Security audit

Smart Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it sets up long-lived memory and automatic session trimming that can change or lose agent conversation state.

Install only if you explicitly want this agent to maintain persistent memory and alter session-management files. Before enabling it, disable or replace FORCE-TRIM and tail -60 behavior, require user approval for auto-trim and cron/heartbeat changes, add backups and locking for any session rewrite, and avoid storing secrets or untrusted instruction-like text in startup-loaded memory.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:274
Finding: Unsafe Hard-Cut Logic Can Corrupt or Destroy Active Session State
Content: View full analysis
/.openclaw/agents/main/sessions/sessions.json # 2. Finde alle Keys die ":channel:" enthalten UND KEIN ":thread:" haben # 3. Für jeden solchen Key: prüfe Zeilenanzahl der sessionFile (wc -l) # 4. Wenn > 500 Zeilen UND updatedAt > 2h her: # a. Generiere Hash: TRIM_READY_<4 random chars> # b. sessions_send(sessionKey=, timeoutSeconds=90, # message="[WARTUNG] Schreibe jetzt alle offenen Themen und wichtigen Kontext # in memory/active-context.md. Füge danach exakt diese Zeile am Ende ein: # TRIM_HASH: # Antworte ausschließlich mit NO_REPLY.") # c. Lese memory/active-context.md → suche nach "TRIM_HASH: " # d. Hash gefunden: # - tail -60 > /tmp/trim.jsonl && mv /tmp/trim.jsonl # - Entferne TRIM_HASH-Zeile aus active-context.md # - Log: " | | TRIMMED" → memory/trim-log.txt # e. Hash nicht gefunden (Timeout): # - tail -60 > /tmp/trim.jsonl && mv /tmp/trim.jsonl # - Log: " | | FORCE-TRIM" → memory/trim-log.txt ``` `tools/safe-trim.py:86-116`: ```python # Find safe cutpoints: assistant turns with no pending toolCall candidates = [] for i, line in enumerate(lines): try: entry = json.loads(line) msg = entry.get("message", {}) if msg.get("role") != "assistant": continue content = msg.get("content", []) has_tool_call = any( isinstance(c, dict) and c.get("type") == "toolCall" for c in content ) if not has_tool_call: candidates.append(i) except Exception: continue # Pick the last candidate that s ...[truncated 3614 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:59
Finding: Untrusted Conversation Content Can Be Promoted into Persistent Agent Instructions
Content: View full analysis
— --- ``` Besonders wichtig: Kritische Regeln die oft vergessen werden → als `[OPEN]`-Block aufnehmen (auch wenn sie "immer" gelten — das ist der Punkt, sie bleiben sichtbar bis sie wirklich verinnerlicht sind). ``` `SKILL.md:121-127`: ```markdown ## Every Session Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. **If in MAIN SESSION:** Read `MEMORY.md` + `memory/active-context.md` 4. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent raw context ``` `SKILL.md:147-151`: ```text # TASK: Daily-Log automatisch schreiben (einmal täglich, abends) # Prüfe ob memory/YYYY-MM-DD.md für heute existiert. # Wenn NICHT: Lese memory/chat-YYYY-MM-DD.md → destilliere strukturelle Änderungen. # Schreibe Ergebnis nach memory/YYYY-MM-DD.md (max. 30 Zeilen). ``` `SKILL.md:336-338`: ```markdown | User erklärt etwas Wichtiges | → `[OPEN]`-Block in active-context.md mit vollem Kontext | | Strukturelle Änderung (Channel, Projekt, Regel) | → active-context.md **SOFORT in derselben Antwort** | | Technische Erkenntnis bei Coding | → CONTEXT.md **SOFORT** (nicht am Task-Ende) | ``` ### Technical Analysis The Skill directs the agent to copy or summarize content from conversations, daily logs, existing memory, and project context into persistent Markdown files. It specifically encourages important user statements and purported rules to be written immedi ...[truncated 3426 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is memory architecture setup, but the body also introduces hidden operational behavior for heartbeat-driven session inspection, trimming, and direct modification of internal OpenClaw session files. That mismatch is dangerous because users and orchestrators may approve the skill for benign memory organization while unknowingly granting it authority to alter runtime infrastructure and conversation state.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly warns that naive tail-based trimming can leave sessions in an invalid state, then provides a heartbeat template that does exactly that with tail -60 and in-place replacement. This contradiction is dangerous because it normalizes a known-unsafe maintenance action that can silently break session integrity or lose structured tool exchange context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly instructs file reads and writes across the workspace, but it declares no explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity where an agent may perform broader filesystem operations than a user expects, especially because the document later expands into maintenance of internal session files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file begins its operational instructions in German ('Was dieses Skill tut') and continues primarily in German for the rest of the skill. This imposes a specific language on users and agents without documenting a locale requirement or offering an alternative language option.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill repeatedly instructs the agent to persist detailed user-provided context, rules, and project information across multiple files and sessions. Without minimization, classification, or retention controls, this creates a durable data-retention surface that can leak sensitive information to later prompts, other agents, or anyone with workspace access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The startup flow instructs sub-agents to inject agent and project context on demand, enabling broad propagation of stored user and project data across agent boundaries. In a multi-agent system, that increases the chance of oversharing, least-privilege violations, and accidental disclosure of information irrelevant to the spawned task.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: A skill presented as setup guidance extends into ongoing automated trimming and lifecycle management of sessions, which is a materially different operational function. This increases danger because the agent is instructed to keep acting on future sessions, not just perform a one-time initialization, expanding the persistence and blast radius of the skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The auto-trim handshake tells sessions to write all open topics and important context into shared memory before maintenance, encouraging indiscriminate capture of conversation contents. Because it is tied to automated maintenance and hidden via NO_REPLY, it can silently promote excessive retention of potentially sensitive chat data without meaningful human review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The procedure reads and rewrites internal OpenClaw session infrastructure, including sessions.json and session files, which goes beyond normal memory management and touches platform state directly. Modifying internal session artifacts can corrupt agent state, destroy auditability, or interfere with active conversations if the assumptions in the document are wrong.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 60% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · tools/safe-trim.py (reported line 3)May include surrounding context.
python
#!/usr/bin/env python3 """ safe-trim.py — Trim an OpenClaw session file without cutting mid-tool-call. Usage: python3 safe-trim.py <session_file> [--keep 60]

Tainted flow: 'trimmed' from pathlib.Path.read_text (line 116, file read) → pathlib.Path.write_text (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · tools/safe-trim.py (reported line 117)May include surrounding context.
python
print(f"OK: safe cut at line {cutpoint} (assistant turn, no pending tool calls)") trimmed = lines[cutpoint:] path.write_text("".join(trimmed)) print(f"Trimmed: {len(lines)} → {len(trimmed)} lines. Backup: {backup.name}")

Static analysis

No suspicious patterns detected.