memory-compression-system

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:43 PM UTC
• Version: 3.0.1

Overview

The skill mostly matches its memory-compression purpose, but installation can create a recurring OpenClaw agent task that keeps reading and processing local memory without a separate opt-in.

Review this carefully before installing. Only install it if you want recurring background agent execution over your OpenClaw memory. Check whether the installer creates a cron job, verify the exact memory and data directories it will touch, and confirm you can remove any scheduled OpenClaw jobs manually if disable.sh does not clean them up.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: package.json:6
• Finding: Package Installation Automatically Registers a Persistent Scheduled Agent Task<![CDATA[ ## Vulnerability Details **File Location**: `package.json:6-8`; `scripts/install.sh:353-393` **Vulnerability Type**: Persistent scheduled execution without a separate enablement decision **Risk Level**: High ### Vulnerable Code ```json "scripts": { "test": "./test/run-tests.sh", "install": "./scripts/install.sh", "start": "./scripts/enable.sh", "stop": "./scripts/disable.sh", "status": "./scripts/status.sh", "health": "./scripts/health.sh" } ``` ```bash # Set up cron job setup_cron_job() { log "Setting up cron job..." # Check if openclaw command is available if command -v openclaw &> /dev/null; then log "Creating OpenClaw cron job..." # Create cron job via OpenClaw API cron_job=$(cat << 'EOF' { "name": "Memory Compression System", "schedule": { "kind": "every", "everyMs": 21600000 }, "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "Run Memory Compression System: cd /home/node/.openclaw/workspace/skills/memory-compression-system && ./scripts/compress.sh --auto", "timeoutSeconds": 300 }, "delivery": { "mode": "announce" } } EOF ) # Try to create the cron job if openclaw cron add --json "$cron_job" &> /dev/null; then success "OpenClaw cron job created" else warning "Failed to create OpenClaw cron job (may need manual setup)" fi else warning "openclaw command not found, skipping cron setup" log "Manual cron setup required. Add to crontab:" log "0 */6 * * * cd $SKILL_DIR && ./scripts/compress.sh --auto" fi success "Cron setup completed" } ``` ### Technical Analysis The package defines `scripts/install.sh` as its npm `install` lifecycle command. Consequently, an ordinary `npm install` can execute the full installation script. That script invokes `setup_cron_job`, which registers an OpenClaw scheduled task that laun ...[truncated 2481 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the npm `install` lifecycle entry or replace it with a non-mutating validation step: ```json "scripts": { "setup": "./scripts/install.sh", "start": "./scripts/enable.sh" } ``` 2. Remove `setup_cron_job` from the installation workflow. Installation should only create necessary local files and directories. 3. Register the scheduled task exclusively through an explicit `scripts/enable.sh` command. 4. Before registration, display: - The exact command that will execute. - The six-hour execution frequency. - The memory directory that will be read. - The data, backup, and log directories that will be written. - The cleanup and retention behavior. 5. Require explicit interactive confirmation, with a separate documented non-interactive flag for controlled deployments. 6. Capture and securely store the exact job ID returned by `openclaw cron add`, so later removal does not depend on text matching. 7. Make installation idempotent and verify that no duplicate tasks exist before adding a new one. ]]>

