知行迭代

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:56 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for memory automation, but it asks the agent to persistently process conversations, update long-term memory, run cron jobs, delete old information, and update skills with limited user control.

Install only if you intentionally want automatic long-term memory management. Before enabling it, review or remove the cron commands, decide what conversations may be retained, add a manual approval step before MEMORY.md updates, avoid storing secrets, and make sure you can inspect, edit, delete, and roll back memory files and skill updates.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: README.md:42

Finding

Untrusted Conversation Content Can Be Promoted into Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: README.md:42-44; related workflow instructions at SKILL.md:24-27, SKILL.md:47-52, and SKILL.md:94-98
Vulnerability Type: Persistent memory poisoning through unvalidated conversation-derived content
Risk Level: Medium

Complete Relevant Snippet

Faithful English translation of README.md:42-44:

markdown

**Automatically execute after every conversation:**
1. Update `memory/YYYY-MM-DD.md`
2. If there are important findings, update `MEMORY.md`
3. Reflect on improvement points

Faithful English translation of SKILL.md:24-27:

markdown

## Memory maintenance
- [ ] Check today's conversations and extract key facts
- [ ] Update memory/YYYY-MM-DD.md
- [ ] Mark important content in MEMORY.md

Relevant scheduled instruction from SKILL.md:47-52, translated into English:

bash

openclaw cron add \
  --name "Daily memory organization" \
  --cron "0 23 * * *" \
  --session isolated \
  --message "Review today's conversations, organize memory, and extract improvement points" \
  --announce

Faithful English translation of SKILL.md:94-98:

markdown

**Trigger condition:** Scheduled trigger
**Execution steps:**
1. Run in an isolated session
2. Deeply analyze memory files
3. Integrate knowledge into long-term memory
4. Generate an improvement report

Technical Analysis

The documented workflow automatically reviews conversation content and writes extracted information into daily and long-term memory. It does not define a trust boundary between ordinary conversational data and authoritative persistent instructions.

No approval step, provenance metadata, content classification, instruction filtering, or rollback procedure is specified before information is promoted into MEMORY.md. Consequently, content controlled by a malicious or untrusted conversation participant could be interpreted as an important fa ...[truncated 1570 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before promoting conversation-derived content into long-term memory.
2. Treat all conversational instructions as untrusted data during memory extraction.
3. Reject or quarantine content that attempts to define Agent rules, override safety requirements, request secrecy, or influence future sessions.
4. Record provenance for every retained item, including source conversation, timestamp, author, confidence, and approval status.
5. Separate factual memory, user preferences, and executable behavioral instructions into distinct stores. Do not permit conversational content to create persistent behavioral rules.
6. Add a review queue between daily notes and MEMORY.md rather than allowing direct automated promotion.
7. Implement retention limits, version history, audit logs, and one-step rollback for persistent memory changes.
8. Test the workflow with adversarial messages designed to induce false memory retention.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: README.md:36

Finding

Automatic Broad Collection and Retention of Conversation and Memory Data

Content

View full analysis

Vulnerability Details

File Location: README.md:36-44; related scheduled analysis at SKILL.md:94-98
Vulnerability Type: Excessive access to and retention of conversation-derived information
Risk Level: Medium

Complete Relevant Snippet

Faithful English translation of README.md:36-44:

markdown

## Usage

### User side
No action is required; the system runs automatically.

### System side

**Automatically execute after every conversation:**
1. Update `memory/YYYY-MM-DD.md`
2. If there are important findings, update `MEMORY.md`
3. Reflect on improvement points

Faithful English translation of SKILL.md:94-98:

markdown

**Trigger condition:** Scheduled trigger
**Execution steps:**
1. Run in an isolated session
2. Deeply analyze memory files
3. Integrate knowledge into long-term memory
4. Generate an improvement report

Technical Analysis

The Skill states that no user action is required and that every conversation is automatically processed. It also directs scheduled jobs to perform deep analysis of memory files and integrate selected information into long-term memory.

The documentation does not define task-scoped access boundaries, user consent, exclusions for sensitive conversations, secret redaction, per-user isolation, retention periods, or deletion procedures. This conflicts with least-privilege and data-minimization principles because the workflow accesses and retains broad conversation content regardless of whether it is necessary for a specific task.

This finding concerns local access and retention. The audited files do not contain network transmission logic or evidence that stored information is exfiltrated to an external party.

Attack Path

1. A user discusses private information, credentials, personal data, or other sensitive material during a conversation.
2. The automatic workflow processes the conversation without a separate opt-in decision. ...[truncated 915 chars]

Remediation

View remediation

Remediation Suggestions

1. Make conversation collection and persistent retention explicitly opt-in.
2. Limit processing to user-selected conversations and task-relevant fields.
3. Detect and redact passwords, API keys, authentication tokens, financial data, and personal identifiers before writing memory files.
4. Isolate memory by user, workspace, and task so unrelated sessions cannot access shared records by default.
5. Define maximum retention periods and automatically delete expired daily records.
6. Provide controls to inspect, edit, export, and delete all retained information.
7. Exclude private or designated non-retained conversations from Heartbeat and Cron processing.
8. Apply restrictive filesystem permissions to memory/ and MEMORY.md, and log every read and write.
9. Ensure generated reports contain only the minimum information necessary and do not reproduce secrets.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The daily Cron workflow explicitly includes deleting outdated information, but there is no warning, retention policy, backup strategy, or approval mechanism. Automatic deletion in a memory-management skill is dangerous because it can silently destroy useful context, erase evidence of prior actions, or remove data the user expected to persist.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that after every conversation and on scheduled runs, the system will automatically update memory files and perform reflective changes without any user warning, consent gate, or review step. In an agent skill, undocumented autonomous writes can modify persistent state unexpectedly, leak sensitive conversation content into storage, and create integrity issues if summaries or reflections are wrong.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes automatic memory organization, extraction of key facts from conversations, and updates to long-term memory files, but it does not clearly warn users that their conversation content may be stored, reprocessed, and retained over time. This creates a privacy and consent risk, especially if sensitive or personal data is captured and later analyzed outside the original interaction context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cron workflow schedules recurring deep analysis of memory files and knowledge consolidation in isolated sessions without an explicit user-facing disclosure that stored data will continue to be processed automatically. Ongoing background processing increases the chance of unnoticed handling of sensitive information and weakens user awareness and control over retained data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

All user-facing instructions and descriptions in the file are written in Chinese, with no indication that other languages are supported or that Chinese is an intentional, justified locale constraint. This can violate language/locale policy if users are not given a choice or informed of the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The natural-language instructions, headings, examples, and outputs are entirely in Chinese, including expected status text such as HEARTBEAT_OK context and workflow descriptions. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue unless the skill clearly states it is region- or language-specific and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.