Security audit

Vta Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it installs persistent agent behavior that can read conversation history, write auto-loaded context, and expose local memory state without enough control or safeguards.

Review carefully before installing. Use only if you want persistent motivation state to influence future OpenClaw sessions, and avoid --with-cron unless you are comfortable with recurring agent runs that process transcripts. Treat generated files such as VTA_STATE.md, reward-signals.jsonl, reward-log.jsonl, brain-events.jsonl, and brain-dashboard.html as sensitive; delete or disable them if you do not want conversation-derived state retained or auto-loaded.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: scripts/sync-motivation.sh:38
Finding: Persistent Agent Memory Poisoning Through Auto-Injected Motivation State
Content: View full analysis
= 0.7: implications.append('I can take on complex challenges') implications.append('Proactive mode — suggest improvements, spot opportunities') if drive < 0.4: implications.append('Keep tasks simple until I get a win') implications.append('Small accomplishments will help rebuild drive') if seeking: implications.append(f'Gravitate toward: {seeking[0]}') if anticipating: implications.append(f'Excited about: {anticipating[0]}') impl_text = '\n'.join(f'- {imp}' for imp in implications) if implications else '- No special adjustments' output = f'''# ⭐ How Motivated I'm Feeling *This is my drive/reward state. Not data — lived motivation.* ## Current Drive {drive_feel} (drive: ...[truncated 2735 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: install.sh:56
Finding: Recurring Autonomous Agent Execution Installed Through OpenClaw Cron
Content: View full analysis
/dev/null; then echo "⚠️ 'openclaw' not in PATH. Add these cron jobs manually:" echo "" echo "# Drive decay (every 8 hours)" echo "openclaw cron add --name vta-decay --cron '0 4,12,20 * * *' --session isolated --agent-turn '⭐ Run drive decay: Run $SKILL_DIR/scripts/decay-drive.sh and report new drive level'" echo "" echo "# Reward encoding (every 3 hours)" echo "openclaw cron add --name vta-encoding --cron '45 0,3,6,9,12,15,18,21 * * *' --session isolated --agent-turn 'Run VTA reward encoding. Preprocess signals, detect rewards, log them, sync state.'" else echo " Creating vta-decay..." openclaw cron add --name vta-decay \ --cron '0 4,12,20 * * *' \ --session isolated \ --agent-turn "⭐ Run drive decay: Run $SKILL_DIR/scripts/decay-drive.sh and report new drive level" 2>/dev/null && echo " ✅ Created" || echo " ⏭️ Already exists" echo " Creating vta-encoding..." openclaw cron add --name vta-encoding \ --cron '45 0,3,6,9,12,15,18,21 * * *' \ --session isolated \ --agent-turn "Run VTA reward encoding: 1) Run preprocess-rewards.sh 2) Read encode-rewards.md 3) Log rewards found 4) Resolve fulfilled anticipations 5) Sync state 6) Update watermark" 2>/dev/null && echo " ✅ Created" || echo " ⏭️ Already exists" fi fi ``` ### Technical Analysis The documented installation path uses `--with-cron`, which registers two recurring OpenClaw jobs. The encoding job launches an isolated agent turn every three hours, processes conversation content, changes persistent reward and anticipation state, and regenerates the automatically injected sta ...[truncated 1540 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/preprocess-rewards.sh:7
Finding: Overbroad Collection and Duplication of Conversation Transcript Content
Content: View full analysis
/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('lastProcessedSignal',''))" 2>/dev/null || echo "") fi SESSION_FILE=$(ls -t "$TRANSCRIPT_DIR"/*.jsonl 2>/dev/null | head -1) if [ -z "$SESSION_FILE" ]; then echo "No session transcript found" exit 1 fi ``` The transcript extraction includes every qualifying user message, even when no reward keyword is present: ```python with open(session_file, 'r', encoding='utf-8', errors='replace') as f: for line in f: line = line.strip() if not line: continue try: data = json.loads(line) except json.JSONDecodeError: continue # ... if data.get('type') != 'message': continue msg = data.get('message', {}) role = msg.get('role', '') if role not in ['user', 'assistant']: continue # ... text = text[:800] text = re.sub(r'[\x00-\x1f]', ' ', text) text = ' '.join(text.split()) if len(text) < 10: continue # ... text_lower = text.lower() has_reward = any(kw in text_lower for kw in reward_keywords) # Include user messages + reward-relevant assistant messages if role == 'user' or has_reward: signals.append({ 'id': msg_id, ...[truncated 2055 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate-dashboard.sh:82
