Security audit

redis-memory-system

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Redis-based memory helper, but it reads cross-session transcripts, installs persistent cron execution, and exposes sensitive memory data in ways users should review carefully.

Review this before installing. Only use it if you intentionally want cross-session transcript ingestion into Redis and are comfortable with cron-based background execution. Prefer an opt-in install path, restrict Redis access, validate usernames, remove or manually approve cron registration, avoid shared Redis databases, and treat stored summaries/transcript excerpts as sensitive data.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

Location: scripts/setup.sh:47
Finding: Installer Creates a Persistent Hourly Cron Task
Content: View full analysis
> /tmp/memory-heartbeat.log 2>&1" (crontab -l 2>/dev/null | grep -v "memory.sh heartbeat"; echo "$CRON_JOB") | crontab - echo "✅ System cron registered (hourly monitoring sentinel)" ``` ### Technical Analysis The installer modifies the current user's crontab and registers `memory.sh heartbeat` for execution every hour. This scheduled task survives the installation process and subsequent OpenClaw sessions. Periodic heartbeat monitoring is related to the Skill's declared functionality and is disclosed in `SKILL.md`. However, the quick-install procedure creates the persistent task automatically, without: - Requesting explicit confirmation. - Offering an installation option that excludes cron registration. - Verifying that the installed script is protected from modification by less-trusted processes. - Providing an uninstall procedure. - Preserving and identifying the entry through a unique, safely managed marker. The cron target is copied into `$OPENCLAW_WORKSPACE/scripts` or `$HOME/.openclaw/workspace/scripts`. If another process can modify that workspace file, the scheduled task becomes a reusable execution mechanism for the replacement code. The cron registration therefore exceeds the minimum privileges needed for manual memory storage and retrieval. It is only necessary for the optional hourly monitoring feature and should not be an unconditional side effect of installation. ### Attack Path 1. A user follows the documented quick-install instructions and runs `scripts/setup.sh`. 2. The installer copies `memory.sh` into the user's OpenClaw workspace. 3. The installer adds an hourly cron entry without requesting separate consent. 4. An attacker or co ...[truncated 718 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/memory.sh:281
Finding: Redis Lua Injection Through an Unvalidated Username
Content: View full analysis
&2; exit 1; } [ -z "$SUMMARY" ] && { echo "❌ Missing content" >&2; exit 1; } redis-cli EVAL " redis.call('HSET', 'memory:$USER', ARGV[1], ARGV[2]) redis.call('EXPIRE', 'memory:$USER', 604800) redis.call('SET', 'activity:${USER}:last_seen', ARGV[3], 'EX', 43200) return 'OK' " 0 "$DATE" "$SUMMARY" "$(date '+%Y-%m-%d %H:%M')" >/dev/null echo "✅ Recorded" exit 0 fi ``` ### Technical Analysis `$USER` is interpolated directly into the Lua program passed to Redis `EVAL`. Although the date, summary, and timestamp are passed safely through `ARGV`, the Redis key names are constructed as Lua source code. A username containing a single quote, closing syntax, and additional Lua statements can terminate the intended string literal and inject attacker-selected Redis commands. Shell quoting does not neutralize this issue because the vulnerability occurs when Redis parses the already-expanded argument as Lua code. The script performs no username validation before this interpolation. The username originates from the positional argument to: ```bash memory.sh set
``` Consequently, any caller allowed to invoke this command can potentially execute arbitrary Lua-supported Redis operations available to the connected Redis user. ### Attack Path 1. An attacker gains the ability to invoke `memory.sh set`, directly or through an agent/tool workflow that forwards an attacker-controlled username. 2. The attacker supplies a username containing Lua string-termination and statement-injection syntax. 3. Bash expands the username inside the multiline `EVAL` argument. 4. `redis-cli` sends the resulting attacker-influenced Lua progr ...[truncated 1076 chars]
Remediation: View remediation
/dev/null ``` Additionally: 1. Validate usernames with a conservative allowlist such as `^[A-Za-z0-9._-]{1,64}$`. 2. Apply the same validation consistently to command-line arguments, `MEMORY_USERS`, and `/etc/memory-users.conf`. 3. Configure a dedicated Redis ACL account limited to the required key prefixes and commands. 4. Avoid sharing the same unrestricted Redis database with unrelated applications. 5. Add regression tests using usernames containing quotes, newlines, Lua comment markers, and control characters. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/memory.sh:221
Finding: Predictable Temporary Warning Files Permit Path Manipulation and Symlink Clobbering
Content: View full analysis
