Echo

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:15 PM UTC
• Version: 1.0.0

Overview

The skill clearly describes syncing agent memory to Supabase, but it does not define enough safeguards or scope for sensitive memory upload and local restore behavior.

Review this skill carefully before installing. Use `--dry-run` first, confirm exactly which memory files would be uploaded or restored, verify the Supabase destination and credentials, and avoid syncing memories that may contain secrets, personal data, project details, or credentials until the skill documents and enforces clear boundaries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:3

Finding

Unbounded Agent Memory Synchronization to External Cloud Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3–8
Vulnerability Type: Unrestricted transfer of local agent-memory data to external storage
Risk Level: High

Relevant Snippet:

markdown

Sync OpenClaw markdown memory files to Supabase with Luhmann encoding. Parse, encode, embed, and upsert agent memories from local workspace to cloud storage.

## Commands

```bash
echo-memory sync          # Parse + encode + embed + upsert to Supabase

Technical Analysis

The documented echo-memory sync workflow reads agent-memory Markdown files from the local workspace and transfers their contents to Supabase. This crosses a local-to-cloud trust boundary and may expose sensitive persistent context.

The skill documentation does not specify a restrictive file allowlist, secret filtering, destination verification, user confirmation, tenant identity, retention policy, or encryption requirements. It also does not include an implementation that would allow these controls to be verified. Consequently, invoking the synchronization command may transfer credentials, personal information, conversation history, internal project details, or other sensitive material contained in memory files to an unspecified Supabase destination.

The cloud-transfer behavior is explicitly documented, but its implementation and actual authorization controls could not be validated because the audited package contains only SKILL.md.

Attack Path

1. Sensitive information is stored in local OpenClaw Markdown memory files.
2. A user or agent invokes echo-memory sync.
3. The command parses and encodes the local memory files.
4. The resulting memory content or embeddings are uploaded and upserted to a Supabase destination.
5. If that destination is unauthorized, misconfigured, shared, or attacker-controlled, the uploaded information becomes accessible outside the intended local trust boundary.

Impact Assessment

Succes ...[truncated 563 chars]

Remediation

View remediation

Remediation Suggestions

1. Define an explicit allowlist of directories and files eligible for synchronization; deny all other paths by default.
2. Exclude credentials, environment files, private keys, tokens, authentication records, and other known secret formats.
3. Apply secret and sensitive-data scanning before encoding or uploading content, and abort synchronization when protected material is detected.
4. Display the exact source files, destination Supabase project, account or tenant, table, and expected data changes before transmission.
5. Require explicit informed confirmation for cloud uploads, with --dry-run as the recommended default workflow.
6. Authenticate the destination securely and enforce least-privilege credentials restricted to the required database objects and operations.
7. Encrypt data in transit and at rest, and document retention, deletion, access-control, and tenant-isolation policies.
8. Provide the executable implementation, dependency manifest, and configuration schema so that file selection, authentication, filtering, and upload behavior can be independently audited.
9. Add audit logging that records which files were synchronized and where they were sent without recording their sensitive contents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises sync and restore operations against Supabase cloud storage but does not warn that these actions transmit memory contents off-host and may overwrite or recreate local files. Users may run the commands without understanding the confidentiality and integrity implications, which can lead to unintended disclosure of sensitive memory data or accidental local file modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.