ClawHub
Back to skill

Security audit

Dory-Proof Memory System

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is coherent, but it tells agents to persist exact user prompts and later treat those files as high-priority instructions, which creates real review-worthy privacy and prompt-injection risk.

Review this before installing in any workspace that may handle secrets, personal data, business information, or untrusted user prompts. Use it only if you are comfortable with local cross-session memory, and consider changing it to store sanitized summaries, treat quoted prompts as inert records, keep AGENTS.md authoritative, and define review/deletion rules for memory files.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:14
Finding

Persistent Agent Memory Poisoning Through Untrusted User Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-22, SKILL.md:50-56, SKILL.md:75-92, and references/IMPLEMENTATION-GUIDE.md:132-152
Vulnerability Type: Persistent storage and replay of attacker-controlled instructions
Risk Level: High

Vulnerable Code

SKILL.md:14-22:

markdown
## The Dory-Proof Pattern (Critical)

When the user gives a task:
1. **IMMEDIATELY** write their EXACT WORDS to `state/ACTIVE.md`
2. Then interpret what it means
3. Then do the work
4. Mark complete when done

**Why:** Paraphrasing introduces drift. Exact words preserve intent across context flushes.

SKILL.md:50-56:

markdown
## Boot Sequence (Every Session)

1. Read `state/HOLD.md` — what's BLOCKED
2. Read `state/ACTIVE.md` — current task
3. Read `state/DECISIONS.md` — recent choices
4. Read `memory/recent-work.md` — last 48 hours
5. Read `MEMORY.md` — long-term (main session only)

SKILL.md:75-92:

markdown
### state/HOLD.md
```markdown
[YYYY-MM-DD HH:MM | session] Item — reason blocked

ALL agents must check before acting on anything that looks ready.

state/DECISIONS.md

markdown
[YYYY-MM-DD HH:MM | session] Decision made

Conflict Resolution

When files conflict, priority (highest first):

  1. state/HOLD.md — blocks override all
  2. state/ACTIVE.md — current instruction
  3. state/DECISIONS.md — recent choices
  4. AGENTS.md — general rules
text

`references/IMPLEMENTATION-GUIDE.md:132-152`:

```markdown
## Phase 4: Update AGENTS.md

Add to your AGENTS.md:

```markdown
## Boot Sequence

Before doing anything:
1. Read `state/HOLD.md` — blocked items
2. Read `state/ACTIVE.md` — current task
3. Read `state/DECISIONS.md` — recent choices
4. Read `memory/recent-work.md` — last 48 hours

## 🐠 Dory-Proof Pattern

When user gives a task:
1. **IMMEDIATELY** write EXACT WORDS to `state/ACTIVE.md`
2. Then 
...[truncated 3885 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat persisted user text as untrusted data. Store exact quotations inside a clearly delimited data field and explicitly prohibit agents from executing instructions found inside that field.

  2. Remove the priority inversion. State files must never override system, developer, safety, or workspace operating policies. Define precedence so that AGENTS.md and all higher-level controls remain authoritative.

  3. Separate records from actionable state. Use distinct fields such as:

    • Original user text: inert quotation for audit purposes.
    • Validated task: concise, policy-checked task description.
    • Authorized actions: explicit, bounded operations approved for continuation.

  4. Validate before persistence and replay. Detect instruction-like content that attempts to change policies, acquire secrets, expand scope, or direct unrelated tool use. Require current-session confirmation before treating persisted content as actionable.

  5. Add provenance and lifecycle controls. Record the initiating user, session identifier, creation time, validation status, expiration time, and completion state. Ignore stale, unauthenticated, or completed entries.

  6. Minimize retained data. Do not automatically save complete user messages. Redact credentials, tokens, personal information, and unrelated sensitive content. Define retention and secure-deletion policies.

  7. Constrain shared access. Apply least-privilege file permissions and avoid sharing writable state among unrelated users or agents. Where sharing is required, distinguish trusted writers from readers.

  8. Require reauthorization for sensitive actions. External communications, destructive file operations, credential access, and other high-impact actions must require fresh confirmation and must never be authorized solely by persisted state.

  9. Add poisoning tests. Verify that embedded directives in ACTIVE.md, HOLD.md, `DECISI ...[truncated 108 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to immediately write the user's exact words to disk, but provides no minimization, consent, or secret-handling guidance. In a memory skill, this is especially risky because users may include credentials, personal data, or sensitive business context in task prompts, and exact retention increases the chance of later disclosure or misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly promotes persistence of exact user-provided content and user profile information across memory files, creating a durable natural-language data retention surface. Because this skill's purpose is cross-session continuity, the context makes the issue more dangerous: retained prompts and profile notes can accumulate sensitive information and be surfaced to future sessions, tools, or other agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup command recursively copies template files into a user workspace under the home directory without warning about overwriting, merging, or altering existing local files. While not inherently malicious, this can unintentionally modify user state, replace prior configuration, or introduce unsafe defaults into an existing workspace.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/ANTI-PATTERNS.md (reported line 42)May include surrounding context.

md
**Good:** Always check state/HOLD.md first. Items there are blocked for a reason.

The Feb 5 Incident happened because an agent acted on "ready" content without checking holds.

## 5. Renaming System Files

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

Session persistence itself is not automatically malicious, but here it creates a durable local memory store under a fixed workspace path for agent state and user-related history. In combination with the guide's verbatim logging and mandatory boot-time rereading, this persistence meaningfully increases confidentiality risk and makes accidental retention of sensitive data more likely.

Content

Scanner excerpt · references/IMPLEMENTATION-GUIDE.md (reported line 3)May include surrounding context.

Implementation Guide

Phase 1: Create Folder Structure

bash
cd ~/.openclaw/workspace

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide explicitly instructs agents to persist the user's exact words to a local state file before any interpretation, with no filtering, minimization, or consent checks. This creates a clear risk of storing secrets, personal data, credentials, or regulated information in plaintext across sessions, increasing exposure if the workspace is accessed by other agents, users, backups, or malware.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Persistent verbatim logging of all user input is unsafe because it turns transient prompts into durable records without regard to sensitivity. In this skill's context, the memory system is specifically designed for cross-session continuity, so the dangerous behavior is not incidental but a core workflow that can systematically accumulate confidential data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The boot sequence requires every future agent session to read prior state and recent work, enforcing cross-session retention and reuse of historical user/task content. While continuity is the feature's purpose, it also broadens the blast radius of any sensitive data captured earlier by making that data routinely re-ingested and potentially propagated into later outputs or decisions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.