OpenClaw Memory System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.0.0

Overview

This memory skill is not hidden malware, but it installs recurring jobs that read conversation logs, write long-term memory, and delete session files with weak controls.

Install only if you are comfortable with automatic background jobs reading your OpenClaw session logs, retaining summaries in Markdown memory files, and deleting session files. Before use, require explicit opt-in for each cron task, disable or dry-run GC, review what sessions are scanned, add sensitive-data redaction, and document how to pause or uninstall all jobs.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T02 · Agent Memory Poisoning

Error

• Location: prompts/l3-weekly-prompt.md:104
• Finding: Untrusted Conversation Content Can Poison Persistent Agent Rules<![CDATA[ ## Vulnerability Details **File Location**: `prompts/l3-weekly-prompt.md:104-132` **Supporting Locations**: `prompts/l1-hourly-prompt.md:32-33, 43-65, 104-108`; `prompts/migrate-prompt.md:60-76, 95-124` **Vulnerability Type**: Persistent memory poisoning **Risk Level**: Critical ### Vulnerable Code ```markdown ### Step 2: 读取 L2 文件 使用 `read` 工具读取本周所有 memory 文件。 ### Step 3: 识别候选经验 扫描包含以下关键词的内容： - "修复"、"解决"、"发现"、"意识到" - "错误"、"失败"、"崩溃"、"丢失" - "决策"、"选择"、"方案"、"结论" - "最佳实践"、"方法论"、"规则" ### Step 4: 提炼 CAR 格式 对每个候选经验： 1. 提取 Context（触发场景） 2. 提取 Action（失效/成功动作） 3. 提炼 Result（强制复用规则） 4. 确保格式符合 CAR 规范 ### Step 4.5: 去重检查 **读取 `${MEMORY_MD}` 已有内容**，对比每条新提炼法则的核心论点： - 如已有相同或高度相似的核心论点 → 跳过，不重复写入 - 如是新法则 → 继续 ### Step 5: 写入 MEMORY.md 追加到 `${MEMORY_MD}` 末尾： ``` The persistent output template includes: ```markdown - **强制复用规则**：... ``` ### Technical Analysis Session conversations are attacker-influenced input. The hourly L1 process scans those conversations and stores keyword-matched material. The nightly L2 process archives it, and the weekly L3 process converts it into persistent rules described as mandatory for future reuse. There is no provenance tracking, trust classification, instruction-versus-data separation, prompt-injection filtering, authenticated marker validation, or user approval before `MEMORY.md` is changed. Deduplication only compares semantic similarity and does not determine whether a proposed rule is trustworthy. The migration process exposes the same condition by deriving L3 rules from historical backup content without validating the origin or safety of that content. ### Attack Path 1. An attacker submits conversation text containing terms recognized by L1 or L3, such as a decision, rule, solution, or best practice. 2. The hourly task reads the affected session log and extracts the crafted material into `SESSION-STATE.md`. 3. The nightly task copies the extracted material into an L2 archive. 4. The weekly task interprets the material ...[truncated 723 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Process only explicit, authenticated memory markers rather than generic keywords. 2. Bind each record to its source user, session, timestamp, and trust level. 3. Treat all archived conversation text as untrusted data, never as executable or authoritative instructions. 4. Reject content that attempts to alter system prompts, safety rules, tool permissions, or memory-processing behavior. 5. Require explicit user review and approval before adding any rule to `MEMORY.md`. 6. Replace “mandatory reuse rule” semantics with advisory notes that cannot override higher-priority instructions. 7. Apply the same validation and approval process to migrated historical records. 8. Add adversarial tests covering indirect prompt injection and durable memory poisoning. ]]>

T06 · System Persistence

Error

• Location: prompts/install-prompt.md:167
• Finding: Installation Creates Persistent Scheduled Jobs Without Adequate Lifecycle Controls<![CDATA[ ## Vulnerability Details **File Location**: `prompts/install-prompt.md:167-181` **Supporting Location**: `SKILL.md:160-174` **Vulnerability Type**: Cross-session scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```markdown ### Step 8: 注册 Cron 任务 **首选方式**：使用 `openclaw cron add` 命令 注册 4 个核心任务 + 1 个可选心跳任务： | 任务 | Cron 表达式 | 说明 | |------|------------|------| | L1 每小时提炼 | `0 9-23 * * *` | isolated | | L2 夜间归档 | `5 23 * * *` | isolated | | L3 周度萃取 | `30 23 * * 0` | isolated | | Session GC | `10 23 * * *` | isolated | | 心跳检查 | `*/30 * * * *` | main（可选）| **降级方式**：如 CLI 命令失败，输出 JSON 配置让用户手动添加。 ``` ### Technical Analysis The installation workflow registers recurring tasks that continue operating after the initiating Skill invocation. These jobs read conversation logs, write persistent memory, and perform physical session-file deletion. Only the heartbeat is identified as optional. The four core jobs are installed as part of an “atomic, uninterrupted” workflow without a dedicated confirmation step that enumerates their permissions and destructive effects. The project also provides no complete uninstall workflow, job ownership marker, expiration mechanism, or verified rollback procedure for scheduled jobs. This behavior is declared as part of the Skill, so it is not a concealed startup backdoor. Nevertheless, it creates persistent cross-session execution with inadequate consent and lifecycle management. ### Attack Path 1. A user invokes `/install-memory`. 2. The installation flow registers four recurring core jobs. 3. The initiating session ends, but the jobs remain active. 4. Later jobs repeatedly access shared session data, modify memory files, and run deletion logic without per-run approval. 5. Reinstallations may create additional tasks if registration is not idempotent. ### Impact Assessment The installed jobs maintain recurring access to Agent session logs and workspace memory after the original Skill run. The GC task addit ...[truncated 255 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit confirmation that lists each job, schedule, data source, write target, and destructive permission. 2. Make every scheduled task opt-in, especially session GC. 3. Assign stable job identifiers and verify idempotency before registration. 4. Provide a documented uninstall command that removes every registered job. 5. Roll back newly registered jobs if installation fails at a later step. 6. Support expiration dates and a global pause mechanism. 7. Display and verify the actual registered job list instead of printing an unconditional success summary. 8. Run each job with the minimum filesystem and session permissions required. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: prompts/gc-cleanup-prompt.md:25
• Finding: GC Decision Order Can Delete Protected or Legitimate Sessions<![CDATA[ ## Vulnerability Details **File Location**: `prompts/gc-cleanup-prompt.md:25-65` **Vulnerability Type**: Unsafe automated file deletion **Risk Level**: High ### Vulnerable Code ```markdown ## 删除规则 ### 删除条件（满足任一即删除） 1. **Cron 临时文件**：文件名包含 `:run:` 标记 2. **空文件**：文件大小 < 1KB（1024 字节） ### 保留条件（满足任一即保留） 1. **Main 会话**：所有历史会话完整保留 2. **Feishu 会话**：所有历史会话完整保留 3. **用户创建的会话**：保留 4. **大文件**：文件大小 > 10KB（说明有实际内容） ... 对每个文件： 检查文件名是否包含 :run: → 是 → 标记删除 检查文件大小是否 < 1KB → 是 → 标记删除 检查文件大小是否 > 10KB → 是 → 标记保留 否则 → 标记保留 ### Step 3: 执行删除 删除标记为"删除"的文件。 ``` ### Technical Analysis The documented deletion conditions use “any condition” semantics. A filename containing `:run:` or a file smaller than 1 KB is sufficient to mark it for deletion. The classification sequence evaluates deletion before the large-file retention rule and never defines that a later retention result overrides an earlier deletion result. More importantly, the stated Main, Feishu, and user-session exclusions are not represented in the actual decision procedure. Filename patterns and file size are not reliable proof that a session is disposable. A valid short session may be smaller than 1 KB, while a legitimate or protected session may contain `:run:` in its name. ### Attack Path 1. A legitimate session file is created with less than 1 KB of content, or its filename contains `:run:`. 2. The nightly GC task scans all `.jsonl` files in the configured directory. 3. The file satisfies a deletion condition and is marked for deletion. 4. No metadata-based ownership or protected-session exclusion is applied. 5. The task physically deletes the file without interactive confirmation. ### Impact Assessment The task can irreversibly remove legitimate session history, causing data loss and denial of service for users or integrations relying on that history. Its scope includes every `.jsonl` file reachable under the resolved main-agent sessions directory. No evidence indicates deletion outside that direct ...[truncated 133 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automated physical deletion by default. 2. Identify disposable sessions through authoritative metadata, not filename and size heuristics. 3. Evaluate protected-session exclusions before any deletion rule. 4. Require all deletion criteria to be satisfied instead of deleting when any one condition matches. 5. Canonicalize each candidate path and verify that it remains inside the intended sessions directory. 6. Move candidates to a quarantine directory with a retention period before permanent deletion. 7. Record immutable audit details including path, reason, timestamp, and job identifier. 8. Require explicit confirmation for the first GC run and provide a dry-run mode. 9. Add tests for small legitimate sessions, large `:run:` sessions, protected sessions, symlinks, and conflicting rules. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: prompts/l1-hourly-prompt.md:15