Finding: Stored HTML and JavaScript Injection in Generated Brain Dashboard
Content: View full analysis
= 0.7)] | length' "$HIPPOCAMPUS_FILE") TOP_MEMORIES=$(jq -c '[.memories | sort_by(-.importance) | .[:5] | .[] | {id, domain, importance, summary: (.content[:80] + "...")}]' "$HIPPOCAMPUS_FILE") fi # Read VTA if available DRIVE=0.5 SEEKING="[]" ANTICIPATING="[]" RECENT_REWARDS="[]" if [ "$HAS_VTA" = "true" ]; then DRIVE=$(jq -r '.drive // 0.5' "$VTA_FILE") SEEKING=$(jq -c '.seeking // []' "$VTA_FILE") ANTICIPATING=$(jq -c '.anticipating // []' "$VTA_FILE") RECENT_REWARDS=$(jq -c '[.recentRewards[-5:] // [] | .[] | {type, source, intensity}]' "$VTA_FILE") fi ``` The values are embedded directly inside an executable inline script: ```bash cat >> "$OUTPUT_FILE" << JSDATA const state = { hippocampus: { installed: $HAS_HIPPOCAMPUS, topMemories: $TOP_MEMORIES }, amygdala: { dimensions: { valence:$VALENCE, arousal:$AROUSAL, connection:$CONNECTION, curiosity:$CURIOSITY, energy:$ENERGY, trust:$TRUST, anticipation:$ANTICIPATION }, recentEmotions: $RECENT_EMOTIONS }, vta: { installed: $HAS_VTA, drive: $DRIVE, seeking: $SEEKING, anticipating: $ANTICIPATING, recentRewards: $RECENT_REWARDS } }; JSDATA ``` The dashboard then renders these fields with `innerHTML`: ```javascript if (state.hippocampus.installed) { const memEl = document.getElementById('topMemories'); if (state.hippocampus.topMemories?.length) { state.hippocampus.topMemories.forEach(m => { memEl.innerHTML += `
${(m.importance*100).toFixed(0)}%
Remediation: View remediation
`, `&`, U+2028, and U+2029. 3. Prefer loading state from a dedicated JSON file rather than embedding mutable data into an inline script. 4. Apply a restrictive Content Security Policy that prohibits inline scripts and event handlers. 5. Validate and constrain all memory, emotion, seeking, anticipation, and reward fields before dashboard generation. 6. Treat values from all workspace memory files as untrusted, even if they were generated by another local skill. 7. Add automated tests using payloads containing HTML tags, event handlers, template-literal characters, and script-termination sequences. 8. Escape `AGENT_NAME` and any other values interpolated directly into HTML attributes or text nodes. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is a motivation/reward system, but the documented behavior extends into dashboard generation, cross-skill discovery, reading identity/avatar metadata, and accessing other memory/emotional-state files. This mismatch undermines informed consent and can hide materially broader data access than a user would expect from the description, especially when combined with persistent workspace writes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly states that installation and cron jobs generate files in the workspace and that VTA_STATE.md is automatically injected into every session, but it does not present this as an opt-in behavior or clearly warn users that persistent workspace and session-context modification will occur. For an agent skill, silent persistence and automatic context injection can alter downstream agent behavior in ways the user did not knowingly authorize, which is a genuine security and trust concern even if framed as a feature.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says the generated VTA_STATE.md is 'auto-injected into every session,' which means the skill is designed to influence all future agent interactions by default rather than only when the user deliberately enables it. In the context of a 'reward and motivation' system, this is especially sensitive because it persistently adds behavioral framing to the model's context and can bias responses, priorities, or autonomy without per-session consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and instructs use of shell scripts, file reads/writes, environment access, and cron setup, but does not declare an explicit tool scope or permissions boundary. That makes the operational capability broader and less transparent to users and reviewers, increasing the risk of over-privileged execution or unexpected side effects during installation and runtime.