ClawHub
Back to skill

Security audit

Markdown Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local memory skill, but it asks the agent to persist and reload broad session, user, and personality data in ways that can affect future behavior without enough user control.

Install only if you intentionally want cross-session local memory. Before using it, define what may be saved, avoid storing sensitive personal or credential data, keep memories separate from agent policy/personality instructions, and create a clear way to inspect, edit, delete, and roll back saved entries and any AGENTS.md changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:89
Finding

Persistent Agent Memory and Personality Poisoning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89-116
Vulnerability Type: Persistent storage of conversation-derived content in instruction-bearing memory and identity files
Risk Level: High

Vulnerable Segment

The following is a faithful English translation of the complete relevant source segment:

markdown
1. Read `SOUL.md` — AI personality
2. Read `USER.md` — user information
3. Read `memory/YYYY-MM-DD.md` (today and yesterday)
4. **Main session**: Read `MEMORY.md`
5. Check the `knowledge/` directory

## Saving Memory

When the user says "remember...":
- Update the record in `memory/YYYY-MM-DD.md`
- Synchronize important content to `MEMORY.md`
- Optionally store it in the vector database

```bash
# Add memory with an importance score
python3 ~/.openclaw/workspace/scripts/memory-system/context-memory.py add "content" 8

# Add tags
python3 ~/.openclaw/workspace/scripts/memory-system/memory-py.py add "content" "tag1,tag2"

Update Rules

Files That Must Be Updated

  1. memory/YYYY-MM-DD.md - every session
  2. MEMORY.md - new lessons or important information
  3. SOUL.md - personality changes
  4. USER.md - user preference changes
text

### Technical Analysis

The Skill instructs the agent to persist conversation-derived information into files that are automatically loaded during later sessions. These files do not serve only as passive records: `SOUL.md` defines agent personality, `MEMORY.md` supplies long-term context, and `USER.md` influences behavior based on supposed user preferences.

No trust boundary or validation mechanism separates ordinary user data from executable natural-language instructions. The Skill also lacks provenance tracking, instruction filtering, confirmation requirements, integrity controls, and a distinction between trusted policy and untrusted remembered content.

Consequently, attacker-controlled text can be stored in a con
...[truncated 1789 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prohibit automatic modification of SOUL.md, core policy files, and other instruction-bearing resources.
  2. Store remembered information in a structured data format with fixed fields rather than unrestricted Markdown instructions.
  3. Treat all persisted conversation content as untrusted data when it is loaded into a future prompt.
  4. Reject or quarantine content containing role directives, policy overrides, tool instructions, or requests to alter future behavior.
  5. Require explicit, informed user confirmation before writing any long-term memory.
  6. Record provenance, timestamp, initiating user, and approval status for every memory entry.
  7. Separate factual user preferences from system policy and agent personality definitions.
  8. Apply access controls so ordinary Skill execution cannot write to identity or global instruction files.
  9. Provide review, expiry, deletion, and rollback mechanisms for persisted entries.
  10. Load only memory records relevant to the current task instead of automatically importing unrestricted files into every session.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:134
Finding

Persistent Modification of Global Agent Operating Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 134-152
Vulnerability Type: Promotion of Skill-specific instructions into persistent global agent policy
Risk Level: Medium

Vulnerable Segment

The following is a faithful English translation of the complete relevant source segment:

markdown
Add the following to AGENTS.md:

```markdown
## Memory

### Daily Records (`memory/YYYY-MM-DD.md`)
- Record key content from every session
- Format: `## Session X / ### Topic / Decisions / Tasks`

### Long-Term Memory (`MEMORY.md`)
- Core principles and preferences
- Important lessons
- Prohibited actions
- Load only in the main session

### Vector Search
- Model: Ollama + nomic-embed-text
- Script: context-memory.py
text

### Technical Analysis

The Skill directs users or agents to place its operating rules into `AGENTS.md`, an instruction-bearing workspace file that can govern subsequent agent sessions. This expands the Skill's influence beyond an explicit invocation and turns local Skill guidance into persistent global policy.

The inserted policy requires ongoing session recording and long-term memory loading. Combined with unrestricted Markdown memory files, this creates a durable path through which stored content can repeatedly enter future agent contexts.

Although the section is presented as a configuration example rather than an automatic script, following it changes the persistent instruction environment. The documentation does not require informed approval, scope the configuration to this Skill, verify existing policy, or provide safe removal and rollback procedures.

### Attack Path

1. A user or agent installs or reviews the Skill and follows its configuration instructions.
2. The supplied memory policy is copied into the workspace-level `AGENTS.md`.
3. Future sessions load and obey the modified operating instructions even when the memory Skill is not the active task.
4.
...[truncated 1041 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not instruct Skills to modify workspace-wide files such as AGENTS.md by default.
  2. Keep memory behavior scoped to explicit Skill invocations and the current task.
  3. If global configuration is necessary, require explicit user approval and display the exact proposed changes before applying them.
  4. Store Skill-specific configuration in a dedicated, non-instruction-bearing configuration file.
  5. Define clear precedence rules so Skill configuration cannot override system or workspace safety policy.
  6. Add a documented uninstall and rollback procedure that removes all inserted global instructions.
  7. Disable automatic session recording unless the user has deliberately opted in.
  8. Validate and sanitize all memory content before exposing it to future agent sessions.
  9. Maintain an auditable change log for modifications to global agent policy.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs storing user preferences and other user-related information persistently in local Markdown files and a vector database, but it does not require informed user consent, retention limits, or a review/delete mechanism. Even though storage is local, this still creates a privacy risk because sensitive personal data can accumulate across sessions and later be surfaced unexpectedly through search or file access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language description and operating instructions are entirely in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a locale or language policy issue unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.