🧠 EchoFadeMemory

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:39 AM UTC
• Version: 2.0.0

Overview

This is a real memory helper, but it encourages broad automatic recall and durable storage of personal, project, screenshot, and OCR data without enough consent, scoping, or endpoint safeguards.

Install only if you intentionally want an always-available long-term memory layer and trust the echo-fade-memory service endpoint. Use a local or authenticated HTTPS endpoint, avoid the always-on hook unless needed, narrow hook matchers, review each memory before storing it, and avoid storing secrets, precise personal data, regulated data, screenshots, or OCR text unless the user clearly opts in.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: hooks/openclaw/handler.js:8

Finding

Agent Bootstrap Instruction Injection Alters Default Memory Behavior

Content

View full analysis

{ if (!event || typeof event !== "object") { return; } if (event.type !== "agent" || event.action !== "bootstrap") { return; } if (!event.context || typeof event.context !== "object") { return; } if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: "ECHO_FADE_MEMORY_REMINDER.md", content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt hook emits a similar instruction block: ```sh cat <<'EOF' Before answering, check whether durable memory should be part of the workflow: - Recall relevant prior context first - Prefer proactive recall for private-chat questions about user state, recent facts, previous decisions, or omitted context - Over-trigger low-cost recall rather than answering as if no history exists - Store new durable preferences, decisions, corrections, or lessons - Reinforce memories that proved use ...[truncated 1940 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/activator.sh:5

Finding

Proactive Persistence of Sensitive User Context Without a Consent Gate

Content

View full analysis

Before answering, check whether durable memory should be part of the workflow: - Recall relevant prior context first - Prefer proactive recall for private-chat questions about user state, recent facts, previous decisions, or omitted context - Over-trigger low-cost recall rather than answering as if no history exists - Store new durable preferences, decisions, corrections, or lessons - Reinforce memories that proved useful - Ground fuzzy memories before trusting them High-priority recall cues: - 今天、刚刚、最近、这次、还是、又、依然 - 上次、之前、你还记得吗、你不是知道吗、你忘了？ - 那个、这个、继续刚才的、你知道的 - what the user is wearing, where they are, what they recently said or did ``` The storage wrapper accepts and transmits the supplied content without a sensitivity or consent check: ```python payload = {"object_type": args.object_type} if args.object_type == "memory": if not args.payload: raise SystemExit("usage: store.sh [--summary TEXT] [--type TYPE]") payload.update( { "content": args.payload, "memory_type": args.memory_type, "summary": args.summary, "importance": float(args.importance), "source_kind": args.kind, "source_ref": args.ref, } ) if args.conflict_group: payload["conflict_group"] = args.conflict_group ``` ### Technical Analysis The hook recommends proactively processing private-chat details, including what a user is wearing, where the user is, and what the user recently said or did. The project documentation similarly encourages immediate storage of durable preferences, decisions, corrections, screenshots, and other visual artifacts. The storage path does not implement ...[truncated 1670 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/store.sh:38

Finding

Persistent Prompt Injection Through Unsanitized Stored and Recalled Memory

Content

View full analysis

[--summary TEXT] [--type TYPE]") payload.update( { "content": args.payload, "memory_type": args.memory_type, "summary": args.summary, "importance": float(args.importance), "source_kind": args.kind, "source_ref": args.ref, } ) if args.conflict_group: payload["conflict_group"] = args.conflict_group ``` Recalled results are emitted directly for downstream agent consumption: ```python base_url, query, k = sys.argv[1], sys.argv[2], sys.argv[3] req = urllib.request.Request( f"{base_url.rstrip('/')}/v1/tools/recall", data=json.dumps({"query": query, "k": int(k)}).encode("utf-8"), headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode("utf-8")) print(json.dumps(data, indent=2, ensure_ascii=False)) ``` The bootstrap reminder encourages the agent to use recalled content before answering: ```javascript Before answering: - Recall relevant project memory first - Ground memories if they look fuzzy or uncertain ``` ### Technical Analysis The memory store accepts arbitrary text without distinguishing factual data from executable-looking agent instructions. There is no content normalization, imperative-language filtering, trust classification, provenance validation, or policy preventing stored content from attempting to alter agent behavior. The recall wrapper prints the server response directly. When that output is supplie ...[truncated 1808 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_resolve_base_url.py:12

