Security audit

Openclaw Token Memory Optimizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent token-optimization guide, but its optional transcript-indexing advice can make all historical OpenClaw sessions searchable without enough privacy scoping or warnings.

Review this before installing if your OpenClaw transcripts may contain secrets, personal data, proprietary code, or sensitive tool output. Avoid the wildcard transcript path unless you have reviewed and sanitized the files; prefer a small allowlist, local-only embeddings, retention limits, and rebuilding or deleting indexes when source data should no longer be searchable.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:127
Finding: Broad Wildcard Indexing of Sensitive Session Transcripts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
2. Check that the embedding model is downloaded 3. Ensure memory files exist and have content ### "Restart didn't clear context" The restart clears the session history, but: - System prompt is always loaded

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README promotes indexing old session transcripts and memory files for search without warning that those artifacts may contain secrets, personal data, credentials, or other sensitive operational context. In a memory-optimization skill, this omission is more dangerous because the feature encourages persistent aggregation and retrieval of historical data, increasing the chance of unintentional exposure or over-retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill recommends indexing ~/.openclaw/sessions/*.jsonl into searchable memory without warning that transcripts may contain sensitive prompts, secrets, personal data, or prior tool outputs. Making historical sessions broadly searchable increases the chance of unintended retrieval and disclosure of sensitive information to future agent runs or users.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The example message "Do the thing. Use message tool if human needs to know." is highly generic and overlaps with common everyday language. In a markdown skill description, this kind of unspecific invocation wording can contribute to ambiguous activation or unclear trigger scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.