OpenClaw Compact Summary

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:36 AM UTC
• Version: 1.0.0

Overview

This skill is a simple memory-compaction template with one low-impact resume directive that users should understand before installing.

Install only if you want OpenClaw memory compaction to use this structured MEMORY.md format. Be aware that the template stores a resume instruction that may make future agents continue without recap; consider removing that field if you prefer persistent memory to contain only factual state.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Note

• Location: SKILL.md:45

Finding

Persistent Behavioral Instruction Embedded in Memory Summaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–46
Vulnerability Type: Persistent instruction injection through long-term memory
Risk Level: Low

Vulnerable Code

markdown

## Resume Instruction
Continue directly — do not acknowledge this summary, do not recap what was happening, and do not preface with continuation text.

Technical Analysis

The skill instructs the agent to include an imperative behavioral directive in summaries written during memory flush or compaction. Unlike factual state such as prior requests, files, and unfinished tasks, this text directs the behavior of an agent that later consumes MEMORY.md.

This creates a persistent instruction channel across sessions. The directive shown does not override safety controls or request a harmful action, so the present impact is limited. Nevertheless, storing executable instructions alongside remembered facts weakens the trust boundary between passive memory data and authoritative agent instructions. If this pattern permits variable or attacker-controlled resume instructions in future versions or surrounding workflows, it could be used to persist more consequential behavioral manipulation.

Attack Path

1. The skill is activated during a memory flush or compaction operation.
2. Its structured template is used to write a summary into persistent MEMORY.md storage.
3. The Resume Instruction and its imperative directive are stored with the conversation state.
4. A subsequent agent session loads and interprets that memory.
5. The later agent follows the persisted directive by suppressing acknowledgment, recap, and continuation context.

The audited artifact contains only a fixed, low-impact instruction; no mechanism for attacker-controlled substitution was identified.

Impact Assessment

The instruction can influence response presentation in future sessions that consume the stored summary. It may suppress acknowledgment and contextual recap, potentially r ...[truncated 293 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove fixed behavioral directives from summaries persisted to MEMORY.md.
2. Restrict persistent summaries to factual state, including prior requests, completed work, unfinished tasks, relevant files, and tool results.
3. If continuation preferences are required, place them in trusted configuration rather than conversation-derived memory.
4. Treat all content loaded from memory as untrusted contextual data, not executable instructions.
5. Apply explicit instruction precedence so memory content cannot override system, developer, safety, or current-user instructions.
6. Use a typed schema that separates factual state from preferences and rejects imperative instruction fields.
7. Validate and sanitize any user-derived text before persistence to prevent instructions from being introduced through summary fields.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.