火一五记忆进化技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:08 AM UTC
• Version: 3.4.5

Overview

This memory skill has a coherent purpose, but it handles private agent memory with unsafe external LLM transmission, bundled credentials, broad cross-agent changes, and weak controls.

Review before installing. Do not run Dream Agent or batch-install on sensitive workspaces unless the publisher removes the bundled API key, restores normal TLS verification, documents and minimizes external data sharing, validates all persistent memory paths, pins dependencies, and adds explicit target selection with backups for cross-agent changes.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dream-api.py:26

Finding

External Transmission of Complete Memory Logs with TLS Verification Disabled

Content

View full analysis

/dev/null 2>&1; then MEMORIES_JSON=$(timeout 30 python3 "$API_SCRIPT" "$LOG_CONTENT" 2>/dev/null) || MEMORIES_JSON="" else MEMORIES_JSON=$(python3 "$API_SCRIPT" "$LOG_CONTENT" 2>/dev/null) || MEMORIES_JSON="" fi echo "$MEMORIES_JSON" > /tmp/dream-analysis-result.json ``` ### Technical Analysis The Dream workflow reads a complete daily memory log and inserts it verbatim into a request sent to `https://api.minimaxi.com/v1/text/chatcompletion_v2`. Such logs may contain personal conversations, user preferences, project details, external-system references, task identifiers, or accidentally captured credentials. Although the Skill states that the Dream Agent is LLM-driven, it does not provide an explicit consent boundary, field-level data-minimizatio ...[truncated 1486 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dream-api.py:15

Finding

Hard-Coded MiniMax API Credential Distributed in Source Code

Content

View full analysis

" API_URL = "https://api.minimaxi.com/v1/text/chatcompletion_v2" ``` The same apparent credential is embedded in both Python files and is placed directly in the authorization header: ```python headers={ 'Authorization': f'Bearer {API_KEY}', 'Content-Type': 'application/json' } ``` ### Technical Analysis An API key is stored as a source-code constant and distributed with the Skill package. Any person or process able to download or inspect the package can recover the credential. Duplicating the key in multiple files also increases the probability that partial remediation will leave an active copy behind. A hard-coded shared credential prevents meaningful attribution between users of the Skill and bypasses normal secret rotation and per-installation access controls. ### Attack Path 1. An attacker obtains the public or installed Skill package. 2. The attacker reads either affected Python file. 3. The attacker extracts the bearer credential. 4. The attacker sends direct requests to the MiniMax API using the credential. 5. Requests are billed to or attributed to the credential owner until the key is revoked. ### Impact Assessment - Unauthorized API use and quota consumption. - Potential financial loss or service exhaustion. - Impersonation of the credential owner at the API boundary. - Loss of auditability because legitimate and unauthorized traffic shares one key. - Possible account-level consequences if the credential grants broader API permissions. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dream-api.py:84

Finding

Shell Command Injection Through Cost-Tracking Commands

Content

View full analysis

/dev/null 2>&1") except: pass ``` The generic wrapper additionally places a caller-controlled model value in a shell command: ```python def _record_cost(input_tokens, output_tokens, model, duration_ms): try: os.system(f'{COST_TRACKER_SCRIPT} record ' f'--input-tokens {input_tokens} ' f'--output-tokens {output_tokens} ' f'--model "{model}" ' f'--duration {duration_ms} > /dev/null 2>&1') except: pass ``` ### Technical Analysis `os.system()` invokes a command shell. Values derived from the API response are interpolated without strict type validation or shell-safe argument handling. The generic wrapper also accepts a caller-supplied `model` string and embeds it inside double quotes, which does not prevent substitutions such as `$(...)`, backticks, escaped quotes, or command separators after quote termination. The practical severity is increased because both API clients disable TLS certificate validation. An on-path attacker can manipulate response fields that later enter the shell command. The broad exception handler does not prevent exploitation because exceptions occur after the shell has already parsed and poten ...[truncated 1013 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/dream-consolidate.py:29

Finding

Untrusted LLM Output Can Escape the Memory Directory and Poison Persistent Agent State

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/save-memory.sh:145

Finding

Unsanitized Memory Name Permits Arbitrary Local File Writes

Content

View full analysis

"$FILEPATH" --- name: ${NAME} type: ${TYPE} description: ${DESCRIPTION} created: ${TODAY} updated: ${TODAY} --- ${CONTENT} EOF ``` ### Technical Analysis The memory type is constrained, but the caller-controlled `NAME` is used directly as part of the path. It is not checked for `/`, `..`, absolute paths, control characters, or canonical containment. A name containing traversal components can cause `FILEPATH` to resolve outside `memory/`. The shell redirection then creates or overwrites the resolved target. The interactive overwrite prompt only applies if the destination already exists and can also be bypassed when the caller is able to provide input. ### Attack Path 1. A caller or manipulated agent invokes `save-memory.sh` with a crafted name containing traversal components. 2. The script appends `.md` but does not remove path separators or `..`. 3. The resulting path escapes the selected memory-type directory. 4. The here-document writes attacker-controlled metadata and content to the target path. 5. If the target is consumed as agent configuration or memory, the write may also cause persistent behavioral manipulation. ### Impact Assessment The attacker can create or overwrite `.md` files accessible to the OpenClaw user, subject to the constructed suffix and filesystem permissions. Possible targets include other memory indexes, agent ...[truncated 107 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dream.sh:95