T06 · System Persistence

Warning

• Location: scripts/disable.sh:48
• Finding: Disable Workflow Can Report Success While Scheduled Tasks Remain Active<![CDATA[ ## Vulnerability Details **File Location**: `scripts/disable.sh:48-70`, `scripts/disable.sh:75-91`, `scripts/disable.sh:138-161` **Vulnerability Type**: Incomplete and fail-open removal of persistent scheduled tasks **Risk Level**: Medium ### Vulnerable Code ```bash # Remove cron job remove_cron_job() { echo "Removing cron job..." # Check if openclaw command is available if command -v openclaw &> /dev/null; then echo "Removing OpenClaw cron job..." # Find and remove cron job local job_id=$(openclaw cron list --json 2>/dev/null | grep -i -B2 -A2 "memory.compression" | grep '"id"' | cut -d'"' -f4 | head -1) if [ -n "$job_id" ]; then if openclaw cron remove --id "$job_id" &> /dev/null; then echo -e "${YELLOW}OpenClaw cron job removed: $job_id${NC}" else echo -e "${RED}Failed to remove OpenClaw cron job${NC}" fi else echo -e "${YELLOW}No OpenClaw cron job found${NC}" fi else echo -e "${YELLOW}openclaw command not found${NC}" echo "Manual cron cleanup required. Remove from crontab:" echo "0 */6 * * * cd $SKILL_DIR && ./scripts/compress.sh --auto" fi } ``` ```bash # Remove enabled marker remove_enabled_marker() { echo "Removing enabled marker..." if [ -f "$SKILL_DIR/.enabled" ]; then local enabled_date=$(cat "$SKILL_DIR/.enabled") rm -f "$SKILL_DIR/.enabled" echo -e "${YELLOW}Disabled (was enabled on: $enabled_date)${NC}" else echo -e "${YELLOW}No enabled marker found${NC}" fi } ``` ```bash remove_cron_job echo "" remove_enabled_marker echo "" create_disabled_marker echo "" show_final_status echo "" echo -e "${YELLOW}=========================================${NC}" echo -e "${YELLOW} MEMORY COMPRESSION SYSTEM DISABLED ${NC}" echo -e "${YELLOW}=========================================${NC}" ``` ### Technical ...[truncated 2441 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Capture the exact job ID returned by `openclaw cron add` and store it in a protected state file when enabling the Skill. 2. Parse scheduler JSON with `jq` rather than line-oriented text tools: ```bash mapfile -t job_ids < <( openclaw cron list --json | jq -r '.[] | select(.name == "Memory Compression System") | .id' ) ``` 3. Remove every matching or stored job, not only the first result. 4. Treat any removal failure as fatal. Do not delete `.enabled`, create `.disabled`, or print success until verification passes. 5. After removal, query both OpenClaw scheduling and the user's crontab and verify that no exact matching task remains. 6. If system-crontab fallback is supported, install and remove a uniquely marked block, for example: ```text # BEGIN memory-compression-system ... # END memory-compression-system ``` 7. Make `disable.sh` check actual scheduler state even when `.enabled` is absent. Marker files should be informational, not authoritative. 8. Return a nonzero exit status whenever any persistent task remains. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install.sh:399
• Finding: Installer Applies File-Only Permissions to Data Directories<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:399-405` **Vulnerability Type**: Incorrect recursive permission handling causing data-directory denial of service **Risk Level**: Medium ### Vulnerable Code ```bash # Finalize installation finalize_installation() { log "Finalizing installation..." # Set permissions chmod -R 755 "$SKILL_DIR/scripts" chmod 644 "$CONFIG_DIR"/* chmod 644 "$DATA_DIR"/* ``` The earlier installation workflow creates directories immediately beneath `DATA_DIR`: ```bash mkdir -p "$DATA_DIR/compressed" mkdir -p "$DATA_DIR/backups" mkdir -p "$DATA_DIR/search" ``` ### Technical Analysis The wildcard `"$DATA_DIR"/*` expands to both regular files and immediate child directories. Applying mode `0644` to a directory removes its execute or traversal bit. On Unix-like systems, read permission on a directory permits listing its entries, while execute permission is required to traverse it and access files within it. Modes such as `0644` are therefore inappropriate for directories. After installation, `data/compressed`, `data/backups`, and `data/search` can become non-traversable. Subsequent compression, backup creation, search-index updates, and cleanup operations may fail. The scheduled task can continue launching while being unable to perform its declared operations reliably. This is an availability and integrity-management flaw rather than privilege escalation. It does not grant broader permissions; it incorrectly removes required permissions. ### Attack Path 1. A user runs `scripts/install.sh`, directly or through the npm install lifecycle. 2. `create_directories` creates `data/compressed`, `data/backups`, and `data/search`. 3. `finalize_installation` expands `"$DATA_DIR"/*`. 4. `chmod 644` is applied to the child directories as well as regular files. 5. The directories lose execute/traversal permission. 6. Manual or scheduled compression attempts to write compressed files, backups, or ...[truncated 752 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set directory and file permissions separately: ```bash find "$DATA_DIR" -type d -exec chmod 700 {} + find "$DATA_DIR" -type f -exec chmod 600 {} + ``` 2. If data must be group-readable, use a deliberate policy such as: ```bash find "$DATA_DIR" -type d -exec chmod 750 {} + find "$DATA_DIR" -type f -exec chmod 640 {} + ``` 3. Protect memory backups and generated memory summaries with restrictive permissions because they may contain sensitive workspace content. 4. Apply the same directory-versus-file distinction to configuration and log paths. 5. Add an installation self-test that verifies: - Every required directory is traversable and writable by the service account. - A temporary backup can be created and removed. - A search-index file can be atomically written. - A compressed output file can be created. 6. Abort installation with a nonzero status if permission validation fails, rather than registering scheduled execution for a broken installation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior includes broad filesystem modification, backups of existing directories and cron data, and registration of automation jobs, while no permissions are declared. In skill context, this materially increases risk because a user seeking memory compression may unknowingly authorize extensive local persistence and file manipulation beyond the apparent purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented behavior includes broad filesystem modification, backups of existing directories and cron data, and registration of automation jobs, while no permissions are declared. In skill context, this materially increases risk because a user seeking memory compression may unknowingly authorize extensive local persistence and file manipulation beyond the apparent purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior includes broad filesystem modification, backups of existing directories and cron data, and registration of automation jobs, while no permissions are declared. In skill context, this materially increases risk because a user seeking memory compression may unknowingly authorize extensive local persistence and file manipulation beyond the apparent purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior includes broad filesystem modification, backups of existing directories and cron data, and registration of automation jobs, while no permissions are declared. In skill context, this materially increases risk because a user seeking memory compression may unknowingly authorize extensive local persistence and file manipulation beyond the apparent purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented behavior includes broad filesystem modification, backups of existing directories and cron data, and registration of automation jobs, while no permissions are declared. In skill context, this materially increases risk because a user seeking memory compression may unknowingly authorize extensive local persistence and file manipulation beyond the apparent purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior includes broad filesystem modification, backups of existing directories and cron data, and registration of automation jobs, while no permissions are declared. In skill context, this materially increases risk because a user seeking memory compression may unknowingly authorize extensive local persistence and file manipulation beyond the apparent purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior includes broad filesystem modification, backups of existing directories and cron data, and registration of automation jobs, while no permissions are declared. In skill context, this materially increases risk because a user seeking memory compression may unknowingly authorize extensive local persistence and file manipulation beyond the apparent purpose.

