is a file write affecting user or system data. The description states the behavior but does not explicitly warn the user that the skill may automatically create files during scheduled execution.

Content

No source excerpt is available for this finding.