T09 · Insecure Skill Coding Practices
Warning
- Location
src/core/lifecycle-monitor.js:129- Finding
Unredacted Lifecycle Payloads Are Persisted in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawMem
Security checks for vulnerabilities and agentic risk
Overview
ClawMem is a memory tool, but it can automatically retain full agent tool and memory event data without clear privacy controls.
Review this skill carefully before installing. Use it only if you intentionally want local long-term memory of agent sessions, tool calls, and memory writes. Treat the SQLite database as sensitive, avoid sending secrets through monitored events, and add or require redaction, retention/deletion controls, encryption or strict file permissions, and explicit opt-in before enabling lifecycle monitoring.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/core/retrieval.js:120- Finding
Caller-Controlled Limits Bypass the Configured Retrieval Maximum
- Content
View full analysis
0) { results = this.searchByTags(tags, { limit }); } else if (timeRange) { results = this.searchByTimeRange(timeRange, { session_id, event_type, limit }); } else { const stmt = db.prepare(` SELECT * FROM l0_index ORDER BY timestamp DESC LIMIT ? `); results = stmt.all(limit); } ``` ### Technical Analysis The configured `maxRetrieveLimit` is assigned to `this.maxResults`, but it is only used as a default value. A caller-provided `limit` replaces that default without any type, sign, integer, or upper-bound validation. SQLite interprets `LIMIT -1` as no limit. Therefore, a caller can supply `limit: -1` to request all matching rows. ...[truncated 1870 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (35)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly advertises 'silent' lifecycle monitoring and background processing of agent activity, but it does not disclose what user/session data is collected, how long it is stored, or what consent controls exist. In a memory-management skill for an AI agent, this can lead to covert collection of prompts, tool inputs, and memory content that may contain secrets or personal data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed intercepted events include session lifecycle, tool calls, and memory reads/writes, all of which can contain highly sensitive data such as prompts, credentials in tool arguments, internal memory contents, or user identifiers. Documenting interception without warning about sensitive-content capture normalizes unsafe deployment and increases the risk of unintentional surveillance or secret retention.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Copy
.env.exampleto.env:bash cp .env.example .envEdit configuration as needed:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Copy
.env.exampleto.env:bash cp .env.example .envEdit configuration as needed:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code does not implement the declared memory management behavior itself. It does not perform memory storage, retrieval, lifecycle monitoring, advanced search, or token-cost optimization logic. Instead, it only loads configuration from a local .env file, applies defaults, and exposes the resulting settings. While the configuration keys reference concepts like retrieval tiers and lifecycle events, this chunk’s actual behavior is limited to configuration management. That is a materially different primary purpose from the declared skill description, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 86% confidence
- Finding
The code substantially matches the core claim of a lightweight 3-tier memory storage/retrieval system with L0/L1/L2 layers and token-cost estimation. However, parts of the declared description overstate the implemented functionality. There is no visible automatic lifecycle monitoring (such as expiration, cleanup, state transitions, retention policies, or hooks). Search is basic rather than advanced: L0 supports simple category and timestamp filtering plus limit, while L1/L2 are direct lookups by record ID only. The 60–80% savings claim appears as a hardcoded estimate in stats and is not demonstrated by actual optimization logic or benchmarking in this code. Because these are material descriptive claims rather than minor implementation details, this is a description-behavior mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
2. Configure Environment
bash cp .env.example .env # Edit .env with your configuration
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
2. Configure Environment
bash cp .env.example .env # Edit .env with your configuration
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
2. Configure Environment
bash cp .env.example .env # Edit .env with your configuration
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
2. Configure Environment
bash cp .env.example .env # Edit .env with your configuration
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } // 加载配置 const envConfig = parseEnvFile(join(__dirname, '..', '.env')); // 默认配置 const defaultConfig = {
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code automatically persists full event payloads to L2 using
JSON.stringify(payload, null, 2)formemory.writeandtool.call, which can include session identifiers, tool arguments, memory content, and other sensitive data. In a memory-management skill, this is especially dangerous because it creates silent long-term retention of potentially confidential prompts, outputs, and operational data without visible user consent, minimization, or redaction.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README promotes automatic interception of session, tool, and memory events, which can capture prompts, tool arguments, outputs, and other potentially sensitive user data. In a memory-management skill, this is especially risky because the feature is central to the product, yet the documentation shown does not warn about consent, retention, redaction, or privacy boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples encourage storing full details and performing searches over persisted memory contents, which may include sensitive prompts, API outputs, personal data, or secrets. Because this is framed as normal usage without a warning, users may unintentionally persist confidential data and later expose it through retrieval or search flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes lifecycle monitoring that intercepts OpenClaw events and stores session/tool data, but it does not prominently warn users that potentially sensitive prompts, tool arguments, or session content may be persisted. In a memory-management skill, this omission is security-relevant because users may unknowingly store secrets or private operational data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All headings, descriptions, and usage guidance in this file are presented in Chinese, which effectively forces a specific language for users of the skill documentation. There is no indication that this is an optional locale, nor any justification that the skill is intended only for a Chinese-language audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file documents
searchBySession(..., { includeDetails: true })and shows retrieval of complete session data and L2 details, which could expose sensitive conversation contents. The guide does not include any warning about privacy, access control, or careful handling of returned session data.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The comments describe the component as 'imperceptible' and 'fully automatic' monitoring of key lifecycle events, indicating a design oriented toward undisclosed observation rather than transparent telemetry. In this skill context, which already centralizes memory and retrieval, hidden monitoring increases the risk of collecting behavioral and content data beyond user expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language design intent emphasizes stealthy automatic interception and retention of event data, and the implementation supports that by queueing intercepted events and later storing summaries and full payload content. Even without overt exfiltration, covert capture of session and tool/memory content is a security and privacy concern because it expands the sensitive-data footprint and can expose secrets if the local database is accessed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Comments, log strings, and returned user-facing messages in this file are written in Chinese, indicating a fixed language experience. The file does not offer opt-in language selection or document that the skill is intentionally region- or locale-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The L2 storage path persists
record.full_contentand associated metadata to the database, which can include detailed user data. Although the code logs that storage occurred, there is no warning, confirmation, or comment/docstring disclosing the privacy-sensitive nature of storing complete content.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The search methods write user-controlled search terms directly to logs, and this memory system is specifically designed to store and retrieve conversational history and related metadata. In this context, keywords can include sensitive personal data, secrets, or internal identifiers, so logging them creates an unnecessary secondary exposure path through log files and observability systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
advancedSearchlogs the entire query object, which may include keywords, tags, session identifiers, time ranges, categories, and other sensitive retrieval parameters. Because this component operates on a memory store for agent conversations, full-query logging can expose highly sensitive user activity and correlation data to anyone with log access.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language header, startup logs, and demo messaging are presented only in Chinese, which imposes a specific language on users without any visible opt-in or documented locale limitation. This matches the policy-violation category for language/locale constraints because the skill does not indicate that users may choose another language or that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This README is written in Chinese and serves as a user-facing skill document. Although it links to English docs, the file itself does not state a language choice or opt-in, so it may impose a locale on readers of this variant.
- Content