Finding

Unrestricted Configurable HTTP Endpoint Can Exfiltrate Memory Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a general long-term memory orchestration capability built on an echo-fade-memory service, including proactive recall and early storage of durable facts and artifacts. The supplied code does not implement such a workflow. Instead, it merely inspects command output for common error indicators and, upon finding one, prints a reminder recommending that a workaround be stored as memory. This is a materially different primary purpose: error detection and conditional prompting, not memory retrieval or storage. There is no actual interaction with a memory backend, no recall of prior context, and no handling of the broad categories of information named in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says the skill should support long-term memory by proactively recalling prior context and storing durable facts or visual artifacts. However, the supplied code only implements a forget operation against the memory service, posting to /v1/tools/forget with a query or ID and optional object type. That is materially different from the declared primary purpose: it removes or suppresses memory entries rather than recalling or storing them. This is not just a supporting detail; it is a distinct memory-deletion capability not represented in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill provides a long-term memory workflow that retrieves and stores user/session memory via the echo-fade-memory service. The supplied code does not implement recall, storage, context handling, or any memory workflow behavior. It only checks whether the backing service is healthy by calling its /v1/healthz endpoint. That is a materially different primary purpose, so this is a clear description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The description presents a broader memory workflow that should proactively use prior context and prefer recall before answering, implying both retrieval and storage behavior. The actual code chunk is narrowly scoped to storing data: it parses CLI arguments, supports memory or image objects, and sends them to a storage endpoint. There is no code for recalling memories, searching prior context, or deciding when to use memory before answering. While storing durable facts and visual artifacts aligns with part of the description, the primary behavior of this chunk is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural trigger list is extremely broad and includes common conversational markers like 'continue', 'recently', 'again', and 'you know', which can cause the agent to invoke memory recall/store workflows without clear user intent. In this skill's context, that is especially risky because the workflow is designed to persist durable facts, screenshots, OCR text, and personal state, potentially leading to overcollection, unintended retention, or privacy leakage.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to match ordinary conversation such as 'remember this' or 'didn't I say this before,' which can cause the agent to invoke long-term memory flows without a clear, scoped user intent to persist or retrieve durable data. In a memory skill, this increases the chance of over-collection, unnecessary retention, and accidental cross-session use of sensitive personal or project information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document explicitly instructs the agent to 'immediately store' user preferences, long-term constraints, decisions, corrections, screenshots, and other artifacts, but provides no requirement for user notice, consent, minimization, or sensitivity checks. This is especially dangerous because screenshots and durable user facts may contain secrets, personal data, tokens, internal documents, or regulated information that could be retained and later surfaced outside the user's expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises shell, file, environment, and network-capable behavior but does not declare any explicit tool scope or permission boundary. In an agent setting, that increases the blast radius because memory operations may touch local files, screenshots, OCR text, and HTTP endpoints without a clear least-privilege contract.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages storing user facts, preferences, screenshots, receipts, OCR text, and recent personal state in long-term memory but does not clearly warn about retention, sensitivity, or downstream exposure. That omission can result in users or operators unknowingly persisting sensitive personal or visual data to a memory service, which is a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructional content is entirely written in Chinese and directly prescribes behavior for when to use the skill, without offering a language choice or documenting a justified locale restriction. This can violate language/locale policy when the broader environment or user has not opted into Chinese-only guidance.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

This setup persists automatic hook execution in agent settings, creating ongoing session-level behavior that will continue across future interactions. Persistent command hooks are security-relevant because they extend the lifetime of trust in local scripts and can magnify the impact of later script modification, path hijacking, or user misunderstanding about what is running automatically.

Content

Scanner excerpt · references/hooks-setup.md (reported line 28)May include surrounding context.

Claude Code Setup

Create .claude/settings.json:

json

{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation instructs users to register shell command hooks that execute automatically on prompt and tool events, but it does not front-load a clear warning that these are automatic command executions inside the agent environment. Even if the referenced scripts are intended to be lightweight, normalizing unattended command hooks increases attack surface and can surprise users into enabling code execution they may not fully review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file configures UserPromptSubmit with an empty matcher, which is an overly broad activation condition and provides no specificity about when the hook should or should not run. Because the document repeats this pattern as recommended setup, it risks unintended invocation on ordinary prompts rather than a narrowly defined context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script explicitly instructs the agent to proactively recall and store durable user facts, recent state, decisions, and even visual artifacts, but provides no requirement for user notice, consent, minimization, or sensitivity checks. In a memory skill, this makes privacy harm more likely because the behavior is framed as default and proactive, increasing the chance of collecting or reusing personal data beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the caller-provided query to a remote HTTP endpoint without any inline warning, consent prompt, or data-sensitivity check. In a memory skill, queries may contain prior conversation context, personal facts, or other sensitive user data, so silent transmission to an external service creates a real privacy and data-handling risk even if this is intended functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends user-provided memory content, image paths/URLs, OCR text, tags, and related metadata to a remote endpoint with no user-facing disclosure, confirmation, or visible indication at the point of transmission. In a long-term memory skill, this is security-relevant because the data is likely to include sensitive personal context, durable facts, prior session content, and images, so silent transmission increases privacy and consent risk even if the destination service is expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The reminder explicitly encodes activation guidance using a Chinese phrase ("记住这个") alongside English, but provides no language-choice mechanism or statement that trigger languages are configurable. This can create a language/locale policy issue because the skill bakes in specific language expectations rather than making them user-selectable or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 58% confidence

Finding

The natural-language setup presents unconditional activation on every submitted prompt as the primary configuration, using an empty matcher with no opt-in narrowing at the point of recommendation. While not a strong violation, this can be read as enforcing a universal behavior without presenting user-choice-first guidance until much later in troubleshooting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions define high-priority recall cues using Chinese phrases, which imposes a specific language preference in the skill behavior without documenting user choice or opt-in. This can create a language/locale policy concern because the skill appears tuned to one language without stating that it is optional or region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.