OpenClaw Memory Upgrade

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 1.0.0

Overview

This memory-upgrade skill is transparent about adding persistence, but it over-collects sensitive conversation data such as API keys, contact details, and searchable session history without clear safeguards.

Review carefully before installing. Do not use the configuration as written in environments where conversations may include credentials, personal data, confidential business details, or multiple users. Remove API keys, tokens, contact details, and other sensitive data from capture rules; disable automatic session indexing and auto-recall unless explicitly needed; pin and audit third-party plugin versions; and define retention and deletion procedures for memory files, indexes, caches, and plugin stores.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48

Finding

Persistent Plaintext Storage of API Keys and Personal Information

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:73

Finding

Cross-Session Disclosure Through Broad Transcript Indexing and Automatic Recall

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:192

Finding

Execution of Unpinned Third-Party Plugins and npm Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The memoryFlush prompt explicitly instructs extraction and storage of highly sensitive material including API keys and contact information into persistent files. This is dangerous because credentials, personal data, and infrastructure details may be written to disk automatically during compaction, expanding exposure through file compromise, indexing, later recall, or accidental inclusion in responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill promotes persistent, searchable retention of user conversation data across sessions without any explicit consent flow, minimization guidance, or privacy warning. Because the stated goal is to remember user identity, work, and prior discussions, it materially increases the chance that sensitive personal or business data will be stored and later surfaced unexpectedly.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These instructions create deliberate retention of sensitive user data, specifically credentials and contact information, in persistent memory artifacts. Even if intended for convenience rather than abuse, durable storage of secrets and personal data increases the blast radius of local compromise, plugin misuse, backups, or later disclosure by the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The AGENTS.md instructions direct the agent to write important information to daily files every session and to promote those notes into long-term memory, but provide no safeguards around sensitive content. In practice this encourages indiscriminate persistence of user data, project details, and operational context that may exceed what is necessary and remain accessible across future sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This is a clear case of session persistence: the skill instructs the agent to write conversation-derived data to dated memory files for future use. In context, persistence is the feature being added, but it becomes risky because the persisted set explicitly includes sensitive technical and personal information, making later retrieval or leakage more likely.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

"enabled": true,
      "softThresholdTokens": 4000,
      "systemPrompt": "Session nearing compaction. Analyze the conversation and extract durable memories NOW before context is lost.",
      "prompt": "Scan the current conversation and write any of the following to memory/YYYY-MM-DD.md (use today's date):\n\n1. DECISIONS made (with reasoning and context)\n2. USER PREFERENCES or corrections expressed\n3. TECHNICAL DETAILS (commands, configs, API keys, endpoints, file paths)\n4. PROJECT STATUS changes or milestones\n5. PEOPLE mentioned (names, roles, contact info, relationships)\n6. WORKFLOWS or processes described\n7. ERRORS encountered and their solutions\n8. OPINIONS or feedback the user gave\n\nFor each item, include timestamps and enough context that future-you can understand it without the conversation. If nothing meaningful happened, reply with NO_REPLY."
    }
  }
}

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The session policy normalizes preserving any 'important' information into daily and long-term memory files without defining safety boundaries. While less explicit than the memoryFlush prompt, it still creates a durable collection mechanism for potentially sensitive user and project data that can accumulate over time.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented architecture chains capture, file writes, indexing, auto-recall, and long-term retention into a multilayer persistence pipeline. This makes the overall system more dangerous because once sensitive data enters any layer, it can be copied, reindexed, and resurfaced across multiple mechanisms, making deletion and control harder.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.