Security audit

Auto Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it claims: store and recover agent memory through public permanent storage, with important privacy and API-key handling risks disclosed enough for user review.

Install only if you want permanent public storage for selected memories or files. Do not upload secrets, credentials, private prompts, regulated data, or personal data unless you encrypt it first. Treat the Auto Drive API key as sensitive, avoid pasting it while screen sharing or into shell history, and pin the optional npx-based auto-respawn tooling before using wallet anchoring.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup-auto-memory.sh:43
Finding: API Key Is Echoed During Interactive Setup
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/update-api-key.sh:17
Finding: API Key Rotation Accepts Secrets Through Command-Line Arguments
Content: View full analysis
&2 exit 1 fi ``` ### Technical Analysis The script accepts an API key as its first command-line argument. Command-line arguments commonly remain in shell history and may be visible to local process-inspection tools while the command is running. The interactive fallback also uses an echoing `read` command rather than silent input. Passing credentials through command arguments is unnecessary because protected standard input, a dedicated file descriptor, or a secret manager can provide non-interactive input without placing the value in the command line. ### Attack Path 1. A user runs a command such as: ```bash scripts/update-api-key.sh actual-secret-key ``` 2. The command and key may be written to shell history. 3. While the process is running, another local process may inspect its argument list where platform permissions allow. 4. An attacker with access to the user’s history, process metadata, terminal logs, or CI command logs recovers the key. 5. The attacker reuses the key against the Auto Drive API. Alternatively, when the user runs the script interactively without an argument, the prompt visibly echoes the key and exposes it to terminal observers. ### Impact Assessment The vulnerability may disclose the Auto Drive API credential to local users or logging infrastructure. A stolen key can permit authenticated Auto Drive operations within the key’s assigned scope and can consume the account’s upload allowance. It does not indepe ...[truncated 57 chars]
Remediation: View remediation
&2 exit 1 fi ``` For automation: - Read from a protected file descriptor or standard input. - Use the CI platform’s masked secret facility. - Avoid command tracing while handling credentials. - Clear temporary secret variables after use. - Document that command-line arguments must never contain API keys. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/automemory-download.sh:27
Finding: Download Destination Validation Can Be Bypassed with a Final-Component Symlink
Content: View full analysis
&2; exit 1 fi OUTPUT_DIR_PART="$(dirname "$OUTPUT")" OUTPUT_BASE="$(basename "$OUTPUT")" OUTPUT_RESOLVED="$(cd "$OUTPUT_DIR_PART" 2>/dev/null && pwd -P)/$OUTPUT_BASE" || { echo "Error: Could not resolve output path — directory does not exist: $OUTPUT_DIR_PART" >&2; exit 1 } HOME_REAL="$(cd "$HOME" && pwd -P)" if [[ "$OUTPUT_RESOLVED" != "$HOME_REAL/"* ]]; then echo "Error: Output path must be within home directory" >&2 exit 1 fi OUTPUT="$OUTPUT_RESOLVED" fi ``` The validated path is subsequently passed directly to `curl`: ```bash download_to_file() { local URL="$1" DEST="$2" shift 2 RESPONSE=$(curl -sS -w "\n%{http_code}" "$URL" "$@" -o "$DEST") echo "$RESPONSE" | tail -1 } ``` ### Technical Analysis The validation physically resolves only the destination’s parent directory. It appends the final basename without checking whether that final path component is an existing symbolic link. `curl -o` follows symbolic links when opening the destination. Therefore, a path that syntactically resides beneath `$HOME` can point to another writable file outside `$HOME`. This bypasses the script’s intended home-directory write boundary. The vulnerability is a time-of-check/time-of-use concern as well: even if the destination were checked once, another local actor could replace it with a symlink before `curl` opens it. ### Attack Path 1. An attacker who can create files in a directory beneath the victim’s home directory creates a symlink: ```bash ln -s /path/to/another/writable/file "$HOME/download-result" ``` 2. The victim invokes: ```bash scripts/automemory-download.sh
Remediation: View remediation
&2 exit 1 fi ``` 2. Write into a securely created temporary file inside the already validated directory: ```bash TMP_OUTPUT=$(mktemp "$OUTPUT_DIR_PART/.automemory-download.XXXXXX") chmod 600 "$TMP_OUTPUT" ``` 3. Download to the temporary file, validate the HTTP result, and atomically rename it to the destination. 4. Recheck the destination immediately before replacement. 5. Refuse to overwrite existing files by default; require an explicit `--force` option if overwrite is intended. 6. Where available, use an implementation that opens the destination with no-follow and exclusive-creation semantics. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:233
