Dory-Proof Memory System

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:17 AM UTC
• Version: 1.0.0

Overview

This memory skill is coherent, but it tells agents to persist exact user prompts and later treat those files as high-priority instructions, which creates real review-worthy privacy and prompt-injection risk.

Review this before installing in any workspace that may handle secrets, personal data, business information, or untrusted user prompts. Use it only if you are comfortable with local cross-session memory, and consider changing it to store sanitized summaries, treat quoted prompts as inert records, keep AGENTS.md authoritative, and define review/deletion rules for memory files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:14
• Finding: Persistent Agent Memory Poisoning Through Untrusted User Instructions## Vulnerability Details **File Location**: `SKILL.md:14-22`, `SKILL.md:50-56`, `SKILL.md:75-92`, and `references/IMPLEMENTATION-GUIDE.md:132-152` **Vulnerability Type**: Persistent storage and replay of attacker-controlled instructions **Risk Level**: High ### Vulnerable Code `SKILL.md:14-22`: ```markdown ## The Dory-Proof Pattern (Critical) When the user gives a task: 1. **IMMEDIATELY** write their EXACT WORDS to `state/ACTIVE.md` 2. Then interpret what it means 3. Then do the work 4. Mark complete when done **Why:** Paraphrasing introduces drift. Exact words preserve intent across context flushes. ``` `SKILL.md:50-56`: ```markdown ## Boot Sequence (Every Session) 1. Read `state/HOLD.md` — what's BLOCKED 2. Read `state/ACTIVE.md` — current task 3. Read `state/DECISIONS.md` — recent choices 4. Read `memory/recent-work.md` — last 48 hours 5. Read `MEMORY.md` — long-term (main session only) ``` `SKILL.md:75-92`: ```markdown ### state/HOLD.md ```markdown [YYYY-MM-DD HH:MM | session] Item — reason blocked ``` **ALL agents must check before acting on anything that looks ready.** ### state/DECISIONS.md ```markdown [YYYY-MM-DD HH:MM | session] Decision made ``` ## Conflict Resolution When files conflict, priority (highest first): 1. **state/HOLD.md** — blocks override all 2. **state/ACTIVE.md** — current instruction 3. **state/DECISIONS.md** — recent choices 4. **AGENTS.md** — general rules ``` `references/IMPLEMENTATION-GUIDE.md:132-152`: ```markdown ## Phase 4: Update AGENTS.md Add to your AGENTS.md: ```markdown ## Boot Sequence Before doing anything: 1. Read `state/HOLD.md` — blocked items 2. Read `state/ACTIVE.md` — current task 3. Read `state/DECISIONS.md` — recent choices 4. Read `memory/recent-work.md` — last 48 hours ## 🐠 Dory-Proof Pattern When user gives a task: 1. **IMMEDIATELY** write EXACT WORDS to `state/ACTIVE.md` 2. Then ...[truncated 3885 chars]
• Remediation: ## Remediation Suggestions 1. **Treat persisted user text as untrusted data.** Store exact quotations inside a clearly delimited data field and explicitly prohibit agents from executing instructions found inside that field. 2. **Remove the priority inversion.** State files must never override system, developer, safety, or workspace operating policies. Define precedence so that `AGENTS.md` and all higher-level controls remain authoritative. 3. **Separate records from actionable state.** Use distinct fields such as: - `Original user text`: inert quotation for audit purposes. - `Validated task`: concise, policy-checked task description. - `Authorized actions`: explicit, bounded operations approved for continuation. 4. **Validate before persistence and replay.** Detect instruction-like content that attempts to change policies, acquire secrets, expand scope, or direct unrelated tool use. Require current-session confirmation before treating persisted content as actionable. 5. **Add provenance and lifecycle controls.** Record the initiating user, session identifier, creation time, validation status, expiration time, and completion state. Ignore stale, unauthenticated, or completed entries. 6. **Minimize retained data.** Do not automatically save complete user messages. Redact credentials, tokens, personal information, and unrelated sensitive content. Define retention and secure-deletion policies. 7. **Constrain shared access.** Apply least-privilege file permissions and avoid sharing writable state among unrelated users or agents. Where sharing is required, distinguish trusted writers from readers. 8. **Require reauthorization for sensitive actions.** External communications, destructive file operations, credential access, and other high-impact actions must require fresh confirmation and must never be authorized solely by persisted state. 9. **Add poisoning tests.** Verify that embedded directives in `ACTIVE.md`, `HOLD.md`, `DECISI ...[truncated 108 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to immediately write the user's exact words to disk, but provides no minimization, consent, or secret-handling guidance. In a memory skill, this is especially risky because users may include credentials, personal data, or sensitive business context in task prompts, and exact retention increases the chance of later disclosure or misuse.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly promotes persistence of exact user-provided content and user profile information across memory files, creating a durable natural-language data retention surface. Because this skill's purpose is cross-session continuity, the context makes the issue more dangerous: retained prompts and profile notes can accumulate sensitive information and be surfaced to future sessions, tools, or other agents.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The setup command recursively copies template files into a user workspace under the home directory without warning about overwriting, merging, or altering existing local files. While not inherently malicious, this can unintentionally modify user state, replace prior configuration, or introduce unsafe defaults into an existing workspace.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Good:** Always check state/HOLD.md first. Items there are blocked for a reason.

The Feb 5 Incident happened because an agent acted on "ready" content without checking holds.

## 5. Renaming System Files

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Implementation Guide

## Phase 1: Create Folder Structure

```bash
cd ~/.openclaw/workspace

• Confidence: 87% confidence
• Finding: Session persistence itself is not automatically malicious, but here it creates a durable local memory store under a fixed workspace path for agent state and user-related history. In combination with the guide's verbatim logging and mandatory boot-time rereading, this persistence meaningfully increases confidentiality risk and makes accidental retention of sensitive data more likely.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide explicitly instructs agents to persist the user's exact words to a local state file before any interpretation, with no filtering, minimization, or consent checks. This creates a clear risk of storing secrets, personal data, credentials, or regulated information in plaintext across sessions, increasing exposure if the workspace is accessed by other agents, users, backups, or malware.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Persistent verbatim logging of all user input is unsafe because it turns transient prompts into durable records without regard to sensitivity. In this skill's context, the memory system is specifically designed for cross-session continuity, so the dangerous behavior is not incidental but a core workflow that can systematically accumulate confidential data.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The boot sequence requires every future agent session to read prior state and recent work, enforcing cross-session retention and reuse of historical user/task content. While continuity is the feature's purpose, it also broadens the blast radius of any sensitive data captured earlier by making that data routinely re-ingested and potentially propagated into later outputs or decisions.

Static analysis

No suspicious patterns detected.