• Finding: Hourly Task Reads All Main-Agent Session Logs Beyond the Explicit-Marker Model<![CDATA[ ## Vulnerability Details **File Location**: `prompts/l1-hourly-prompt.md:15-33` **Supporting Location**: `prompts/l1-hourly-prompt.md:43-72, 104-108` **Vulnerability Type**: Excessive access to shared session data **Risk Level**: High ### Vulnerable Code ```bash BASE=$(pwd) WORKSPACE="${BASE}/workspace" SESSION_STATE="${WORKSPACE}/SESSION-STATE.md" SESSIONS_DIR="${BASE}/../../agents/main/sessions/" ``` ```markdown ## 输入 - **文件**：`${SESSIONS_DIR}` 下的 `.jsonl` 文件 - **范围**：最后 300 行（或 `[Last_Extracted_Time]` 之后的内容，取较新的） ``` The extraction rules also recognize broad generic terms corresponding to needs, plans, choices, execution, understanding, and discoveries rather than limiting processing to an explicit memory marker. ### Technical Analysis The Skill describes an explicit-marker memory protocol, but the hourly task scans every `.jsonl` file in the shared main-Agent session directory. It analyzes up to 300 lines from each source and searches for broad conversational phrases. There is no demonstrated filtering by current user, originating session, integration, tenant, or consent status. Consequently, unrelated sessions can be exposed to the isolated memory-processing task and copied into shared memory files. This violates least-privilege principles because the stated memory objective can be implemented using an explicit, per-user input channel without traversing all main-Agent session logs. ### Attack Path 1. The Skill is installed and the hourly Cron task receives access to the main session directory. 2. Another user, integration, or unrelated workflow creates a session log in that directory. 3. The log contains a broadly matched conversational phrase. 4. L1 reads the log and extracts its content. 5. The extracted content is written into workspace memory and may later be archived or converted into persistent rules. ### Impact Assessment The task may disclose unrelated conversation content to the memory-processing Agent and retain it beyond ...[truncated 324 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Read only records explicitly submitted to a dedicated memory inbox. 2. Require an exact opt-in marker rather than generic keyword matching. 3. Bind processing to the consenting user and originating session. 4. Exclude other users, integrations, and background sessions by default. 5. Enforce filesystem or API-level authorization rather than relying solely on prompt instructions. 6. Minimize the amount of source content read and avoid retaining surrounding conversation text. 7. Provide a user-visible record of the source session and extracted fields. 8. Add multi-user isolation tests to verify that one session cannot enter another user's memory. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: prompts/l2-nightly-prompt.md:38
• Finding: Conversation Content Is Persisted Without Sensitive-Data Redaction or Retention Controls<![CDATA[ ## Vulnerability Details **File Location**: `prompts/l2-nightly-prompt.md:38-67` **Supporting Locations**: `prompts/l1-hourly-prompt.md:79-108`; `prompts/l3-weekly-prompt.md:104-132` **Vulnerability Type**: Insecure persistent storage of conversation data **Risk Level**: Medium ### Vulnerable Code ```bash TODAY=$(date +%Y-%m-%d) ARCHIVE_FILE="${MEMORY_DIR}/${TODAY}.md" if [ ! -f "${ARCHIVE_FILE}" ]; then echo "# 每日归档 - ${TODAY}" > "${ARCHIVE_FILE}" echo "" >> "${ARCHIVE_FILE}" echo "> 归档时间：$(date +%H:%M)" >> "${ARCHIVE_FILE}" echo "" >> "${ARCHIVE_FILE}" echo "---" >> "${ARCHIVE_FILE}" echo "" >> "${ARCHIVE_FILE}" fi cat "${SESSION_STATE}" >> "${ARCHIVE_FILE}" ``` The next step overwrites `SESSION-STATE.md` with only a cursor after the archive is created. ### Technical Analysis The L2 process physically appends the complete L1 state to a durable Markdown archive. The repository does not specify secret detection, personally identifiable information redaction, restrictive file permissions, encryption, archive expiration, maximum retention, or user-controlled deletion. Because L1 derives its content from conversation logs, credentials or personal information included in an extracted task, decision, insight, or context can be copied to L1, L2, backups, and potentially L3. Clearing L1 after archiving does not remove the archived copy. ### Attack Path 1. A user mentions a secret or sensitive personal detail in a phrase matched by L1. 2. The hourly task stores the content in `SESSION-STATE.md`. 3. The nightly task appends the complete state to a dated archive. 