/dev/null || echo "") ys=$(date -d 'yesterday' '+%Y-%m-%d' 2>/dev/null) ys_val=$(redis-cli HGET "memory:${u}" "$ys" 2>/dev/null || echo "") wf="/tmp/memory_warning_${u}.flag" if [ -n "$ts" ]; then rm -f "$wf" elif [ -n "$ys_val" ]; then echo "[$NOW] ⚠️ $u: No entry today" else act=$(redis-cli GET "activity:${u}:last_seen" 2>/dev/null || echo "") [ -n "$act" ] && { echo "[$NOW] 🚨 $u: Active but summary missing ($act)"; echo "$NOW|$u|miss|$act" > "$wf"; } fi ``` ### Technical Analysis The heartbeat action creates or removes files under `/tmp` using a predictable name derived directly from the configured username. The username is loaded from `MEMORY_USERS` or `/etc/memory-users.conf` without validation. The file is written with ordinary shell redirection: ```bash echo ... > "$wf" ``` This operation follows symbolic links. A local attacker able to predict a configured username may pre-create the corresponding `/tmp/memory_warning_.flag` as a symbolic link. When the scheduled heartbeat writes the warning, it can truncate and replace the contents of the symlink target if the cron account has permission to write that target. Characters such as `/` are also not rejected. Depending on pre-existing directory structures, a maliciously configured identifier can cause warning files to be addressed outside the intended flat filename namespace. The code does quote `$wf`, which prevents shell word splitting and wildcard expansion, but quoting does not prevent filesystem traversal semantics or symbolic-link following. ### Attack Path 1. The hourly heartbeat cron task is installed. 2. An attacker determines or influences a configured username. 3. Befo ...[truncated 1364 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as a memory/search helper, but the documented deployment also installs software, starts services, and modifies cron. That is a material expansion of capability: users expecting a data utility may unknowingly authorize host-level persistence and background execution, which increases attack surface and can be abused for covert persistence.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a memory/search helper, but the documented deployment also installs software, starts services, and modifies cron. That is a material expansion of capability: users expecting a data utility may unknowingly authorize host-level persistence and background execution, which increases attack surface and can be abused for covert persistence.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as a memory/search helper, but the documented deployment also installs software, starts services, and modifies cron. That is a material expansion of capability: users expecting a data utility may unknowingly authorize host-level persistence and background execution, which increases attack surface and can be abused for covert persistence.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly states that cron sub-sessions bypass dmScope/session isolation by directly reading transcript files. Deliberately circumventing isolation boundaries is highly dangerous because those boundaries exist to prevent cross-session data access; bypassing them can expose sensitive prompts, secrets, and prior conversation content to unauthorized contexts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes an automatic memory system with semantic tag indexing and semantic search, but sync only reads transcripts, emits JSON containing dialog and existing summary state, and does not persist any new memory. Actual writes occur only in the separate manual set command, so the advertised automatic memory behavior is not implemented in this file.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The sync command includes full extracted dialog lines and existing memory summaries in plain-text JSON output. Because these fields are derived from historical transcripts and Redis-stored memory, the command can exfiltrate sensitive cross-session data through logs, terminals, cron captures, or any caller that can run the script, making the memory-system context especially risky.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly promotes a fully automatic cross-session memory system that stores and queries user dialogue in Redis, but it provides no warning, consent model, retention limits, or privacy safeguards. In an agent context, persistent cross-session storage can capture sensitive personal, authentication, or business data and later resurface it through retrieval or search features, creating privacy, confidentiality, and compliance risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents shell-based setup, cron creation, Redis operations, and filesystem access, but the manifest does not declare an explicit tool scope or allowed-tools policy. In a skill that performs persistent storage and transcript access, missing scope boundaries increases the chance that the runtime grants broader execution than users or reviewers expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented design goes beyond Redis memory/search and includes direct filesystem reads of session transcripts plus cron-based monitoring. That broader behavior changes the trust model because it accesses conversational data outside the nominal storage interface and persists background processing beyond the current session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill automatically reads transcript files across sessions without a clear user-facing warning or consent flow about privacy implications. Because transcripts may contain secrets, personal data, or sensitive operational context, silent collection and summarization creates a meaningful confidentiality risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatically reading conversation transcripts and loading summarized memory across sessions creates persistent retention of natural-language data that may include confidential or regulated information. The cross-session context makes this more dangerous because data can surface later in unrelated interactions, increasing leakage and over-collection risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The architecture instructs a cron job to locate the latest transcript, extract dialogue, summarize it, and write it into persistent storage. That pipeline operationalizes automated collection and retention of potentially sensitive chat content, making accidental disclosure or misuse materially more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Installing system cron jobs and writing flags under /tmp exceed the narrow purpose of a Redis memory/search skill and create background persistence on the host. Even if intended for monitoring, this broadens system impact and can be repurposed to maintain execution or leave artifacts outside the user-visible workflow.