火一五记忆进化技能

• Outcome: Review
• Latest audit: May 28, 2026 · 7:03 AM UTC
• Version: 3.4.5

Overview

This memory skill mostly matches its stated purpose, but it handles private memory data with under-disclosed external API calls, unsafe TLS settings, hardcoded credentials, and broad workspace mutation authority.

Install only if you are comfortable with a memory skill that writes persistent files across OpenClaw workspaces, can share memories between agents, and sends log or prompt content to MiniMax using a bundled API key. Review or remove the MiniMax scripts, re-enable TLS verification, replace hardcoded credentials with your own configuration, and run batch install, migration, rollback, and team sync only after backing up your ~/.openclaw workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

# 记录到 Cost Tracker
            try:
                os.system(f"{COST_TRACKER_SCRIPT} record "
                          f"--input-tokens {input_tokens} "
                          f"--output-tokens {output_tokens} "
                          f"--model MiniMax-M2.1 "

• Confidence: 95% confidence
• Finding: os.system(f"{COST_TRACKER_SCRIPT} record " f"--input-tokens {input_tokens} " f"--output-tokens {output_tokens} "

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

def _record_cost(input_tokens, output_tokens, model, duration_ms):
    """内部函数：记录成本"""
    try:
        os.system(f'{COST_TRACKER_SCRIPT} record '
                  f'--input-tokens {input_tokens} '
                  f'--output-tokens {output_tokens} '
                  f'--model "{model}" '

• Confidence: 97% confidence
• Finding: os.system(f'{COST_TRACKER_SCRIPT} record ' f'--input-tokens {input_tokens} ' f'--output-tokens {output_tokens} ' f'--model "{model}" '

