Security audit

OpenClaw Memory System

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is not hidden malware, but it installs recurring jobs that read conversation logs, write long-term memory, and delete session files with weak controls.

Install only if you are comfortable with automatic background jobs reading your OpenClaw session logs, retaining summaries in Markdown memory files, and deleting session files. Before use, require explicit opt-in for each cron task, disable or dry-run GC, review what sessions are scanned, add sensitive-data redaction, and document how to pause or uninstall all jobs.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T02 · Agent Memory Poisoning

Error

Location: prompts/l3-weekly-prompt.md:104
Finding: Untrusted Conversation Content Can Poison Persistent Agent Rules
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: prompts/install-prompt.md:167
Finding: Installation Creates Persistent Scheduled Jobs Without Adequate Lifecycle Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: prompts/gc-cleanup-prompt.md:25
Finding: GC Decision Order Can Delete Protected or Legitimate Sessions
Content: View full analysis
10KB（说明有实际内容） ... 对每个文件：检查文件名是否包含 :run: → 是 → 标记删除检查文件大小是否 < 1KB → 是 → 标记删除检查文件大小是否 > 10KB → 是 → 标记保留否则 → 标记保留 ### Step 3: 执行删除删除标记为"删除"的文件。 ``` ### Technical Analysis The documented deletion conditions use “any condition” semantics. A filename containing `:run:` or a file smaller than 1 KB is sufficient to mark it for deletion. The classification sequence evaluates deletion before the large-file retention rule and never defines that a later retention result overrides an earlier deletion result. More importantly, the stated Main, Feishu, and user-session exclusions are not represented in the actual decision procedure. Filename patterns and file size are not reliable proof that a session is disposable. A valid short session may be smaller than 1 KB, while a legitimate or protected session may contain `:run:` in its name. ### Attack Path 1. A legitimate session file is created with less than 1 KB of content, or its filename contains `:run:`. 2. The nightly GC task scans all `.jsonl` files in the configured directory. 3. The file satisfies a deletion condition and is marked for deletion. 4. No metadata-based ownership or protected-session exclusion is applied. 5. The task physically deletes the file without interactive confirmation. ### Impact Assessment The task can irreversibly remove legitimate session history, causing data loss and denial of service for users or integrations relying on that history. Its scope includes every `.jsonl` file reachable under the resolved main-agent sessions directory. No evidence indicates deletion outside that direct ...[truncated 133 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: prompts/l1-hourly-prompt.md:15
Finding: Hourly Task Reads All Main-Agent Session Logs Beyond the Explicit-Marker Model
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: prompts/l2-nightly-prompt.md:38
Finding: Conversation Content Is Persisted Without Sensitive-Data Redaction or Retention Controls
Content: View full analysis
"${ARCHIVE_FILE}" echo "" >> "${ARCHIVE_FILE}" echo "> 归档时间：$(date +%H:%M)" >> "${ARCHIVE_FILE}" echo "" >> "${ARCHIVE_FILE}" echo "---" >> "${ARCHIVE_FILE}" echo "" >> "${ARCHIVE_FILE}" fi cat "${SESSION_STATE}" >> "${ARCHIVE_FILE}" ``` The next step overwrites `SESSION-STATE.md` with only a cursor after the archive is created. ### Technical Analysis The L2 process physically appends the complete L1 state to a durable Markdown archive. The repository does not specify secret detection, personally identifiable information redaction, restrictive file permissions, encryption, archive expiration, maximum retention, or user-controlled deletion. Because L1 derives its content from conversation logs, credentials or personal information included in an extracted task, decision, insight, or context can be copied to L1, L2, backups, and potentially L3. Clearing L1 after archiving does not remove the archived copy. ### Attack Path 1. A user mentions a secret or sensitive personal detail in a phrase matched by L1. 2. The hourly task stores the content in `SESSION-STATE.md`. 3. The nightly task appends the complete state to a dated archive. 4. Installation backups or later migration operations create additional copies. 5. Any actor or process able to read the workspace or backups can access the retained information. ### Impact Assessment Potentially affected data includes credentials, tokens, private decisions, personal information, and confidential work context. The exposure scope includes workspace memory files ...[truncated 208 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: prompts/migrate-prompt.md:39
Finding: Migration Backup Selection Can Restore Stale Data
Content: View full analysis
/dev/null | head -1 ``` ### Technical Analysis `BACKUP_DIR` contains a wildcard pattern rather than a resolved directory. When unquoted during `ls`, shell expansion returns matching backup directories in shell or lexical order. Piping that output to `head -1` generally selects the first name, which is likely the oldest timestamped backup rather than the newest. The shown command only prints a match and does not assign the selected result back to `BACKUP_DIR`. Later instructions refer to `${BACKUP_DIR}`, leaving ambiguity over whether tools should process one backup or all wildcard matches. There is also no canonical-path validation, integrity check, freshness check, or user confirmation for the selected backup. ### Attack Path 1. Multiple timestamped backup directories exist. 2. A user invokes `/migrate-memory`. 3. The wildcard expands to multiple paths. 4. `head -1` identifies the lexicographically first, potentially oldest backup. 5. The migration task reads obsolete or previously poisoned content. 6. Stale tasks, decisions, or persistent rules are reintroduced into active memory. ### Impact Assessment The issue can corrupt memory integrity by restoring outdated records or reintroducing content that a user believed had been superseded. If an attacker can create a matching directory beneath `BASE`, the ambiguity may also influence which data is considered during migration. The demonstrated impact is limited to memory and archive integrity; no arbitrary command execution is established by the provided prompt. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The command rm memory/YYYY-MM-DD.md is a destructive filesystem operation embedded in documentation, and it normalizes use of an unsafe tool parameter without safeguards. In skill/troubleshooting contexts, users often copy-paste commands directly, so even a placeholder path can lead to accidental deletion if replaced incorrectly or executed from the wrong repository location.
Content: Scanner excerpt · references/troubleshooting.md (reported line 59)May include surrounding context.
修复：

