Smart Memory

Security checks across malware telemetry and agentic risk

Overview

This memory skill also sets up recurring session-history maintenance that can rewrite internal OpenClaw session files, including an unsafe raw trim path.

Install only after reviewing and likely removing or rewriting the automatic session-trimming section. Back up MEMORY.md, AGENTS.md, HEARTBEAT.md, memory/, and .openclaw session files first, and prefer a vetted boundary-aware trim tool with explicit user approval over the raw heartbeat commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to read and write multiple files (`MEMORY.md`, `memory/*`, `AGENTS.md`, `HEARTBEAT.md`) but does not declare corresponding permissions. Undeclared file access is dangerous because it hides the true capability surface from reviewers and can lead to unexpected modification of persistent agent state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The stated purpose is memory setup, but the skill also introduces operational session inspection and trimming logic against internal session storage. That materially expands behavior into maintenance of runtime/session artifacts, creating a hidden destructive capability that could delete context, corrupt sessions, or interfere with auditability beyond what a user would expect from the description.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The session-lifecycle section adds active session-management procedures that go beyond configuring a memory architecture, including heartbeat-driven maintenance and trim workflows. This is dangerous because it encourages the agent to manipulate live conversation/session state, which increases the risk of unintended data loss and broadens the trust boundary of the skill.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The document claims sessions must never be directly trimmed, yet the heartbeat template later performs `tail -60 ... && mv ...` direct trimming on session files. This contradiction is dangerous because operators may rely on the stated safety rule while the actual instructions still perform unsafe destructive edits, potentially cutting through structured JSONL/tool-call boundaries and breaking agent session integrity.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal