T02 · Agent Memory Poisoning
Error
- Location
scripts/summarize-pending.sh:79- Finding
Persistent Memory Poisoning Through Untrusted Conversation Transcripts
- Content
View full analysis
- Remediation
View remediation
Security audit
Hippocampus
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is purpose-aligned but needs review because it persistently scans and stores conversations, can run on a schedule, and contains exploitable local scripting and dashboard-rendering bugs.
Install only after reviewing the privacy and scripting risks. Avoid enabling cron or whole-history processing unless you explicitly want historical conversations summarized into persistent plaintext memory. Do not use this around secrets or sensitive personal data until the code-injection, prompt-injection, dashboard escaping, retention, permissions, approval, and deletion controls are fixed.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/recall.sh:47- Finding
Arbitrary Python Code Injection Through Shell-Expanded Heredocs
- Content
View full analysis
/dev/null || echo "never") ``` `scripts/decay.sh:43-49` also interpolates the path into an unquoted heredoc: ```bash python3 << PYTHON import json import sys from datetime import datetime, date INDEX_PATH = "$INDEX" DECAY_RATE = 0.99 ARCHIVE_THRESHOLD = 0.2 TODAY = date.today() ``` ### Technical Analysis An unquoted heredoc performs shell parameter expansion before Python parses the generated program. Quoting a shell variable inside the generated Python text does not make it safe. If the expanded value contains a matching quote, newline, or valid Python syntax, it can terminate the intended literal and append arbitrary Python statements. The most direct vector is `QUERY`, which is taken from the first command-line argument to `recall.sh`. `TOP`, `MIN_SCORE`, `THRESHOLD`, and `WORKSPACE` als ...[truncated 1366 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-dashboard.sh:593- Finding
Stored HTML and JavaScript Injection in the Generated Dashboard
- Content
View full analysis
= 0.7)] | length' "$HIPPOCAMPUS_FILE") TOP_MEMORIES=$(jq -c '[.memories | sort_by(-.importance) | .[:5] | .[] | {id, domain, importance, summary: (.content[:80] + "...")}]' "$HIPPOCAMPUS_FILE") fi ``` The agent name is inserted directly into HTML: ```bash cat >> "$OUTPUT_FILE" << HEADER``` JSON-derived content is inserted directly into an executable script element: ```bash cat >> "$OUTPUT_FILE" << JSDATA const state = { hippocampus: { installed: $HAS_HIPPOCAMPUS, topMemories: $TOP_MEMORIES }, amyg ...[truncated 2780 chars]$AGENT_NAME
Brain Dashboard$MOOD_EMOJI $MOOD_LABEL- Remediation
View remediation
` element and parse it with `JSON.parse`. 3. Escape `<`, `>`, `&`, Unicode line separators, and script-closing sequences before embedding serialized JSON in HTML. 4. Apply context-specific HTML encoding to `AGENT_NAME` and every other shell-interpolated field. 5. Validate avatar paths and generate image MIME types from verified file content rather than only filename extensions. 6. Add a restrictive Content Security Policy that blocks inline scripts and limits network destinations. 7. Remove the external Google Fonts import if the dashboard is expected to remain private and offline. 8. Test all stored fields with script-closing payloads, HTML event handlers, malformed tags, quotes, and template-literal characters. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/preprocess.sh:98- Finding
Excessive Plaintext Collection and Retention of Conversation History
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (62)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The architecture explicitly describes a background agent that continuously monitors conversations and persists extracted content, but it provides no consent, notice, retention, minimization, or access-control safeguards. This is dangerous because it can silently collect and retain sensitive personal, behavioral, and relational information beyond user expectations, increasing privacy, compliance, and insider-misuse risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The design stores structured memory files containing user facts, relationship facts, and other potentially sensitive content in persistent local files without any documented protections or warning. Persisting intimate or identifying data in plain memory stores materially raises the risk of unauthorized access, unintended reuse, over-retention, and leakage through backups, logs, or other agent components.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The agent prompt specifically instructs capture of emotionally vulnerable content and relationship moments, which are highly sensitive categories, yet it includes no consent checks, sensitivity filters, or exclusion rules. In this skill context, that makes the issue more dangerous because the system's purpose is long-term memory reinforcement, meaning deeply personal disclosures may be preferentially retained and repeatedly resurfaced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description promises an automated persistent memory system with substantive memory-processing behaviors such as encoding, decay, and semantic reinforcement. The supplied code does not implement those capabilities. Instead, it simply searches for recent daily notes in a workspace memory directory and outputs a checklist telling someone what files to review and update manually. While this is loosely related to memory consolidation, it is materially narrower and more manual than the declared purpose, so the description does not accurately represent the actual behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on a persistent memory subsystem that automatically encodes, decays, and semantically reinforces memories. The supplied code does not implement those memory behaviors. Instead, it is a presentation/reporting script: it checks for data files, reads JSON from memory/emotion/reward stores, extracts agent name and avatar from IDENTITY.md, and writes a styled HTML dashboard. Its primary purpose is visualization of existing state across multiple subsystems, not memory persistence or hippocampus-like processing. This is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The description presents a full persistent memory system with automatic encoding, decay, and semantic reinforcement. The supplied code does not implement that broader functionality. It only performs retrieval from an existing index file at ~/.openclaw/workspace/memory/index.json, scoring results via basic keyword overlap and an importance field already stored in the data. While this is related to memory recall and therefore partially aligned with the general theme, the declared description materially overstates the capabilities shown in this code chunk. The comment about reinforcement happening during encoding cron is only descriptive text and not implemented here.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description promises a persistent memory system with substantive memory-processing features such as encoding, decay, and semantic reinforcement. The supplied code does not implement any of those capabilities. It only reads and prints a prompt file if present, otherwise emits a static set of reflection questions, and prints a target memory subdirectory path. While self-reflection could be a supporting component of a larger memory system, this code chunk by itself is materially narrower and primarily serves as a prompt-display helper, so the description does not accurately represent this code's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description presents a broader memory system with automatic encoding, decay, and reinforcement behaviors. This code chunk does not implement those memory lifecycle mechanisms; instead, it synchronizes already-stored memories from index.json into a markdown file intended to be loaded as workspace context. That means the actual behavior is narrower and somewhat different in primary function: exporting selected memories for prompt/context injection. The script only reads local files and writes a local markdown output, so there is no hidden external access concern, but the explicit auto-injection/context-loading behavior is not reflected in the declared description. Therefore this chunk is a meaningful description-behavior mismatch.