bash
# 删除错误文件 rm memory/YYYY-MM-DD.md # 错误日期 # 确保 L2 Prompt 中使用动态日期 TODAY=$(date +%Y-%m-%d)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The GC troubleshooting section recommends bulk find ... -delete operations that can remove multiple files based on broad patterns, again without warnings, dry-run instructions, or recovery guidance. Because the paths are derived from $(pwd) and traverse relative directories, a user running this from an unexpected location could delete unintended session data or other files irreversibly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language instructions, command descriptions, and operational guidance are presented in Chinese throughout the file, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when the skill offers language choice or clearly documents a justified region-specific limitation, neither of which appears here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises and schedules automatic Cron-driven writes and a cleanup job that performs physical deletion, but the top-level description does not present a clear user-facing warning about these background modifications. In an agent skill context, unattended persistence and deletion can surprise users, affect unrelated files if paths are misconfigured, and create integrity/privacy risks even without overtly malicious logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This prompt directs automated deletion of session files based on broad filename and size heuristics, but it does not require an explicit user-facing warning or confirmation about the impact on stored session history. In an agent context, deleting session artifacts can destroy user data, audit trails, or operational state, and the prompt’s 'safety' language may create false confidence despite the risk of misclassification and irreversible removal.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: All required output strings and operational instructions are specified in Chinese, effectively constraining the skill's responses to a single language. The policy says to flag language or locale restrictions unless the skill offers user choice or clearly documents a justified regional constraint, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The task description and role instructions are written entirely in Chinese and implicitly require the skill to operate in that language. There is no indication that the user can choose another language or that the Chinese-only constraint is necessary for a region-specific or compliance-bound use case.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The install prompt instructs registration of multiple cron jobs, including an optional heartbeat, creating persistent background tasks on the user's system. Because the prompt does not prominently warn that installation changes scheduled task state and may continue running automatically after setup, users may grant persistence without informed consent, which is a meaningful security and trust risk for an agent skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The prompt directs an automated cron-triggered process to overwrite SESSION-STATE.md in the workspace on an hourly basis, but it does not require any explicit user consent, preview, backup, or safety check before modifying user data. In an agent skill context, unattended periodic writes can destroy prior state, propagate bad extraction results, or overwrite manually curated content, especially because the instruction explicitly says to use overwrite semantics.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt content and required confirmation output are written entirely in Chinese and present the behavior as fixed, with no option for the user to choose language or locale. This is a natural-language policy concern because it imposes a specific language without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt explicitly instructs overwriting SESSION-STATE.md so that prior contents are cleared and replaced only with a cursor marker, but it does not require any backup, confirmation, or explicit warning about irreversible data loss. In a memory/archive workflow, this is operationally risky because a failed or partial archive step could destroy active state or silently discard data that may be needed for recovery or auditing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs appending content to MEMORY.md, which is persistent user data, but provides no warning, confirmation, or safeguard before modifying it. Because the content is derived from multiple weekly files and written automatically, an agent could change long-lived state without the user's informed consent, potentially polluting or corrupting memory over time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructions are written entirely in Chinese and direct the agent's behavior in that language, with no opt-in or alternative