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The problem/solution text explicitly recommends direct transcript JSONL reading to overcome isolation between cron and the main session. Because this is framed as a way around a protection boundary rather than a legitimate platform interface, it indicates intentional circumvention that could expose isolated-session data and defeat expected security guarantees.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation claims the cron toolset is limited to exec and read, yet the workflow performs Redis writes and lock manipulation via shell-executed commands. This discrepancy obscures the real side effects of the cron job and may mislead reviewers into believing the job is effectively read-only when it can mutate persistent state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script prints extracted transcript lines directly to stdout, and those lines may contain sensitive user prompts, assistant replies, or tool results from prior sessions. In this skill’s context as a cross-session memory/transcript processor invoked by cron, stdout is likely to be consumed by logs, pipelines, or other automation, which increases the chance of unintended disclosure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The help text presents the skill as supporting only sync/get/set/heartbeat/ping/stats, but the code also implements tag and search commands later in the script. This is a meaningful behavior mismatch because the manifest advertises tag retrieval and semantic search support, while the exposed documentation in the code does not reflect those capabilities and instead understates the actual interface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script reads recent transcript content from session files and emits it as JSON diagnostic output, including user/assistant dialog excerpts and existing summaries. In a memory system handling cross-session conversations, this creates an unnecessary disclosure channel: anyone able to invoke sync or capture its output can access potentially sensitive conversation content without minimization or explicit authorization checks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says the skill supports semantic search, but the search action merely echoes the query and lists all Redis tag index keys. It performs no retrieval, ranking, embedding lookup, or even keyword filtering against stored memories, so the advertised search capability materially exceeds the implemented behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The get command returns stored memory summaries directly with no authentication, authorization, or redaction visible in the script. In a system designed to persist cross-session summaries, that means any caller with shell access to this utility may be able to retrieve potentially sensitive user memory in clear text.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The setup script performs system-level package installation and launches a Redis service, which exceeds a narrow 'memory system' file-copying setup and introduces privileged side effects. This is dangerous because running an installer for an application-level skill unexpectedly changes host software state and starts a background daemon, increasing attack surface and violating least surprise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script installs packages non-interactively and later modifies persistent scheduler state without presenting a warning or confirmation. Silent persistent system changes are risky because users may execute the installer expecting local skill setup, not host modification, and this weakens informed consent around privileged operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script starts a Redis server in the background using daemon mode without prior disclosure that it will launch a persistent service. Undisclosed daemon startup is dangerous because it creates a running networked component and ongoing resource usage, and may expose Redis insecurely depending on host configuration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script persists execution by modifying the user's crontab to run memory.sh hourly, which is a durable change unrelated to a one-time installer and creates ongoing code execution. Persistent scheduled execution is security-relevant because it survives the install session, may run modified scripts later, and can be abused for stealthy background activity.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 99% confidence
Finding: The cron registration creates session persistence by ensuring the installed script runs every hour, establishing ongoing execution beyond the initial install. In the context of an agent skill, persistence is more dangerous because the skill is expected to support memory features, not silently maintain a host-level foothold that can later execute altered script contents.
Content: Scanner excerpt · scripts/setup.sh (reported line 49)May include surrounding context.
sh
# 5. 配置系统 cron 保底监控（每小时） CRON_JOB="0 * * * * $SCRIPTS_DIR/memory.sh heartbeat >> /tmp/memory-heartbeat.log 2>&1" (crontab -l 2>/dev/null | grep -v "memory.sh heartbeat"; echo "$CRON_JOB") | crontab - echo "✅ 系统 cron 已注册（每小时监控哨兵）" # 6. 安装验证

Static analysis

No suspicious patterns detected.