skill-heartbeat-memory

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:48 PM UTC
• Version: 0.0.7

Overview

This skill is broadly aligned with memory saving, but it automatically turns chat transcripts into persistent agent memory without enough safeguards against injected or misleading session content.

Install only if you are comfortable with an automated process reading recent OpenClaw session history and writing summaries into workspace memory. Review MEMORY.md and Daily notes regularly, limit processSessionsAfter and maxSessionsPerRun, consider disabling filesystem scanning or notifications if not needed, and do not treat generated memory as authoritative without human review.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: index.js:680

Finding

Untrusted Session Content Can Poison Persistent Agent Memory

Content

View full analysis

0) { const content = messages.slice(0, 10).map(m => `${m.role}: ${(m.content || '').substring(0, 200)}` ).join('\n'); if (sessions_spawn_fn) { try { console.log(` 🤖 调用 LLM 提炼...`); const llmResult = await sessions_spawn_fn({ task: buildSummarizeTask(content, sessionId), runtime: 'subagent', mode: 'run', // 使用配置的 timeout，默认 1000 秒（防止 subagent 超时） timeoutSeconds: config.memorySave?.timeoutSeconds || DEFAULT_CONFIG.memorySave.timeoutSeconds, // 执行完毕后自动删除 subagent session，避免残留导致下一轮 heartbeat 被误处理 cleanup: 'delete' }); // 追踪自身产生的 subagent session ID（防止下一轮被当作新 session 处理） if (llmResult && llmResult.sessionId) { ownSubagentIds.add(llmResult.sessionId); } const parsed = parseLLMResult(llmResult); if (parsed) { summary = parsed; } else { console.log(` ⚠️ LLM 解析失败，使用降级方案`); summary = summarizeSessionLocal(messages, sessionId); } ``` ```js if (summaries.length > 0) { // 空转保护：如果所有摘要都是自身 subagent 的记录，跳过写入 const hasRealC ...[truncated 5352 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (125)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 567)May include surrounding context.

openclaw gateway restart

4. 重建配置文件

rm ~/.openclaw/workspace/memory/heartbeat-memory-config.json

下次执行时会自动重建

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is memory preservation, but the static findings indicate additional behaviors such as external notifications, CLI execution, and local metadata/config inspection. That mismatch is dangerous because users may enable the skill expecting local note generation while it also reaches into broader system state or external channels, expanding the trust boundary without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is memory preservation, but the static findings indicate additional behaviors such as external notifications, CLI execution, and local metadata/config inspection. That mismatch is dangerous because users may enable the skill expecting local note generation while it also reaches into broader system state or external channels, expanding the trust boundary without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is memory preservation, but the static findings indicate additional behaviors such as external notifications, CLI execution, and local metadata/config inspection. That mismatch is dangerous because users may enable the skill expecting local note generation while it also reaches into broader system state or external channels, expanding the trust boundary without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The documented purpose is memory preservation, but the static findings indicate additional behaviors such as external notifications, CLI execution, and local metadata/config inspection. That mismatch is dangerous because users may enable the skill expecting local note generation while it also reaches into broader system state or external channels, expanding the trust boundary without clear consent.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: heartbeat-memory

description: 自动记忆保存 Skill。支持 Heartbeat 自动触发和主 Agent 中手动调用两种方式。自动检查新 sessions，生成 Daily 笔记，定期提炼 MEMORY.md，支持备份已删除的 sessions。

---

# heartbeat-memory

> 🌐 **ClawHub:​** [clawhub.ai/JustZeroX/heartbeat-memory](https://clawhub.ai/JustZeroX/heartbeat-memory)  

> 💻 **GitHub:​** [github.com/JustZeroX/skill-heartbeat-memory](https://github.com/JustZeroX/skill-heartbeat-memory.git)

Heartbeat 自动记忆保存 - 支持 **Heartbeat 自动触发** 和 **手动触发** 两种方式。自动检�

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The troubleshooting guidance includes a raw deletion command targeting a workspace config file. In an agent/tooling context, destructive shell examples can be copied or auto-executed without sufficient validation, and reliance on relative paths plus automatic CWD assumptions raises the chance of deleting the wrong file or normalizing unsafe deletion practices.

Content

Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.

openclaw gateway restart

4. 重建配置文件（相对于当前工作区）

rm ./memory/heartbeat-memory-config.json

text

> 💡 **路径说明：​** 故障排查命令中的路径都是相对于当前工作区（`./`）。在工作区目录下执行即可，无需指定完整路径。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md

本文档提供 heartbeat-memory Skill 的完整故障排查指南。

> 💡 **路径说明：​** 本文档中的命令分两类：
> - **相对路径（`./`）​**：在工作区目录下执行，适用于所有工作区，无需替换。
> - **绝对路径示例**：使用默认工作区 `~/.openclaw/workspace/` 举例。如使用多个 Agent，请将 `workspace` 替换为对应工作区名称（如 `workspace-dev`、`workspace-test`）。

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:131