4. Installation backups or later migration operations create additional copies. 5. Any actor or process able to read the workspace or backups can access the retained information. ### Impact Assessment Potentially affected data includes credentials, tokens, private decisions, personal information, and confidential work context. The exposure scope includes workspace memory files ...[truncated 208 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Detect and redact credentials, tokens, private keys, authentication headers, and common personal-data formats before writing. 2. Default to storing concise structured summaries instead of complete extracted text. 3. Create memory and backup files with restrictive permissions. 4. Define configurable L1, L2, L3, and backup retention periods. 5. Provide commands to inspect, export, and securely delete stored memory. 6. Prevent sensitive fields from being promoted into L3 rules. 7. Avoid backing up plaintext secrets, or encrypt backups using a user-managed key. 8. Document the data lifecycle and obtain informed consent before persistent storage begins. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: prompts/migrate-prompt.md:39
• Finding: Migration Backup Selection Can Restore Stale Data<![CDATA[ ## Vulnerability Details **File Location**: `prompts/migrate-prompt.md:39-46` **Vulnerability Type**: Unsafe wildcard-based backup selection **Risk Level**: Medium ### Vulnerable Code ```bash BACKUP_DIR="${BASE}/memory-system-backup.*" ls -d ${BACKUP_DIR} 2>/dev/null | head -1 ``` ### Technical Analysis `BACKUP_DIR` contains a wildcard pattern rather than a resolved directory. When unquoted during `ls`, shell expansion returns matching backup directories in shell or lexical order. Piping that output to `head -1` generally selects the first name, which is likely the oldest timestamped backup rather than the newest. The shown command only prints a match and does not assign the selected result back to `BACKUP_DIR`. Later instructions refer to `${BACKUP_DIR}`, leaving ambiguity over whether tools should process one backup or all wildcard matches. There is also no canonical-path validation, integrity check, freshness check, or user confirmation for the selected backup. ### Attack Path 1. Multiple timestamped backup directories exist. 2. A user invokes `/migrate-memory`. 3. The wildcard expands to multiple paths. 4. `head -1` identifies the lexicographically first, potentially oldest backup. 5. The migration task reads obsolete or previously poisoned content. 6. Stale tasks, decisions, or persistent rules are reintroduced into active memory. ### Impact Assessment The issue can corrupt memory integrity by restoring outdated records or reintroducing content that a user believed had been superseded. If an attacker can create a matching directory beneath `BASE`, the ambiguity may also influence which data is considered during migration. The demonstrated impact is limited to memory and archive integrity; no arbitrary command execution is established by the provided prompt. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve exactly one backup directory before processing: ```bash BACKUP_DIR=$(find "$BASE" -maxdepth 1 -type d -name 'memory-system-backup.*' \ -printf '%T@ %p\n' | sort -nr | head -1 | cut -d' ' -f2-) ``` 2. Reject empty results and verify that the resolved value is a directory. 3. Canonicalize the selected path and confirm it remains directly beneath `BASE`. 4. Validate the expected backup structure and file integrity. 5. Display the selected timestamp and require confirmation before migration. 6. Permit the user to choose a specific backup explicitly. 7. Never reuse the unresolved wildcard pattern for subsequent reads or writes. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**修复**：
```bash
# 删除错误文件
rm memory/YYYY-MM-DD.md  # 错误日期

# 确保 L2 Prompt 中使用动态日期
TODAY=$(date +%Y-%m-%d)

• Confidence: 90% confidence
• Finding: The command `rm memory/YYYY-MM-DD.md` is a destructive filesystem operation embedded in documentation, and it normalizes use of an unsafe tool parameter without safeguards. In skill/troubleshooting contexts, users often copy-paste commands directly, so even a placeholder path can lead to accidental deletion if replaced incorrectly or executed from the wrong repository location.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The GC troubleshooting section recommends bulk `find ... -delete` operations that can remove multiple files based on broad patterns, again without warnings, dry-run instructions, or recovery guidance. Because the paths are derived from `$(pwd)` and traverse relative directories, a user running this from an unexpected location could delete unintended session data or other files irreversibly.