other
Note
- Location
memory_health.py:75- Finding
Overbroad Reading of Sensitive Agent State and Unrelated Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Hermes Memory
Security checks for vulnerabilities and agentic risk
Overview
This memory-health skill is mostly local and purpose-aligned, but it reads sensitive agent memory/state files and all top-level files in a local self-improving directory more broadly than the documentation clearly scopes.
Review before installing. Run it only if you are comfortable with it reading OpenClaw memory/profile/state files and all top-level files in ~/self-improving on each check. If using the cron example, adjust the hard-coded paths, understand it will keep running on weekdays, and consider limiting the script to an explicit allowlist of files before scheduling it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs users to run a local Python script and describes behavior that reads and writes memory files, but it declares no explicit tool scope or permissions. This creates an authorization ambiguity: an agent or user may grant broader file access than intended, increasing the chance of unintended modification of local state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The markdown advertises automatic archiving, scheduled self-checks, and log creation, but it does not clearly warn that user memory files may be modified and that persistent logs will be written. In a memory-management skill, silent or under-documented file mutation is risky because it can alter user data over time and leave sensitive content in archives or logs.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs users to install a cron job that will run indefinitely on weekdays, creating persistent scheduled execution and appending to a log file. Persistence increases risk because any unsafe logic in the script continues to execute without further review, and recurring access to memory files can compound data modification or leakage over time.
- Content
自动定时（每天收盘后17:30自检一次）：
bash # 添加到crontab crontab -e # 写入： 30 17 * * 1-5 /home/linuxbrew/.linuxbrew/bin/python3 /home/jdvrommel/self-improving/hermes-memory/memory_health.py >> /home/jdvrommel/self-improving/hermes-memory/health.log 2>&1
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and all user-facing print messages are written in Chinese, making the skill operate in a fixed language with no indication of user choice or opt-in. The policy requires avoiding forced language/locale behavior unless the constraint is explicitly justified or selectable.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script enumerates and reads files from ~/self-improving even though its stated purpose is checking Hermes memory health. This expands the data-access scope beyond the declared memory files and can expose unrelated local content through file counting, line counting, and console output.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code reads the contents of arbitrary files in ~/self-improving to count lines, which is broader access than necessary for a memory-health checker. Reading arbitrary local files increases privacy risk and creates an unnecessary capability that could be repurposed to inspect sensitive data stored in that directory.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content, including the description and usage instructions, is presented only in Chinese. This can violate language/locale policy when the skill forces a specific language without user opt-in or an explicitly documented justification.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The checker writes a persistent state file despite being described primarily as a self-check/reminder tool. Unexpected persistence creates side effects, may leave behavioral traces on disk, and can overwrite existing state without explicit consent or visibility.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script writes a JSON state file without any user-facing warning at the time of execution. Silent persistence reduces transparency and can surprise users who expect a read-only health check, especially in a tool that accesses personal workspace files.
- Content
Static analysis
No suspicious patterns detected.