Finding: Optional Wallet Integration Uses an Unpinned Package Through npx
Content: View full analysis
--cid ``` ``` ### Technical Analysis The documented integration invokes `npx tsx` without specifying a package version, lockfile, integrity value, or verified local installation. If `tsx` is not already installed locally, `npx` may retrieve and execute a package from the configured npm registry at invocation time. This creates a supply-chain execution path whose effective code can change after the Skill has been reviewed. The command is especially sensitive because it is documented for an on-chain wallet operation. While the repository itself does not contain a malicious package or remote shell payload, the instruction unnecessarily relies on mutable external package resolution. ### Attack Path 1. A user follows the documented Auto-Respawn integration. 2. The local project does not contain a locked and verified `tsx` installation. 3. `npx` resolves the package from the configured registry. 4. A compromised registry account, malicious package release, registry substitution, or dependency compromise supplies attacker-controlled code. 5. The downloaded package executes with the user’s privileges. 6. The code may access environment variables, local files, or wallet-related resources available to that process. This path depends on compromise or malicious control of the resolved package or registry; the audit found no evidence that the current legitimate `tsx` package is malicious. ### Impact Assessment Compromised dependency code would execute with the privileges of the user running `npx`. It could read accessible files and environment variables, alter workspace content, or interfere with the wallet anchoring operation. Any wallet impact depends on how `a ...[truncated 104 chars]
Remediation: View remediation
" } } ``` Then: - Commit a package lockfile containing registry integrity metadata. - Install with a lockfile-enforcing command such as `npm ci`. - Invoke the verified local executable rather than allowing dynamic resolution: ```bash ./node_modules/.bin/tsx auto-respawn.ts anchor --from --cid ``` - Review and pin the companion `auto-respawn.ts` implementation. - Use a trusted registry and restrict package installation scripts where feasible. - Run wallet-related tooling with minimal filesystem and environment access. - Require explicit user confirmation before signing an on-chain transaction. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises persistent agent-memory functionality on the Autonomys Network, including saving decisions/context and rebuilding history from a CID after state loss. This code chunk does not implement those behaviors. Instead, it contains support/setup logic: dependency checks, CID regex validation, API-key verification with the Auto Drive service, and local credential/config persistence. Those are materially different from the advertised primary purpose. While helper/setup code can be related, this chunk lacks any actual memory-chain upload, retrieval, or reconstruction logic, and it performs an undeclared credential-handling capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description promises a durable agent-memory system that saves decisions, identity, and context and can reconstruct full history from a CID. The supplied code does not implement saving, memory chaining, identity/context handling, or history reconstruction. It only validates a CID and downloads the corresponding file from Autonomys endpoints, writing it to stdout or a local file. This is a materially different primary purpose. The optional use of an API key for authenticated downloads also touches external access not reflected in the declared permissions, though the main mismatch is the gap between claimed memory functionality and actual file-download behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broader system capability centered on durable storage and recovery of agent memory on the Autonomys Network. The supplied code chunk is specifically a recall utility: it accepts or discovers a CID, validates it, downloads each linked memory item via API or public gateway, optionally decompresses content, prints or saves JSON files, follows previousCid links, and optionally rewrites a local automemory state file. That is only the retrieval/restoration portion of the described system, not the permanent storage portion. The code does not upload, save, or persist memories to the network, nor does it reconstruct full agent identity/context except by outputting fetched entries. Because the primary declared purpose combines storage and guaranteed persistence, while the actual script