Finding

Predictable Shared Temporary File Enables Result Tampering and Symlink Attacks

Content

View full analysis

/tmp/dream-analysis-result.json fi ``` The consolidation process later uses the same global path: ```python analysis_file = '/tmp/dream-analysis-result.json' memory_dir = os.path.expanduser('~/.openclaw/workspace/memory') workspace_dir = os.path.expanduser('~/.openclaw/workspace') if not os.path.exists(analysis_file): sys.exit(1) created = create_memory_files( analysis_file, memory_dir, workspace_dir, today ) ``` ### Technical Analysis The analysis result is stored at a fixed, predictable path in a shared temporary directory. The script does not securely create the file, verify ownership, reject symbolic links, restrict its permissions, bind it to the current process, or remove it after use. A local attacker can pre-create the path as a symlink to another user-writable target. Shell redirection follows the link and overwrites the target. Alternatively, the attacker can replace the JSON file between production and consumption, causing arbitrary attacker-provided memory objects to be consolidated. The result may itself contain sensitive summaries extracted from private logs, and default temporary-file permissions may permit unintended local access depending on the process umask. ### Attack Path 1. A local attacker predicts `/tmp/dream-analysis-result.json`. 2. The attacker creates it as a symlink to a target file or repeatedly replaces it with attacker-controlled JSON. 3. `dream.sh` writes the model result through the predictable path, potentially following the symlink. 4. Before consolidation, the attacker substitutes a malicious response. 5. `dream-consolidate.py` trusts and persists the substituted memorie ...[truncated 282 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:30

Finding

Installer Fetches an Undeclared and Unpinned Third-Party Skill with Force

Content

View full analysis

/dev/null; then cd "$OPENCLAW_DIR/workspace" && clawhub install fluid-memory --force 2>&1 || { echo "Dependency installation failed" } cd "$SKILL_DIR" else echo "clawhub was not found" fi fi ``` ### Technical Analysis The installer introduces a third-party component that is absent from the declared dependency metadata. It selects the component only by a mutable package name, with no version pin, cryptographic digest, signature verification, or reviewed source reference. The `--force` option may replace an existing installation. This contradicts other project documentation stating that third-party dependencies were removed and makes it difficult for users to understand the effective code being installed. ### Attack Path 1. A user follows the documented installation procedure. 2. The installer checks for `fluid-memory`. 3. If absent, it resolves the current package associated with that name through ClawHub. 4. The installer downloads and installs the mutable dependency with `--force`. 5. Any malicious or compromised dependency code becomes available for execution inside OpenClaw. ### Impact Assessment - Execution exposure to code not contained in or reviewed with this Skill. - Dependency-confusion, package takeover, or compromised-release risk. - Replacement of an existing local component because force installation is enabled. - Incomplete software in ...[truncated 51 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/batch-install.sh:36

Finding

Batch Installer Deletes Skills and Overwrites Heartbeat Configuration Across All Matching Agents

Content

View full analysis

/dev/null | sort) for ws in $WORKSPACES; do ws_name=$(basename "$ws") skills_dir="$ws/skills" memory_dir="$ws/memory" mkdir -p "$skills_dir" for skill in "${CORE_SKILLS[@]}"; do src_dir="$MAIN_WORKSPACE/skills/$skill" if [ -d "$src_dir" ]; then if [ ! -d "$skills_dir/$skill" ]; then cp -r "$src_dir" "$skills_dir/$skill" else rm -rf "$skills_dir/$skill" cp -r "$src_dir" "$skills_dir/$skill" fi else existing_src="$OPENCLAW_DIR/workspace-wecom-default-dm-xun/skills/$skill" if [ -d "$existing_src" ]; then rm -rf "$skills_dir/$skill" cp -r "$existing_src" "$skills_dir/$skill" fi fi done if [ -f "$MAIN_WORKSPACE/HEARTBEAT.md" ]; then cp "$MAIN_WORKSPACE/HEARTBEAT.md" "$ws/HEARTBEAT.md" fi done ``` ### Technical Analysis The batch installer discovers every directory matching `workspace-wecom-*` and modifies it without an explicit per-agent allow-list or confirmation. Existing Skill directories are recursively deleted before replacement, and every agent’s `HEARTBEAT.md` is overwritten with the main workspace version. `HEARTBEAT.md` may influence recurring agent behavior. Copying it across unrelated direct-message and group agents weakens the stated isolation model and may propagate instructions or operational assumptions intended only for the main workspace. No backup, ownership check, atomic deployment, merge operation, or rollback transaction is performed. ### Attack Path 1. A user executes the documented batch installation command. 2. The script enume ...[truncated 760 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (115)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description is materially inconsistent with the behaviors implied by the document and findings: it presents a high-level memory feature set while also including deployment, cross-workspace installation, and other operational actions not clearly disclosed. Security review depends on accurate declarations; when behavior is broader than the stated purpose, users may authorize a skill without understanding its real reach.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The report includes unredacted banking names, email addresses, phone numbers, and long numeric identifiers that appear to be personal or financial data. Even though the text says these items were 'checked and cleared' from cross-agent copying, embedding them directly in a migration report creates a fresh disclosure risk and needlessly propagates sensitive information in a documentation artifact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.