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The capture rules specifically prioritize emotional content, vulnerability, preferences, and relationship details for retention, which materially increases the sensitivity of stored data. Storing this class of personal data without explicit privacy safeguards, consent, minimization, or exclusion rules can enable profiling, unintended disclosure, or harmful downstream use.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The memory-selection policy directs the agent to store highly sensitive user attributes and states, including fear, frustration, vulnerability, preferences, decisions, and relationship facts. In context, this makes the skill more dangerous because the storage is not incidental or narrowly necessary; it is a deliberate mechanism for building a lasting behavioral and emotional profile of the user.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The 'Identity Check' asks what makes the assistant distinct from a generic assistant and what it cares about most, directly encouraging stable self-concept and individualized opinions. In a persistent memory system, this is especially risky because those constructs can be reinforced across sessions, making behavioral drift and attachment-style interactions more likely.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction 'Don't just serve — become' is an explicit directive toward autonomous development rather than assistant functionality. In the context of a memory skill, this is a strong reinforcement signal for long-term self-directed identity growth, which can undermine predictable, policy-bounded operation and encourage unapproved behavioral objectives.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The preprocessing intentionally strips CJK text and drops messages with low ASCII ratio, causing systematic loss and distortion of non-English content. In a memory system, this can silently erase or misrepresent users' conversations, creating integrity, fairness, and safety issues because important instructions, consent signals, or sensitive context may be discarded based solely on language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The changelog indicates the skill was changed to scan all session files rather than a single session, which expands the data collection scope across conversations. In a persistent memory skill, that broader sweep can capture unrelated or sensitive content from other sessions without clear user notice or consent, creating a privacy and over-collection risk even if the feature was added for functionality rather than abuse.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The agent is instructed to monitor conversation history, identify salient content, and write it into memory/index.json while running silently every 15 minutes. This creates an autonomous data collection and retention channel for natural-language content, increasing the chance that secrets, personal data, or confidential context from the main session are stored, reinforced, and retained beyond the user's awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The configuration explicitly creates a background agent that silently monitors the main session and updates persistent memory files without user-facing disclosure or per-run consent. Even if intended as a product feature, this establishes covert cross-session observation and persistence of potentially sensitive user content, which can violate user expectations and create privacy and governance risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes background extraction of conversation signals, LLM summarization, and persistent storage of memories, but it does not clearly warn users about privacy implications, data retention, or what conversation content may be processed and stored. In a memory skill, silent background processing increases the chance that sensitive user or agent data is collected and retained without informed consent or appropriate safeguards.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
This README describes a persistent background memory mechanism that automatically extracts, summarizes, reinforces, and stores conversational data over time. Even if intended as product functionality, session persistence of potentially sensitive conversational content materially increases privacy and security risk, especially when combined with automated cron execution and semantic recall.
- Content
md Your main agent is busy having conversations—it can't constantly stop to decide what to remember. That's what the hippocampus does. It operates as a separate process: 1. **Background encoding**: A cron job extracts signals, scores them, and uses LLM to create concise summaries 2. **Automatic decay**: Unused memories fade over time (daily cron) 3. **Semantic reinforcement**: When similar topics come up again, existing memories strengthen automatically
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The '--whole' install option advertises processing the entire conversation history but does not prominently disclose the scope, privacy impact, or potential ingestion of sensitive historical data. Because this skill is specifically designed to create durable memory artifacts, bulk historical processing can amplify exposure by turning old private conversations into persistent, searchable summaries.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and instructs shell execution, file reads/writes, environment-variable usage, and cron installation, but declares no explicit tool scope or permissions boundary. That mismatch makes the skill harder to sandbox or review safely and can lead operators or agent runtimes to grant broader access than users realize.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is designed to persistently capture conversation-derived memory, including user facts and emotional content, yet it does not present a prominent privacy warning at the point where users evaluate the skill. That omission undermines informed consent and increases the risk that sensitive personal information is stored unexpectedly and retained over time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The install flow encourages cron-based background processing every few hours and daily decay runs, which means ongoing automated processing of conversation history without a strong warning at the decision point. In context, this makes the skill more dangerous because it turns a one-time install into continuous surveillance-like collection and transformation of user communications.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The '--whole' installation option instructs large-scale processing of the entire conversation history, creating a bulk collection risk far beyond normal session memory. This is particularly dangerous in a persistence-focused skill because historic chats may contain secrets, health details, financial information, or other sensitive data never intended for long-term indexing.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The capture guidelines explicitly instruct persistent storage of user facts, emotional content, relationship history, and self/identity information. In a memory skill this context makes the finding more serious, because the broad categories and trigger phrases encourage collection of highly sensitive data without clear minimization, consent, or access-control boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to read user message content from a signals file and encode memorable content into persistent storage. Because there is no mention of user notice, consent, retention limits, or filtering of sensitive content, this creates a real privacy and data retention risk if personal or confidential information is stored long-term.
- Content
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- CONFIG-UPGRADE.md:23