is a limited chain-fetch/restore tool with local file writes, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is a generic uploader for a single file to Auto Drive. It authenticates with an API key, creates an upload, sends one file chunk, completes the upload, validates the returned CID, and prints the CID/gateway URL. While this may be a building block for storage on Autonomys-related infrastructure, it does not implement the declared higher-level behavior of permanent agent memory, chaining memory entries, preserving identity/context, or reconstructing history after state loss. The description materially overstates the actual behavior, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description is about a memory persistence capability: saving agent state/history to the Autonomys Network and rebuilding history from a CID. The supplied code does not implement memory saving, retrieval, chain reconstruction, or CID-based recovery. Instead, it performs initial service configuration by directing the user to create an API key, collecting that credential, saving it locally, and verifying the key. While this may support the broader memory feature, the chunk’s actual primary purpose is setup and credential management, which is materially different from the declared end-user functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about durable agent-memory storage and recovery on the Autonomys Network. The actual code does not implement memory storage, recovery, CID handling, identity/context persistence, or network-based history reconstruction. Instead, it performs credential management: it reads a new API key, validates it, saves it, and tells the user to restart a gateway. This is a materially different primary purpose and introduces an undeclared capability related to secret/API key handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a core memory-storage and history-reconstruction capability on the Autonomys Network. The supplied code does not store memory, rebuild history, manage CIDs, or implement persistence logic. Instead, it is an operational verification script for setup readiness: it checks local prerequisites, validates an API key, and displays account upload limits and usage. These are materially different primary behaviors from the declared purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
scripts/automemory-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
scripts/automemory-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The script is designed to persist an API key in plaintext within $HOME/.openclaw/.env, creating a durable secret at a predictable location. Even though permissions are tightened, any compromise of the user account, unsafe backups, accidental file disclosure, or other local tooling that reads .env files could expose the credential.
Content: Scanner excerpt · scripts/_lib.sh (reported line 10)May include surrounding context.
sh
AD_BASE_URL="https://mainnet.auto-drive.autonomys.xyz/api" AD_DOWNLOAD_URL="https://public.auto-drive.autonomys.xyz/api" AM_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}" AM_ENV_FILE="$AM_OPENCLAW_DIR/.env" AM_CONFIG_FILE="$AM_OPENCLAW_DIR/openclaw.json" GREEN='\033[0;32m'

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This block intentionally manages a .env file containing AUTO_DRIVE_API_KEY, which increases the credential exposure surface beyond process memory into persistent local storage. In the context of an agent skill that may be installed broadly, automatic secret persistence makes leakage through backups, support bundles, repo mistakes, or local compromise more likely.
Content: Scanner excerpt · scripts/_lib.sh (reported line 128)May include surrounding context.
sh
fi echo -e "${GREEN}✓ Saved to $AM_CONFIG_FILE${NC}" # --- .env ------------------------------------------------------------------ # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates, # then append exactly one entry. if [[ -f "$AM_ENV_FILE" ]]; then

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The code appends the API key directly into a shell-sourceable .env file, creating plaintext secret material on disk. While quoting is handled carefully to prevent shell injection, the main risk remains credential disclosure from persistent storage in a commonly targeted file format.
Content: Scanner excerpt · scripts/_lib.sh (reported line 138)May include surrounding context.
sh
sed '/^AUTO_DRIVE_API_KEY=/d' "$AM_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AM_ENV_FILE" fi # Single-quote the value so characters like #, $, and backticks are # preserved literally when the .env file is later sourced by bash. local safe_key="${key//\'/\'\\\'\'}" echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AM_ENV_FILE" chmod 600 "$AM_ENV_FILE"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/automemory-recall-chain.sh (reported line 158)May include surrounding context.
