T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:75- Finding
Global Session Visibility Enables Broad Cross-Session Conversation Collection
- Content
View full analysis
- Remediation
View remediation
Security audit
DeepSleep
Security checks for vulnerabilities and agentic risk
Overview
DeepSleep is a coherent memory skill, but it asks for broad cross-session access, scheduled background runs, persistent conversation storage, and automatic chat dispatch without tight scoping or approval gates.
Install only if you administer the OpenClaw environment and intentionally want a scheduled agent to read all active group and main-session histories, store derived memories, and send Feishu briefs. Before enabling it, use an explicit chat allowlist if possible, exclude private/DM sessions by default, review generated briefs before dispatch, protect and periodically purge memory files, and require human approval before any audit changes instruction files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:257- Finding
Private Direct-Message Information Is Persisted in Plaintext Memory Files
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:113- Finding
Weekly Audit Can Persistently Modify Operational Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
markdown ## DeepSleep Daily Summary <!-- dispatch_policy: active|silent --> <!-- pack_version: 3.0 --> <!-- silent_days: N (only if silent) -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md 读取 `~/clawd/memory/YYYY-MM-DD.md`。 ### 📋 检查 dispatch_policy 解析摘要中的 `<!-- dispatch_policy: xxx -->` 注释： - `active` → 正常发送晨报 - `silent` → **跳过第2步的消息发送，直接进入第3步更新快照**
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md 读取 `~/clawd/memory/YYYY-MM-DD.md`。 ### 📋 检查 dispatch_policy 解析摘要中的 `<!-- dispatch_policy: xxx -->` 注释: - `active` → 正常发送晨报 - `silent` → **跳过第2步的消息发送,直接进入第3步更新快照**
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # 🧠 DeepSleep v3.0 > Like humans need sleep for memory consolidation, AI agents need DeepSleep to persist context across sessions. Two-phase daily memory persistence for [OpenClaw](https://github.com/openclaw/openclaw) AI agents.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly describes scanning all active group chats, extracting decisions and lessons, detecting cross-group correlations, and storing per-group memory snapshots, but it does not warn operators about the privacy, retention, and consent implications of persisting conversation content across sessions. In a multi-chat environment, this can lead to over-collection and unexpected reuse of sensitive information, increasing the chance of privacy violations or data exposure through stored memory files.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Session persistence is an intended feature of the skill, but it is still security-relevant because it normalizes carrying context and potentially sensitive information across boundaries where users may expect ephemerality. In this skill's context, the persistence is coupled with cross-session visibility and automated dispatch, which makes the retention behavior more dangerous than a local-only memory cache.
- Content
md Two-phase daily memory persistence for AI agents. Like humans need sleep for memory consolidation, AI agents need DeepSleep to persist context across sessions. ## What's New in v3.0
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger description says to activate when the user mentions phrases like "daily summary," "sleep cycle," or "morning brief," which are broad terms that can appear in ordinary conversation outside this skill's intended context. The file does not provide explicit constraints, exact trigger phrases, or negative examples to distinguish when the skill should and should not activate.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is designed to retain and reuse broad conversation history across sessions, including direct-message details written into MEMORY.md. This creates a durable data retention channel that can preserve sensitive personal, operational, or confidential information beyond the original context, increasing the chance of unintended disclosure in later sessions or summaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs operators to change global session visibility to 'all' and install cron-based automation, which materially expands the agent's access and persistence without a prominent warning or consent boundary. In a multi-chat environment, this can expose unrelated conversations to automated summarization and later redistribution, greatly increasing blast radius if the skill is misused or misconfigured.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The privacy notes assert there is no cross-group content leakage, but the skill explicitly distributes cross-group relationship information in briefs and summaries. Even if limited to topic-level hints, revealing that another group is discussing a related subject can disclose sensitive associations, project existence, or participant interests across otherwise separate contexts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document claims per-group snapshots contain only that group's own summaries, yet the snapshot schema includes a related-groups section. That creates a direct risk of leaking knowledge that other groups exist and what topics they are tied to, violating isolation expectations and undermining the stated privacy model.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to send conversation-derived summaries to Feishu chats automatically, which is an external messaging action that propagates previously collected content. Even though the text includes some privacy constraints, it lacks an explicit consent, approval, or confirmation boundary before transmission, so sensitive or misclassified content could be disclosed to recipients without a user-visible check.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill instruction file is written as mandatory Chinese operational guidance, with no indication that the user can choose another language or that the skill is intended only for a Chinese-language environment. This creates a language/locale policy concern because it implicitly fixes the skill behavior to a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to write and modify persistent files such as daily memory files, schedule.md, and MEMORY.md as part of an automated workflow, but it does not require explicit user confirmation, user-visible notice, or an approval boundary before making those changes. In an agent setting, this can lead to silent persistence of incorrect, privacy-sensitive, or attacker-influenced content, especially because the workflow also encourages carrying forward prior content and immediate follow-on dispatch behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This document presents all operational instructions and architecture details only in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The feature list includes a Chinese-language term for the morning brief, which suggests a language-specific behavior. The README does not indicate that language is configurable or that the locale restriction is intentional and justified, creating a potential policy concern around language choice.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The setup instructions automate nightly execution, persistent file creation, and outbound message dispatch, but the README does not clearly warn that enabling the cron job causes ongoing data writes and autonomous messaging behavior. This can surprise operators, especially in shared or production environments, and may cause unintended retention or unsolicited messages if deployed without review.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The document includes localized wording such as "Smart晨报 delivery" and later Chinese template/output text like "近期记忆" and Chinese schedule examples, but it does not state whether output language should follow user preference. This can create an implicit language/locale behavior without opt-in.
- Content
Static analysis
No suspicious patterns detected.