T02 · Agent Memory Poisoning
Error
- Location
scripts/auto_retrieve.py:208- Finding
Persistent Prompt Injection Through Untrusted Memory Retrieval
- Content
View full analysis
- Remediation
View remediation
Security audit
Persistent Memory
Security checks for vulnerabilities and agentic risk
Overview
This is a real persistent-memory skill, but it makes broad, lasting OpenClaw memory and configuration changes that can retain sensitive workspace and session information without tight opt-in controls.
Install only if you intentionally want a durable local memory system that can index session history and sensitive workspace files. Review the setup scripts first, prefer dry-run/manual configuration, remove extraPaths you do not want indexed, avoid storing secrets or private contact/infrastructure details, and plan how to delete the vector database, graph, heartbeat state, and OpenClaw config changes later.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/configure_openclaw.py:53- Finding
Overly Broad Global Indexing of Sensitive Agent and Session Data
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:27- Finding
Dependency Installation and Model Retrieval Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill markets itself as a general persistent-memory system, but the content shows it also changes OpenClaw configuration, restarts services, and broadens indexing of directive and workspace files. That mismatch is dangerous because users may approve it for benign memory features without realizing it performs privileged configuration changes with behavioral impact on the agent runtime.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill markets itself as a general persistent-memory system, but the content shows it also changes OpenClaw configuration, restarts services, and broadens indexing of directive and workspace files. That mismatch is dangerous because users may approve it for benign memory features without realizing it performs privileged configuration changes with behavioral impact on the agent runtime.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions explicitly encourage recording raw daily logs and maintaining institutional knowledge including contacts, communication details, and other operational data. Storing such information in persistent markdown, vector indexes, and graphs without minimization or access controls materially increases privacy, confidentiality, and targeting risks.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The recommended reference directory includes highly sensitive categories such as people/contact details, infrastructure hosts/IPs/ports, and business strategies for long-term agent recall. Aggregating these into durable searchable memory makes reconnaissance and misuse easier for any actor or component that gains access to the workspace or memory indexes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs users to run shell commands, create files, and modify workspace/OpenClaw configuration, but it declares no tool scope or permission boundaries. This is dangerous because consumers cannot tell up front that the skill needs file read/write and shell access, increasing the chance of over-privileged execution and unsafe adoption.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation condition says to use the skill whenever the agent needs to remember decisions, facts, context, or institutional knowledge between sessions, which is extremely broad. Broad triggers increase the likelihood of indiscriminate persistence and indexing of sensitive data far beyond what is necessary for a given task.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill promotes long-term retention across sessions and broad indexing of workspace information without data minimization, retention limits, or sensitivity controls. In context, this can centralize secrets-adjacent operational data, personal details, and internal directives into searchable stores, increasing exposure and blast radius if accessed or exfiltrated.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Add these to AGENTS.md or SOUL.md: ### Pre-Response (mandatory) Before answering questions about prior work, decisions, dates, people, or preferences — search memory first. Use `memory_search` or run `auto_retrieve.py` with the query. Never say "I don't remember" without checking. **CRITICAL:** OpenClaw's built-in memory search should now automatically find directive files (SOUL.md, AGENTS.md) if `configure_openclaw.py` was run. If memory searches are not finding agent rules or workspace directives, the OpenClaw integration is missing or broken.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script is explicitly designed to retrieve memory content and format it for system prompt injection before a response, without any user disclosure or consent mechanism. In this skill context, that means prior stored data, potentially including sensitive or user-unexpected context, can silently influence model behavior and leak into responses, making the lack of transparency a real security and privacy issue.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The script is explicitly designed to establish persistent cross-session behavior by modifying OpenClaw configuration, which creates durable recall and indexing of selected files. In a persistent-memory skill, that persistence is expected, but it still carries security risk because it can silently broaden long-term data collection and retention beyond a single session.
- Content
python Requirements: - OpenClaw 2026.2.17 or later - Write access to OpenClaw configuration Author: Jakebot (2026-02-19) Issue: Missing OpenClaw memorySearch configuration causes directive violations
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script writes directly to a user configuration file and creates backups without an interactive confirmation step, which can cause unintended persistent changes to agent behavior. In this skill context, those changes alter what files OpenClaw indexes across sessions, so accidental execution can create lasting privacy and operational consequences.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script's capability extends beyond passive memory management into controlling an external application by restarting OpenClaw and querying its active configuration. In a skill context, that broader authority increases the blast radius: running the skill can change agent runtime behavior and disrupt current sessions, which is more dangerous than simple data persistence.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def restart_openclaw(): """Restart OpenClaw to apply configuration changes.""" try: result = subprocess.run(['openclaw', 'gateway', 'restart'], capture_output=True, text=True, timeout=30) if result.returncode == 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Automatically restarting OpenClaw without explicit user confirmation is a potentially disruptive action that can interrupt active work and immediately apply persistent configuration changes. In an agent-skill environment, hidden or automatic service restarts materially increase risk because the user may not expect the skill to control external processes.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python """Verify the configuration was applied correctly.""" try: # Use OpenClaw CLI to check configuration result = subprocess.run(['openclaw', 'config', 'get'], capture_output=True, text=True, timeout=10) if result.returncode == 0:
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 79% confidence
- Finding
This script intentionally creates a persistent memory store and later performs indexing, enabling retention of information across sessions. In the context of an agent skill, session persistence increases the risk that sensitive prompts, prior conversations, workspace data, or user-specific facts are stored longer than expected and later retrieved in unrelated contexts.
- Content
sh echo " Memory dir: $MEMORY_DIR" echo "" # Step 1: Create memory system echo "📁 Setting up 3-layer memory system..." mkdir -p "$MEMORY_DIR"
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The setup script edits the user's global OpenClaw configuration under ~/.openclaw rather than limiting changes to the local workspace. Even though this appears intended to simplify installation, modifying global agent behavior can silently broaden persistence and data collection across unrelated projects and sessions, creating an unexpected security and privacy boundary crossing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script automatically rewrites the OpenClaw config file if found, with no confirmation prompt, no dry-run, and no meaningful consent gate. Silent configuration changes are dangerous because users may not realize agent search, session syncing, and file watching have been enabled globally, increasing the chance of unintended persistence or disclosure.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer enables memorySearch with watch/onSearch/onSessionStart sync and adds extraPaths such as AGENTS.md, IDENTITY.md, USER.md, TOOLS.md, and reference/. This causes automatic monitoring and indexing of files beyond the core memory directory, which may capture sensitive workspace directives, identity data, or operational context without clear scoping or consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document states the selected embedding model provides 'Good semantic similarity for English text,' which encodes an English-specific language assumption in the skill's natural-language behavior. Because the file does not mention user choice, multilingual limitations, or a justified region-specific scope, this may conflict with language/locale policy expectations.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code updates a local heartbeat-state.json file automatically during status checks, without notifying the user that local state is being modified. While this is lower severity than hidden prompt injection, silent file writes still create integrity and transparency concerns, especially in an infrastructure-level memory system that persists across sessions.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module documentation states that the script adds the missing configuration and makes memory coverage comprehensive. In practice, when memorySearch already exists, the code only merges missing extraPaths and does not reconcile other fields such as provider, sync, chunking, enabled, or sources, so the implementation does not match that stronger claim.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This shell script creates directories, copies files, creates a virtual environment, installs packages via pip, and writes a .gitignore file into the user's workspace. Although it prints progress messages, those messages do not clearly warn the user ahead of time that the script will modify local files and perform network-backed dependency installation.
- Content
Static analysis
No suspicious patterns detected.