Memos Memory Guide

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.0

Overview

This memory guide is mostly coherent, but it permits private conversation memories to be shared with other local agents without asking the user first.

Install only if you are comfortable with this skill helping agents search prior conversations and with some memories becoming visible to other local agents. Review local memory-sharing behavior carefully, prefer explicit consent before sharing chunks, and pin or otherwise control the better-sqlite3 dependency during installation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Native Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–21
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: better-sqlite3
    bins: []

Technical Analysis

The installation configuration declares the better-sqlite3 npm package without an exact version, lockfile, or integrity hash. Consequently, the package version and associated installation artifacts may be resolved dynamically when the skill is installed.

Because better-sqlite3 is a native Node.js dependency, its installation may involve package lifecycle scripts, native build tooling, or downloaded prebuilt binaries. The package name itself is not established as malicious; the security issue is the absence of controls ensuring that the installed artifact is the same artifact that was reviewed and approved.

Attack Path

1. An attacker compromises the package, its publishing account, or another relevant part of the npm distribution chain.
2. A malicious or otherwise unsafe release becomes the version selected by npm because no exact version is specified.
3. A user or automated system installs the skill and resolves better-sqlite3 from the package registry.
4. Malicious lifecycle code, native build logic, or a compromised binary executes with the privileges of the installation process.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account installing or running the skill. Depending on that account's privileges, the attacker could access OpenClaw configuration, environment variables, local memory databases, conversation data, and other files available to the process. The scope is limited by the operating-system privileges and sandbox controls applied to installation and runtime.

Remediation

View remediation

Remediation Suggestions

• Pin better-sqlite3 to an exact, reviewed version rather than allowing unconstrained resolution.
• Include and enforce a lockfile containing integrity metadata.
• Verify package provenance and registry integrity before installation.
• Disable npm lifecycle scripts where operationally feasible, or explicitly review every required script.
• Prefer reproducible builds and trusted, checksum-verified native artifacts.
• Run dependency installation with minimum privileges and isolate it from sensitive OpenClaw state and configuration.
• Add automated dependency scanning and controlled update review so version changes cannot enter silently.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:73

Finding

Conversation Memories May Be Shared Across Local Agents Without User Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–79
Vulnerability Type: Cross-agent information disclosure
Risk Level: Medium

Vulnerable Code

markdown

### memory_share

- **What it does:** Share an existing memory either with local OpenClaw agents, to the team, or to both.
- **When to call:**
  - If you want to share conversation content to team or hub, first retrieve memories related to that content to obtain the right `chunkId`(s), then share.
  - `target='agents'` (default): When those memories would clearly help other agents in the same workspace, you may share proactively without asking the user.
  - `target='hub'` or `'both'`: Only after explicit user consent when the content would benefit collaborators—explain briefly, ask first, then call `hub`/`both` (Hub must be configured). Never silently Hub-share.

Technical Analysis

The skill explicitly permits proactive sharing of an existing conversation-memory chunk with all local agents in the workspace without obtaining user consent. It also makes agents the default sharing target.

This weakens the documented private ownership boundary: content that was originally available only to its owning agent can be exposed to other workspace agents. Although team or Hub sharing requires explicit consent, local agents may still have different purposes, operators, prompts, or trust levels. The instruction provides no mandatory sensitivity review, content minimization, audience selection, or confirmation step before changing a memory's visibility.

Attack Path

1. The current agent searches private long-term conversation memory and receives a relevant chunkId.
2. The agent decides that the memory could help another local agent.
3. Following the skill instructions, it invokes memory_share without requesting user approval; omission of target selects the default agents target.
4. The memory becomes locally shared across the OpenCl ...[truncated 701 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user consent before sharing any existing memory with another agent, not only before Hub or team sharing.
• Remove agents as an implicit default; require an explicit target for every sharing operation.
• Display or summarize the exact memory content, intended recipients, visibility scope, and sharing duration before confirmation.
• Apply sensitive-data detection and redact credentials, personal data, secrets, and unrelated conversation content.
• Share only the minimum necessary excerpt rather than an entire memory chunk.
• Support narrowly scoped recipient selection instead of workspace-wide visibility where possible.
• Record auditable sharing events and provide a straightforward revocation workflow through memory_unshare.
• Preserve private visibility when consent is absent, ambiguous, or cannot be obtained.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s invocation guidance is broad enough to trigger retrieval of long-term memory on routine mentions of past chats, preferences, or history, which can cause unnecessary access to sensitive prior conversation data. Because recall is framed as something to use whenever prior context might help, the agent may over-collect and surface private information without a clear necessity test or user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to search past conversations and potentially team-shared data, but it does not require a user-facing notice that memory or shared sources are being consulted. This weakens informed consent and can expose sensitive historical or team context in ways the user may not expect, especially when group or all scopes are available.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

## How memory is provided each turn

- **Automatic recall (hook):** At the start of each turn, the system runs a memory search using the user's current message and injects relevant past memories into your context. You do not need to call any tool for that.
- **When that is not enough:** If the user's message is very long, vague, or the automatic search returns **no memories**, you should **generate your own short, focused query** and call `memory_search` yourself.
- **Memory isolation:** Each agent can only see its own local private memories and local `public` memories. Team-shared data only appears when you search with `scope="group"` or `scope="all"`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill explicitly allows proactive sharing of existing memories with other local agents without asking the user. Even if limited to the same workspace, this authorizes autonomous disclosure of potentially sensitive conversation content across agents, expanding access beyond the original collection context without consent.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

- **What it does:** Share an existing memory either with local OpenClaw agents, to the team, or to both.
- **When to call:**
  - If you want to share conversation content to team or hub, first retrieve memories related to that content to obtain the right `chunkId`(s), then share.
  - `target='agents'` (default): When those memories would clearly help other agents in the same workspace, you may share proactively without asking the user.
  - `target='hub'` or `'both'`: Only after explicit user consent when the content would benefit collaborators—explain briefly, ask first, then call `hub`/`both` (Hub must be configured). Never silently Hub-share.
- **Do not use when:** You are creating a brand-new shared note with **no** existing chunk—use `memory_write_public` instead.
- **Parameters:**