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and documents capabilities that include shell execution, filesystem read/write, environment access, and network use, but declares no permissions. That mismatch prevents informed consent and safe policy enforcement, especially for an installation-oriented skill that writes into multiple workspace locations and may contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose materially understates behavior: the static finding indicates external LLM API calls with a hardcoded API key, cost-tracking integration, rollback/snapshot tooling, stale-memory reactivation, and secret scanning/team sharing logic beyond a simple local memory system. Hidden network exfiltration paths and hardcoded credentials are especially dangerous because users may install the skill expecting only local memory handling.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The function interpolates agentId directly into filesystem paths like `${openclawDir}/workspace-${agentId}` without validation or normalization. If agentId can be influenced by external input, values containing path traversal segments or unexpected separators could cause the computed paths to point outside the intended `.openclaw` workspace tree, leading to unauthorized read/write access to other files or memory stores.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The installation report includes specific local environment identifiers such as hostname, username, and an absolute workspace path. While not directly enabling code execution, these details unnecessarily expose sensitive system metadata that can aid profiling, targeted social engineering, or later attacks if the report is shared, logged, or synced outside the local machine.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The report directly includes what appear to be personal and financial identifiers, including bank names, account-like numbers, email addresses, and a phone number. Even if listed as items that were 'checked and cleared,' embedding them in a migration report creates a new disclosure surface and is unrelated to the operational need of documenting memory-structure changes for this skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This memory-analysis component includes an unrelated capability to execute an external cost-tracker script, increasing the attack surface beyond its stated purpose. In a skill that processes potentially sensitive logs, hidden side-effect execution is dangerous because it can be swapped or abused to run arbitrary local code under the user's privileges.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code explicitly disables TLS hostname and certificate verification before sending log contents and API credentials to a remote endpoint. This enables man-in-the-middle interception or tampering, which is especially dangerous here because the transmitted data may include sensitive logs and the request carries a hardcoded bearer token.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The docstring claims more reliable API handling, but the implementation weakens transport security by disabling HTTPS verification. This mismatch can mislead reviewers and users into overtrusting the component, reducing the chance that serious confidentiality and integrity risks are noticed.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script goes beyond passive 'dream/memory refinement' and modifies a shared global index file (WORKSPACE_DIR/MEMORY.md). In a multi-skill or multi-agent workspace, this creates integrity risk because an automated background task can silently alter shared state and influence later agent behavior or memory discovery without explicit user approval.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The `revive_memory` path joins a user-supplied relative path with the workspace root and then rewrites the target file without validating that the resolved path stays inside the intended memory directory. An attacker or misuse by another component could supply path traversal such as `../` to modify arbitrary files under `~/.openclaw/workspace`, which exceeds the narrow purpose of access statistics and stale-memory revival.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The `read` command is misleading because it does not return file contents; instead it records access and may automatically revive the file, causing a write. A caller expecting a harmless read operation could trigger unintended state changes, which is dangerous in an agent context because read-like actions are often treated as lower risk than write actions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script replaces each dynamic agent's MEMORY.md with a clean template before checking for sensitive patterns, so the subsequent 'sensitive info cleanup' check never examines the original content. This creates a false sense of sanitization and can lead operators to believe cross-agent sensitive-memory isolation occurred when the script actually performed destructive overwrite rather than verified cleanup.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: A memory-evolution skill unexpectedly includes a third-party network client plus shell-based cost-tracker execution, which is materially outside the declared functionality. In this skill context, hidden outbound transmission and command execution are more dangerous because users would reasonably expect local memory management, not credentialed API calls and local script invocation.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The docstring presents the module as a generic API wrapper but omits that every call also triggers cost-tracker shell execution, which hides a material side effect from integrators. Misleading documentation increases the chance that developers embed this code into trusted flows without realizing it executes additional local commands.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The rollback restores not only memory data under the workspace but also `openclaw.json`, which is broader application state than a memory-focused rollback would imply. If a snapshot is stale or maliciously crafted, restoring this config can silently change agent behavior, settings, or trust boundaries beyond the expected memory contents.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script enumerates all matching agent workspaces under ~/.openclaw and recursively searches them for hard-coded bank names and account/ID-like numbers. That goes beyond validating memory-directory isolation and creates unnecessary access to potentially sensitive data across unrelated workspaces, increasing privacy risk and the blast radius if the script is run in shared or multi-tenant environments.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The header states the script verifies post-migration memory isolation, but the implementation also performs broad content hunting across agent workspaces. This mismatch is security-relevant because operators may run the script expecting a narrow filesystem integrity check while it actually inspects workspace contents, undermining informed use and review.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases are broad enough that the skill could activate in ordinary conversation about memory, reconstruction, or system behavior, causing unintended execution of capture, recall, or installation-related flows. In a memory skill with persistence and sharing features, overbroad activation increases the chance of collecting or modifying data without clear user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill describes automatic capture and team/shared memory behavior without corresponding privacy, retention, consent, or integrity warnings. Because the feature set explicitly includes persistent collection and cross-agent sharing, omission of these disclosures can lead to unintentional storage or propagation of sensitive conversational content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The install and usage instructions encourage immediate setup and batch deployment, but do not warn that the skill writes persistent memory files and can share information across agents or teams. This is risky because users may deploy it broadly into multiple workspaces without understanding the privacy and integrity consequences.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The access rule triggers memory behavior whenever memory merely 'seems relevant' or when the user mentions prior work, which is overly broad for a persistence and recall mechanism. In a memory-management skill, this increases the chance of unintended retrieval or writing of prior-session information, including personal or team context, without clear user intent or tight scoping.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script automatically persists conversation content to disk without any consent prompt, notice, or filtering, including a raw content block. In a memory skill, that behavior is core functionality, but it still creates a real privacy and data-handling risk because users may reveal secrets, personal data, or operational details that become silently stored.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Reading from stdin and auto-capturing piped content means any upstream process can cause potentially sensitive data to be silently persisted. This is especially risky because piped input often carries logs, transcripts, or command output that may include tokens, credentials, or private user data.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.