sh
if [[ -n "$EXPERIENCE" ]] && echo "$EXPERIENCE" | jq empty 2>/dev/null; then echo "[$COUNT] Fetched $CID via gateway" >&2 else # ZLIB compressed — pipe curl directly into decompressor (no intermediate variable) EXPERIENCE="" if command -v python3 &>/dev/null; then EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/automemory-recall-chain.sh (reported line 165)May include surrounding context.
sh
| python3 -c "import sys,zlib;sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read()))" 2>/dev/null || true) fi if [[ -z "$EXPERIENCE" ]] && command -v perl &>/dev/null; then EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \ | perl -MCompress::Zlib -e 'undef $/;my $d=uncompress(<STDIN>);print $d if defined $d' 2>/dev/null || true) fi if [[ -n "$EXPERIENCE" ]]; then

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill has Write permission and explicitly documents persistent local state updates, including writing the latest CID to a state file and modifying MEMORY.md. In context, this persistence is more dangerous because the skill's purpose is long-term retention and resurrection of agent context; accidental or unsafe writes can preserve sensitive data locally and make future agents trust or consume tainted history.
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
license: Apache-2.0 description: Indestructible agent memory — permanently stored, never lost. Save decisions, identity, and context as a memory chain on the Autonomys Network. Rebuild your full history from a single CID, even after total state loss. compatibility: Requires curl, jq, and the file utility, plus outbound HTTPS to the Autonomys Auto Drive API (ai3.storage) and public gateway. Stored data is permanent and public — do not store secrets. Works with OpenClaw and Hermes agents on macOS and Linux. allowed-tools: Bash(curl:*) Bash(jq:*) Bash(file:*) Read Write metadata: openclaw: emoji: "🧬"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation guidance includes broad phrases like 'save memory', 'remember this permanently', and 'Any time the user wants data stored permanently,' which can overlap with ordinary conversational requests. In an agent environment, this increases the risk of unintentional invocation and accidental transmission of sensitive context to a permanent public storage network.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 82% confidence
Finding: The documentation instructs users to run npx tsx auto-respawn.ts ... without pinning a specific package version. Unpinned npx execution can fetch whatever version is current at execution time, creating a supply-chain risk where a compromised or incompatible dependency is executed unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly encourages storing arbitrary agent memory, including potentially full file snapshots and identity/context data, on permanent decentralized storage and describes resurrection from a single CID, but it does not warn that such data may be irreversible, publicly retrievable, and unsuitable for secrets or personal data. In the context of an agent memory skill, this omission is dangerous because operators may persist API keys, credentials, private prompts, personal data, or sensitive internal state that cannot be deleted once published.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/_lib.sh (reported line 98)May include surrounding context.
sh
local key="$1" mkdir -p "$AM_OPENCLAW_DIR" chmod 700 "$AM_OPENCLAW_DIR" # Collect temp files for cleanup _AM_TMPS=()

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/_lib.sh (reported line 116)May include surrounding context.
sh
jq -n --arg key "$key" \ '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \ > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE" chmod 600 "$AM_CONFIG_FILE" else local jsontmp jsontmp=$(mktemp)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/_lib.sh (reported line 124)May include surrounding context.
sh
jq -n --arg key "$key" \ '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \ > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE" chmod 600 "$AM_CONFIG_FILE" else local jsontmp jsontmp=$(mktemp)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/_lib.sh (reported line 141)May include surrounding context.
sh
jq -n --arg key "$key" \ '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \ > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE" chmod 600 "$AM_CONFIG_FILE" else local jsontmp jsontmp=$(mktemp)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/automemory-recall-chain.sh (reported line 220)May include surrounding context.
sh
jq -n --arg key "$key" \ '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \ > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE" chmod 600 "$AM_CONFIG_FILE" else local jsontmp jsontmp=$(mktemp)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/automemory-save-memory.sh (reported line 147)May include surrounding context.
sh
jq -n --arg key "$key" \ '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \ > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE" chmod 600 "$AM_CONFIG_FILE" else local jsontmp jsontmp=$(mktemp)