Ae1

High

• Category: analysis-evasion

Content

scripts/compress.sh --format ultra

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

scripts/compress.sh --format ultra

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

scripts/compress.sh --format ultra

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

scripts/compress.sh --format ultra

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

scripts/compress.sh --format ultra

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Instruction Override

High

• Category: Prompt Injection

Content

### Environment Variables
```bash
export MEMORY_COMPRESSION_DEBUG=1  # Enable debug mode
export MEMORY_COMPRESSION_QUIET=0  # Disable quiet mode
export MEMORY_COMPRESSION_TEST=0   # Enable test mode
```

• Confidence: 70% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Intent-Code Divergence

High

• Confidence: 92% confidence
• Finding: `get_memory_context` builds a temp file that genuinely includes snippets from memory files, creating the expectation that the compression result contains that gathered context. In `compress_ultra`, the input is read into `content` but never used, so the resulting file contradicts the documented/annotated intent of including memory-file content.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill description claims context compression, and the script gathers memory context into a temp file, but `compress_ultra` reads that file into `content` and never writes the content into the output. Instead it produces a metadata summary with counts, sizes, and config fields, which is semantically different from compressing the memory context itself.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Removing enabled marker..."
    if [ -f "$SKILL_DIR/.enabled" ]; then
        local enabled_date=$(cat "$SKILL_DIR/.enabled")
        rm -f "$SKILL_DIR/.enabled"
        echo -e "${YELLOW}Disabled (was enabled on: $enabled_date)${NC}"
    else
        echo -e "${YELLOW}No enabled marker found${NC}"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises automatic compression and cleanup that can modify or delete stored memory data, but it does not clearly warn users about the risk of data loss or the need to review retention, schedules, and target paths before enabling automation. In a memory-management skill, destructive automation is contextually plausible, but the lack of prominent caution increases the chance of accidental data loss or unsafe deployment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises numerous shell-driven operations such as install, enable, cleanup, backup, restore, and cron-style automation, but the manifest shown does not declare any explicit tool scope or permissions. In a skill ecosystem, undocumented shell capability expands trust assumptions and can let a seemingly content-management skill perform filesystem and scheduling actions users did not explicitly authorize.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly advertises automatic compression every 6 hours and daily cleanup of old files, but it does not present a strong up-front warning that local data will be modified and deleted on an ongoing basis. In this context, silent automation over memory files, backups, and logs can cause unintended data loss or persistence changes, especially if users enable it casually from the quick-start commands.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The manifest emphasizes integrated memory management and compression, so creating backups can fit that purpose. However, this file also implements persistent backup creation and separate search-index updates, broadening behavior beyond a straightforward 'main compression script' into archival and indexing operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script creates backup archives and later writes compressed outputs, history files, search indexes, and timestamp files to disk, but it does not present any confirmation prompt or explicit user-facing warning before those file modifications occur. While the script logs its actions, the help text and comments do not clearly disclose that running it will create and update persistent files under the skill data directories.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: In auto mode, the script invokes a secondary cleanup script that can perform additional file operations without giving the caller visibility into that behavior. In a memory-management skill that already modifies local state, this hidden chained action increases the risk of unintended deletion or retention-policy side effects, especially when run from cron or other unattended automation.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The enable script installs a persistent OpenClaw cron job that causes future autonomous agent execution every 6 hours. That goes beyond a one-time local enablement step and creates ongoing background behavior, which is risky because it can repeatedly invoke other scripts without fresh user review, especially in a skill that manages memory and context automatically.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installer automatically provisions a recurring OpenClaw cron job that will execute compression every 6 hours, without an explicit opt-in prompt, dry-run, or clear warning before enabling persistence. In an agent-skill context, silently installing scheduled autonomous actions expands the skill’s privileges and can cause ongoing file processing or future command execution after the user believes installation is complete.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Set permissions
    chmod -R 755 "$SKILL_DIR/scripts"
    chmod 644 "$CONFIG_DIR"/*
    chmod 644 "$DATA_DIR"/*
    
    # Create installation marker

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.