language path. This can violate language/locale policy when a skill implicitly forces a specific language for all users without documented justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The prompt makes a safety claim that migration will 'not overwrite existing files, only append', but later directs generating full replacement content for SESSION-STATE.md and dated memory files. This mismatch can cause an agent or user to trust the operation as non-destructive when it may overwrite curated state or archival files, leading to silent data loss or corruption during migration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document specifies automated writes to SESSION-STATE.md, memory/YYYY-MM-DD.md, and MEMORY.md, plus a daily Session GC cleanup step, but provides no user-facing warning, confirmation boundary, backup guidance, or deletion safeguards. In an agent skill, undocumented autonomous modification and cleanup of local files can cause unintended data loss or silent state corruption, especially because the workflow is prompt-driven and may be executed by an LLM without strong operational guardrails.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The optional external todo synchronization describes pulling data from an external source into L1 without any warning about external connectivity, data transfer, trust boundaries, or sensitive data ingestion. In a memory-oriented agent skill, this can silently import untrusted or private external content into persistent memory files, increasing the risk of privacy exposure, prompt injection contamination, or unintended cross-system data flow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire skill document is written as a Chinese-only normative specification, using mandatory language such as “必须” and “禁止”, but it does not state that Chinese is optional, user-selected, or required for a region-specific purpose. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The troubleshooting guide includes a direct rm deletion command for a file path without any warning, confirmation step, or backup guidance. Even though the example targets an intentionally 'wrong-date' file, users may substitute the wrong path or run it in the wrong directory context, causing irreversible data loss.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown template presents all operational instructions and examples in Chinese, including the embedded MEMORY.md content and CAR format guidance. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not provided here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown template uses Chinese instructional text and field descriptions throughout, while presenting only bilingual section headers inside the example content. There is no indication that language selection is optional or that the template is intentionally limited to a Chinese-speaking or region-specific context, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown template is written entirely in Chinese, including headings, field descriptions, and usage notes, with no indication that the language is optional or that the template is intended only for a Chinese-language or region-specific context. That creates a natural-language policy concern because it imposes a specific language on users without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The migration flow states that old data will be read from backups and appended into new L1/L2/L3 memory files, but it does not clearly warn users that prior data will be re-ingested into persistent stores. This can lead to accidental retention of sensitive or stale information and unexpected propagation of historical content into active agent memory.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: SQP-3 applies to all file types and covers language/locale policy violations. The entire prompt, including tasking, instructions, and output examples, is fixed in Chinese with no opt-in or explanation that the skill is intended only for a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The prompt states that it is automatically triggered by Cron every 30 minutes and later directs the agent to check the existence and freshness of files under the workspace. For markdown files, the guidance requires warnings when behavior could affect user data, privacy, or system integrity; this description does not disclose that it will autonomously inspect local files on a schedule.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The prompt defines the monitored paths as SESSION-STATE.md, MEMORY.md, and the memory/ directory, and the checklist explicitly says to verify that memory/ exists. However, the error-handling row at L74 says to report that the 'sessions' directory does not exist, which conflicts with the stated check target and could misdirect the agent's reporting.
Content: No source excerpt is available for this finding.