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The install flow enables persistent cron-based execution and creates a markdown file intended for automatic session-context injection, but the skill description does not prominently warn about either behavior before installation. Persistent background execution and automatic prompt/context injection are security-sensitive because they can continuously modify agent state and influence future sessions without fresh user review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents transcript-derived reward extraction and persistent event logging, but does not provide a clear privacy warning about collecting, deriving, and retaining behavioral/session data over time. This can expose sensitive conversational content, inferred preferences, and activity patterns if logs or derived state files are later accessed by other tools, skills, or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The prompt directs the agent to read conversation-derived data and then modify persistent memory/state files via several scripts, but it provides no user-facing consent, scoping, or confirmation step. In an agent setting, this can cause silent collection and persistence of sensitive conversation content or unintended state changes based on untrusted input, especially because the first step explicitly processes conversation history before analysis.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The clear action empties stored anticipation data and immediately writes the change back to reward-state.json. Although it prints a message after completion, there is no prior confirmation or warning before this irreversible data-clearing operation occurs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script is packaged as a VTA reward/motivation skill but reads hippocampus and amygdala data as well, then renders that broader internal state into a dashboard file. This expands data access beyond the stated scope and can expose sensitive memory and emotional information to anyone who can open the generated HTML, making the mismatch a real security/privacy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script writes a persistent HTML dashboard containing memories, emotional state, rewards, and identity-derived information without warning the user that sensitive internal state will be materialized into a shareable file. This increases the chance of unintended disclosure through local browsing, file sharing, backups, or other processes that can read the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script persistently records event data to a workspace JSONL file without any notice, consent, retention controls, or minimization. Because the logged key=value pairs are fully caller-controlled, upstream components may accidentally include sensitive operational context, identifiers, or behavioral telemetry that then remains on disk and can be accessed later by other processes or users with workspace access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script extracts transcript-derived message text from both user and assistant messages and persists it to a JSONL file under the workspace, creating a durable secondary store of conversation content. Because the stored text can include sensitive prompts, personal data, secrets, or operational context, this increases privacy and data-retention risk, especially since the feature is explicitly designed for long-term reward/memory processing and provides no visible consent or minimization beyond truncation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The clear action empties the .seeking array in the persistent reward-state file and immediately overwrites the original file via mv. Although the script prints a message after the change, there is no prior confirmation prompt or warning before this irreversible state modification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The code parses IDENTITY.md for the agent name and avatar path, then reads and base64-embeds an avatar image into the generated dashboard. Personalization may be useful for presentation, but it is not a direct or obvious requirement of a skill whose stated purpose is a dopamine-like wanting/reward system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document is emitted with <html lang="en">, which hard-codes English as the page language. No surrounding text or logic offers locale selection or explains why English is required, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The generated HTML imports Google Fonts, causing a network request when the dashboard is opened and potentially disclosing usage metadata such as IP address, user agent, and timing to a third party. Because this occurs without disclosure or consent, it is a real privacy issue even though the direct impact is limited.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script opens the output path for writing and overwrites it unconditionally. Although it prints a success message afterward, there is no prior warning, confirmation, or comment/docstring disclosing that running the script will modify or replace the file at the chosen output location.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.