PV_18

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:13 AM UTC
• Version: 3.0.0

Overview

The skill is disclosed as a PR and brand-strategy assistant but adds automatic cross-session memory of user preferences and decisions without clear consent, limits, or deletion controls.

Review this skill carefully before installing. Use it only if you are comfortable with it automatically saving preferences, decisions, and other important conversation details to a local memory file and reusing them in later sessions. Avoid sharing sensitive personal, business, legal, financial, or credential-like information unless the skill is updated with explicit opt-in, review, deletion, and retention controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:38
• Finding: Automatic Persistent Storage Enables Cross-Session Memory Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-53 and 96-104 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium ### Vulnerable Code ```python PALACE_PATH = os.path.expanduser("~/.openclaw/pv_palace/") def store_memory(content, importance=5, tags=None): os.makedirs(PALACE_PATH, exist_ok=True) path = os.path.join(PALACE_PATH, "memories.json") data = {"memories": [], "index": {}} if not os.path.exists(path) else json.load(open(path)) mem_id = hashlib.sha256(f"{content}{datetime.now().isoformat()}".encode()).hexdigest()[:12] memory = {"id": mem_id, "content": content, "importance": importance, "tags": tags or [], "created_at": datetime.now().isoformat()} data["memories"].append(memory) for tag in (tags or []): data["index"].setdefault(tag, []).append(mem_id) json.dump(data, open(path, 'w'), ensure_ascii=False, indent=2) ``` The usage rules at lines 96-104 direct the agent to invoke memory storage automatically for user preferences and important decisions, search stored memory when asked, and load stored context automatically at the beginning of a new session. ### Technical Analysis The skill accepts arbitrary `content` and persists it without checking whether the content contains instructions, adversarial prompts, misleading claims, or sensitive information. The stored entries are subsequently selected by importance and loaded into later-session context. This creates a persistent trust-boundary violation: text supplied by a user in one session can become agent context in future sessions. No mechanism distinguishes recalled data from trusted skill instructions, limits which content may be retained, or prevents imperative text from being stored. There is also no explicit consent step, retention period, or validation policy. The weakness is broader than the skill's declared public-relations function and introduces persistent state whe ...[truncated 1287 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic memory writes and cross-session context loading by default. 2. Require explicit, informed user confirmation before storing each item. 3. Restrict memory to a documented allowlist of non-sensitive fields. 4. Reject or neutralize imperative instructions, executable content, and prompt-like rules before storage. 5. Mark all recalled memory as untrusted reference data and isolate it from system and skill instructions. 6. Do not allow recalled content to modify safety rules, tool permissions, or execution policy. 7. Apply retention limits, expiration dates, per-user isolation, and maximum entry sizes. 8. Provide commands to inspect, correct, export, and delete stored entries. 9. Preserve provenance for every entry, including the originating user, session, timestamp, and consent record. 10. Require confirmation before high-importance entries can affect later responses. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38
• Finding: Persistent User Memory Is Stored in an Insecure Plaintext JSON File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-53, 59-66, and 72-88 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```python PALACE_PATH = os.path.expanduser("~/.openclaw/pv_palace/") os.makedirs(PALACE_PATH, exist_ok=True) path = os.path.join(PALACE_PATH, "memories.json") data = {"memories": [], "index": {}} if not os.path.exists(path) else json.load(open(path)) mem_id = hashlib.sha256(f"{content}{datetime.now().isoformat()}".encode()).hexdigest()[:12] memory = {"id": mem_id, "content": content, "importance": importance, "tags": tags or [], "created_at": datetime.now().isoformat()} data["memories"].append(memory) for tag in (tags or []): data["index"].setdefault(tag, []).append(mem_id) json.dump(data, open(path, 'w'), ensure_ascii=False, indent=2) ``` The corresponding read paths directly trust the same file: ```python path = os.path.join(PALACE_PATH, "memories.json") if not os.path.exists(path): return [] data = json.load(open(path)) results = [m for m in data["memories"] if query.lower() in m["content"].lower()] results.sort(key=lambda x: x.get("importance", 0), reverse=True) return results[:limit] ``` ### Technical Analysis Potentially sensitive preferences and decisions are written as plaintext JSON. The implementation does not explicitly set restrictive directory or file permissions, encrypt sensitive data, validate the loaded schema, verify integrity, reject symbolic links, limit file size, or use locking and atomic replacement. The pattern `json.dump(data, open(path, 'w'), ...)` truncates and rewrites the target directly. An interruption or concurrent write can therefore leave a partial or corrupted file. Directly opening a predictable path also follows symbolic links. If another local process can manipulate the memory directory or file under the same account, it can replace or alter the stored data, which is then trusted by `search_memo ...[truncated 1726 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the memory directory with mode `0700` and the memory file with mode `0600`, independently of the process umask. 2. Reject symbolic links and verify that the resolved file remains inside the intended memory directory. 3. Use a secure file-opening pattern with `O_NOFOLLOW`, `O_CREAT`, and explicit permissions where supported. 4. Write through a securely created temporary file in the same directory, flush and synchronize it, and atomically replace the destination. 5. Use file locking or another transaction mechanism to prevent concurrent writers from losing or corrupting data. 6. Validate the JSON schema, field types, entry count, and file size before using loaded content. 7. Add integrity protection, such as an authenticated message code stored separately from the data. 8. Encrypt sensitive memory at rest using platform-backed key storage where appropriate. 9. Use context managers for all file operations and handle parsing, permission, and I/O errors safely. 10. Provide retention and deletion controls so sensitive information is not stored indefinitely. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill’s declared purpose is public-opinion guidance and brand strategy, but most of the implementation introduces a persistent local memory subsystem that stores and retrieves user data across sessions. This is a capability mismatch that can enable undisclosed data collection and retention beyond what a user would reasonably expect from the manifest, increasing privacy and trust risks.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill documents automatic storage of user preferences, decisions, and important information without showing that such collection is necessary for brand-strategy/public-influence assistance. Automatically persisting this information creates a privacy risk, especially because decisions and preferences may be sensitive and are retained locally without clear limits or consent.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill defines an automatic workflow where user inputs are stored based on conversational events and then loaded into new sessions by default. Cross-session persistence of user inputs materially increases privacy risk, can expose prior sensitive context to future interactions, and is especially concerning because it is unrelated to the declared brand-strategy role.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill advertises persistent memory that automatically remembers user preferences, decisions, and important information, but it does not present a clear warning that data will be stored locally on disk. Users may disclose personal or strategic information without understanding that it will persist across sessions.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The natural-language description explicitly states that the digital worker has long-term memory and automatically remembers user information. This creates a default expectation of silent retention, which is risky because it encourages collection of potentially sensitive information without demonstrating necessity or obtaining consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documented workflow says the system will automatically write user data when preferences or decisions are expressed and automatically load that memory into future conversations. This is dangerous because it normalizes silent cross-session data retention without an explicit notice, opt-in, or per-category controls.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill includes executable shell and Python command examples that invoke local persistence functions even though the manifest describes a strategic advisory/public-influence role. Providing operational commands for filesystem-backed memory increases the chance that hosts or users will execute behavior unrelated to the stated purpose, broadening the skill’s effective capability surface.

Static analysis

No suspicious patterns detected.