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language instructions, command descriptions, and operational guidance are presented in Chinese throughout the file, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when the skill offers language choice or clearly documents a justified region-specific limitation, neither of which appears here.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises and schedules automatic Cron-driven writes and a cleanup job that performs physical deletion, but the top-level description does not present a clear user-facing warning about these background modifications. In an agent skill context, unattended persistence and deletion can surprise users, affect unrelated files if paths are misconfigured, and create integrity/privacy risks even without overtly malicious logic.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This prompt directs automated deletion of session files based on broad filename and size heuristics, but it does not require an explicit user-facing warning or confirmation about the impact on stored session history. In an agent context, deleting session artifacts can destroy user data, audit trails, or operational state, and the prompt’s 'safety' language may create false confidence despite the risk of misclassification and irreversible removal.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: All required output strings and operational instructions are specified in Chinese, effectively constraining the skill's responses to a single language. The policy says to flag language or locale restrictions unless the skill offers user choice or clearly documents a justified regional constraint, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The task description and role instructions are written entirely in Chinese and implicitly require the skill to operate in that language. There is no indication that the user can choose another language or that the Chinese-only constraint is necessary for a region-specific or compliance-bound use case.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The install prompt instructs registration of multiple cron jobs, including an optional heartbeat, creating persistent background tasks on the user's system. Because the prompt does not prominently warn that installation changes scheduled task state and may continue running automatically after setup, users may grant persistence without informed consent, which is a meaningful security and trust risk for an agent skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The prompt directs an automated cron-triggered process to overwrite SESSION-STATE.md in the workspace on an hourly basis, but it does not require any explicit user consent, preview, backup, or safety check before modifying user data. In an agent skill context, unattended periodic writes can destroy prior state, propagate bad extraction results, or overwrite manually curated content, especially because the instruction explicitly says to use overwrite semantics.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The prompt content and required confirmation output are written entirely in Chinese and present the behavior as fixed, with no option for the user to choose language or locale. This is a natural-language policy concern because it imposes a specific language without opt-in or documented regional justification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The prompt explicitly instructs overwriting SESSION-STATE.md so that prior contents are cleared and replaced only with a cursor marker, but it does not require any backup, confirmation, or explicit warning about irreversible data loss. In a memory/archive workflow, this is operationally risky because a failed or partial archive step could destroy active state or silently discard data that may be needed for recovery or auditing.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs appending content to MEMORY.md, which is persistent user data, but provides no warning, confirmation, or safeguard before modifying it. Because the content is derived from multiple weekly files and written automatically, an agent could change long-lived state without the user's informed consent, potentially polluting or corrupting memory over time.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill instructions are written entirely in Chinese and direct the agent's behavior in that language, with no opt-in or alternative language path. This can violate language/locale policy when a skill implicitly forces a specific language for all users without documented justification.