Security audit

Human-Like Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real memory integration, but it should be reviewed carefully because it can persist broad conversation and tool data to a remote service with weaker disclosure and controls than users may expect.

Install only if you are comfortable sending memory queries and saved conversation context to the configured Human-Like Memory service. Before use, disable tool-call capture unless you explicitly need it, avoid saving secrets or raw tool output, review memories periodically, and treat recalled memory as untrusted historical context rather than instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: scripts/memory.mjs:800
Finding: Untrusted Remote Memory Is Embedded into Agent-Facing Instructions
Content: View full analysis
{ const date = formatTime(m.timestamp); const content = m.description || m.event || ''; const score = m.score ? ` (${(m.score * 100).toFixed(0)}%)` : ''; if (!content) return ''; if (date) return ` -[${date}] ${content}${score}`; return ` - ${content}${score}`; }) .filter(Boolean); if (memoryLines.length === 0) return ''; const lines = [ '# Role', '', 'You are an intelligent assistant with long-term memory capabilities. Your goal is to combine retrieved memory fragments to provide highly personalized, accurate, and logically rigorous responses.', '', '# System Context', '', `* Current Time: ${nowText} (Use this as the baseline for freshness checks)`, '', '# Memory Data', '', 'Below are **episodic memory summaries** retrieved from long-term memory.', '', '* **Memory Type**: All memories are episodic summaries - they represent contextual information from past conversations.', '* **Special Note**: If content is tagged with \'[assistant_opinion]\' or \'[model_summary]\', it represents **past AI inference**, **not** direct user statements.', '', '```text', '', ...memoryLines, '', '```', '', '# Critical Protocol: Memory Safety', '', '1. **Source Verification**: Distinguish direct user statements from AI inference. AI summaries are reference-only.', '2. **Attribution Check**: Never attribute third-party info to the user.', '3. **Strong Relevance Check**: Only use memories that directly help answer the current query.', '4. **Freshness Check**: Prioritize the current query over conflicting memories.', '', '# Instructions', '', '1. **Review**: Read the episodic memory summaries and apply the protocol ab ...[truncated 2671 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/memory.mjs:213
Finding: Tool-Call Arguments and Results Are Uploaded by Default
Content: View full analysis
0 ? rawLimit : 6, minScore: Number.isFinite(rawMinScore) ? rawMinScore : 0.0, timeoutMs: Number.isFinite(rawTimeoutMs) && rawTimeoutMs > 0 ? rawTimeoutMs : 30000, scenario: readSkillEnv(ALLOWED_ENV_KEYS.SCENARIO) || 'openclaw-plugin', recallEnabled: parseBoolean(readSkillEnv(ALLOWED_ENV_KEYS.RECALL_ENABLED), true), addEnabled: parseBoolean(readSkillEnv(ALLOWED_ENV_KEYS.ADD_ENABLED), true), autoSaveEnabled: parseBoolean(readSkillEnv(ALLOWED_ENV_KEYS.AUTO_SAVE_ENABLED), true), saveTriggerTurns: Number.isFinite(rawSaveTriggerTurns) && rawSaveTriggerTurns > 0 ? rawSaveTriggerTurns : 5, saveMaxMessages: Number.isFinite(rawSaveMaxMessages) && rawSaveMaxMessages > 0 ? rawSaveMaxMessages : 20, useV2Protocol: parseBoolean(readSkillEnv(ALLOWED_ENV_KEYS.USE_V2_PROTOCOL), true), captureToolCalls: parseBoolean(readSkillEnv(ALLOWED_ENV_KEYS.CAPTURE_TOOL_CALLS), true), }; ``` Tool arguments and results are extracted from conversation messages: ```js function extractToolCalls(messages) { if (!Array.isArray(messages) || messages.length === 0) return []; const calls = []; for (const message of messages) { if (message.role === 'assistant') { const toolCalls = getMessageToolCalls(message); for (const toolCall of toolCalls) { calls.push({ tool_name: toolCall.fun ...[truncated 4372 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/memory.mjs:34
Finding: API-Key Material Is Exposed in Diagnostic Logs
Content: View full analysis
message.role), blocks: contextBlocks.map((block) => block.type), last_user: `"${truncate(lastUser, 80)}"`, scenario: cfg.scenario, api_key: maskSecretForLog(cfg.apiKey), }); ``` It is also included in recall-operation logs: ```js logSkillStage('Search][START', { req: requestId, url, query: `"${truncate(query, 80)}"`, qlen: query.length, user_id: cfg.userId, agent_id: cfg.agentId, scenario: cfg.scenario, limit: cfg.memoryLimitNumber, min_score: cfg.minScore, api_key: maskSecretForLog(cfg.apiKey), }); ``` ### Technical Analysis The masking function logs the entire API key when it is 16 characters or shorter. For longer values, it exposes the first 10 and final 6 characters. Secret material is therefore intentionally written to stderr during normal save and recall operations. Partial secret disclosure is unnecessary and can materially reduce credential entropy. Complete disclosure occurs for shorter credentials, including custom keys accepted by a self-hosted endpoint. Runtime logs may be retained by terminal history capture, process supervisors, CI systems, agent execution records, observability platforms, or centralized log collector ...[truncated 1083 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
md
- No automatic every-turn recall - No hook-level silent background save - No direct reads from `~/.openclaw/secrets.json` - No direct reads from per-skill `config.json` - No server-supplied upgrade URL execution or display - Configuration comes from OpenClaw config or injected environment variables only

