Persistent Agent Memory 1.0.1

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:58 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward remote persistent-memory helper, but users should be careful because stored text is retained by Coral Bricks and deletion is semantic rather than exact.

Install only if you are comfortable sending selected memory text and metadata to Coral Bricks for cross-session retention. Do not store credentials, secrets, regulated personal data, or confidential business material unless you have authorization and understand the provider's retention and deletion behavior. Use narrow queries when deleting memories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: persistent-agent-memory
description: "Add persistent memory to any agent so it can remember prior work, maintain context across sessions, and continue long-running workflows."
metadata:
  {
    "openclaw":

• Confidence: 88% confidence
• Finding: Cross-session persistence is the core function of this skill, but persistent memory increases the blast radius of any accidental storage of sensitive or adversarial content. In this context, the danger is elevated because the skill explicitly encourages retaining context across sessions while using a default shared collection abstraction, which can normalize long-term retention without clear data minimization boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to store arbitrary memories in a third-party service but does not clearly warn, at the point of use, that submitted content leaves the local environment and persists across sessions. This creates a meaningful risk that operators or downstream agents will send sensitive data, credentials, or personal information off-platform without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The deletion feature is described as semantic query-based removal, but the documentation does not warn that approximate matching can delete more memories than intended. Because semantic matching is inherently fuzzy, a broad or ambiguous query could remove unrelated persisted records and cause integrity loss that may be difficult to detect or recover.

Static analysis

No suspicious patterns detected.