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The prompt makes a safety claim that migration will 'not overwrite existing files, only append', but later directs generating full replacement content for SESSION-STATE.md and dated memory files. This mismatch can cause an agent or user to trust the operation as non-destructive when it may overwrite curated state or archival files, leading to silent data loss or corruption during migration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document specifies automated writes to SESSION-STATE.md, memory/YYYY-MM-DD.md, and MEMORY.md, plus a daily Session GC cleanup step, but provides no user-facing warning, confirmation boundary, backup guidance, or deletion safeguards. In an agent skill, undocumented autonomous modification and cleanup of local files can cause unintended data loss or silent state corruption, especially because the workflow is prompt-driven and may be executed by an LLM without strong operational guardrails.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The optional external todo synchronization describes pulling data from an external source into L1 without any warning about external connectivity, data transfer, trust boundaries, or sensitive data ingestion. In a memory-oriented agent skill, this can silently import untrusted or private external content into persistent memory files, increasing the risk of privacy exposure, prompt injection contamination, or unintended cross-system data flow.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The entire skill document is written as a Chinese-only normative specification, using mandatory language such as “必须” and “禁止”, but it does not state that Chinese is optional, user-selected, or required for a region-specific purpose. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The troubleshooting guide includes a direct `rm` deletion command for a file path without any warning, confirmation step, or backup guidance. Even though the example targets an intentionally 'wrong-date' file, users may substitute the wrong path or run it in the wrong directory context, causing irreversible data loss.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown template presents all operational instructions and examples in Chinese, including the embedded MEMORY.md content and CAR format guidance. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not provided here.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown template uses Chinese instructional text and field descriptions throughout, while presenting only bilingual section headers inside the example content. There is no indication that language selection is optional or that the template is intentionally limited to a Chinese-speaking or region-specific context, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown template is written entirely in Chinese, including headings, field descriptions, and usage notes, with no indication that the language is optional or that the template is intended only for a Chinese-language or region-specific context. That creates a natural-language policy concern because it imposes a specific language on users without opt-in.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The migration flow states that old data will be read from backups and appended into new L1/L2/L3 memory files, but it does not clearly warn users that prior data will be re-ingested into persistent stores. This can lead to accidental retention of sensitive or stale information and unexpected propagation of historical content into active agent memory.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: SQP-3 applies to all file types and covers language/locale policy violations. The entire prompt, including tasking, instructions, and output examples, is fixed in Chinese with no opt-in or explanation that the skill is intended only for a Chinese-speaking or region-specific environment.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The prompt states that it is automatically triggered by Cron every 30 minutes and later directs the agent to check the existence and freshness of files under the workspace. For markdown files, the guidance requires warnings when behavior could affect user data, privacy, or system integrity; this description does not disclose that it will autonomously inspect local files on a schedule.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The prompt defines the monitored paths as SESSION-STATE.md, MEMORY.md, and the memory/ directory, and the checklist explicitly says to verify that memory/ exists. However, the error-handling row at L74 says to report that the 'sessions' directory does not exist, which conflicts with the stated check target and could misdirect the agent's reporting.

Static analysis

No suspicious patterns detected.