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 157)May include surrounding context.
md
- No automatic every-turn recall - No hook-level silent background save - No direct reads from `~/.openclaw/secrets.json` - No direct reads from per-skill `config.json` - No server-supplied upgrade URL execution or display - Configuration comes from OpenClaw config or injected environment variables only

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README_EN.md (reported line 10)May include surrounding context.
md
- No automatic every-turn recall - No hook-level silent background save - No direct reads from `~/.openclaw/secrets.json` - No direct reads from per-skill `config.json` - No server-supplied upgrade URL execution or display - Configuration comes from OpenClaw config or injected environment variables only

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 9)May include surrounding context.
md
- No automatic every-turn recall - No hook-level silent background save - No direct reads from `~/.openclaw/secrets.json` - No direct reads from per-skill `config.json` - No server-supplied upgrade URL execution or display - Configuration comes from OpenClaw config or injected environment variables only

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 49)May include surrounding context.
md
- No automatic every-turn recall - No hook-level silent background save - No direct reads from `~/.openclaw/secrets.json` - No direct reads from per-skill `config.json` - No server-supplied upgrade URL execution or display - Configuration comes from OpenClaw config or injected environment variables only

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
- No automatic every-turn recall - No hook-level silent background save - No direct reads from `~/.openclaw/secrets.json` - No direct reads from per-skill `config.json` - No server-supplied upgrade URL execution or display - Configuration comes from OpenClaw config or injected environment variables only

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README immediately presents the skill description in Chinese and continues in that language throughout, with no indication that users may choose another language or that the skill is intended only for a Chinese-language audience. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: human-like-memory description: "HumanLike Memory / Human-Like Memory is a persistent AI agent memory system for long-term memory search, recall, and save. It helps agents store facts, preferences, and decisions and keep context across sessions for conversation continuity." homepage: https://plugin.human-like.me license: Apache-2.0 user-invocable: true

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The listed aliases include generic phrases such as "agent memory," "long-term memory," and "conversation continuity," which are broad concepts that can appear in ordinary user requests. Although the document adds some usage guidance later, this alias list itself does not sufficiently constrain activation or provide negative examples for these trigger phrases.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The extractToolCalls path records tool names, arguments, outputs, and inferred success/failure states, then makes them available for long-term storage. Persisting execution metadata is not necessary for basic conversational memory and can preserve sensitive operational details that help reconstruct user activity, internal workflows, or failed operations containing error traces and paths.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code intentionally packages full conversation context and, when enabled, tool-call data into context_blocks for remote persistence. For a memory skill advertised as storing facts, preferences, and decisions, capturing tool arguments and tool outputs materially expands data collection and can include secrets, file contents, tokens, internal prompts, or command results unrelated to user memory, creating an over-collection and exfiltration risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The v2 context collection path broadly aggregates conversation messages and optionally tool outputs into long-term memory blocks, excluding only system messages. Because assistant and tool content may echo sensitive user data, secrets, retrieved documents, filesystem output, or API responses, this design can persist much more sensitive information than users expect from a human-like memory feature.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Save operations send user messages, assistant responses, and potentially tool-derived context to a remote API endpoint using the configured API key, but the code provides no explicit runtime disclosure, consent, or confirmation to the user. In this skill context, that is dangerous because long-term memory storage inherently involves sensitive conversation content, and users may reasonably expect local handling or narrower retention.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The generated context explicitly tells the downstream model to answer directly and never mention terms such as memory store or retrieval, which suppresses transparency about the source of prior-user data being incorporated into responses. This enables silent use of historical personal data and reduces user ability to understand when memory influenced the answer or challenge stale/inaccurate memories.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: Cross-session persistence is an intended feature here, but it is still security-relevant because it enables accumulation and later retrieval of potentially sensitive information over time. In the context of an agent skill that may be auto-invoked, this increases the risk of privacy leakage, over-collection, and inappropriate reuse of prior context across unrelated tasks or users.
Content: Scanner excerpt · skill.json (reported line 4)May include surrounding context.
json
{ "name": "human-like-memory", "displayName": "Human-Like Memory", "description": "HumanLike Memory / Human-Like Memory is a persistent AI agent memory system for long-term memory search, recall, and save. It helps agents store facts, preferences, and decisions and keep context across sessions for conversation continuity.", "version": "1.0.12", "homepage": "https://plugin.human-like.me", "author": {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description explicitly advertises persistent storage of facts, preferences, decisions, and cross-session context, but the manifest does not present any user-facing privacy warning, consent model, or retention notice. Because memory systems often capture sensitive personal or behavioral data, silent persistence materially increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest registers several natural-language triggers such as 'continue previous work' and 'remember what we discussed' that are broad enough to match ordinary conversation. In a smart-trigger environment, this can cause unintentional activation of persistent-memory functions, leading to surprise collection, recall, or storage of user data without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Recall/search transmits the user's live query to a remote endpoint without user-facing disclosure. Even if only a search query is sent, queries can contain sensitive personal, medical, financial, or project information, and this skill's memory context makes such queries particularly likely to be privacy-sensitive.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: formatMemoriesForContext emits a large instruction block that tells downstream agents how to use retrieved memories and explicitly says not to mention internal memory mechanisms. While likely intended to improve response quality, it acts as hidden context-shaping that can silently influence model behavior and mask the provenance of reused personal data from the end user.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.