ClawHub
Back to skill

Security audit

Memory Plus Sync

Security checks for vulnerabilities and agentic risk

Overview

This memory-sync skill has a legitimate purpose, but it broadly handles private memories and includes unsafe install, cleanup, credential, and command execution behavior that needs review before use.

Install only after reviewing and narrowing what channels and memories it may read, store, export, and delete. Avoid running the installer with sudo, do not enable cron cleanup until backups and dry-run behavior are confirmed, keep API keys out of source files, and use local-only or redacted validation for sensitive memories.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
main.py:66
Finding

Shell Command Injection Through MCP Command Arguments

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
install.sh:52
Finding

Installer Persistently Modifies Shell Profiles and Attempts a Privileged System-Wide Symlink

Content
View full analysis
/dev/null || \ echo "⚠️ 无法创建系统级符号链接，使用本地别名" # Create local aliases echo "alias shared-memory-sync='python3 ~/.hermes/skills/openclaw-imports/memory-plus-sync/shared_memory_cli.py'" >> ~/.bashrc 2>/dev/null || true echo "alias shared-memory-sync='python3 ~/.hermes/skills/openclaw-imports/memory-plus-sync/shared_memory_cli.py'" >> ~/.zshrc 2>/dev/null || true fi ``` ### Technical Analysis Although the shortcut is described as optional, the installer attempts to create it automatically. It invokes `sudo` to place a symbolic link in `/usr/local/bin`, which crosses from user-local installation into a system-wide executable namespace. The installer also appends aliases to both `.bashrc` and `.zshrc` without: - requesting explicit consent; - detecting the active shell; - checking whether the alias already exists; - marking the managed block; - providing rollback or uninstall behavior. These profile edits survive the installation process and affect future interactive shell sessions. Repeated installation can add duplicate entries. The `/usr/local/bin` symlink also makes the command available to other accounts and binds a trusted-looking system command name to a script stored in one user’s home directory. This exceeds the minimum privileges needed for memory synchronization. The CLI can operate directly from the project directory or through a user-local executable path. ...[truncated 1336 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
setup_env.sh:18
Finding

Unpinned Runtime Dependency Installation From the Ambient Package Index

Content
View full analysis
/dev/null if [ $? -eq 0 ]; then echo "✅ $pkg 已安装" else echo "⚠️ $pkg 未安装，正在安装..." pip3 install $pkg fi done ``` Related dependency declaration: ```text watchdog>=3.0.0 ``` The installer additionally attempts to install a standard-library module: ```bash REQUIRED_PACKAGES=("sqlite3") for package in "${REQUIRED_PACKAGES[@]}"; do if python3 -c "import $package" 2>/dev/null; then echo "✓ $package 已安装" else echo "⚠️ $package 未安装，尝试安装..." pip3 install $package || echo "❌ 安装 $package 失败，请手动安装" fi done ``` ### Technical Analysis Dependencies are installed at runtime using mutable package names and the caller’s ambient pip configuration. There is no lockfile, exact version pinning, hash verification, source-index restriction, or isolated virtual environment. The `requirements.txt` constraint `watchdog>=3.0.0` permits any future version. The setup script installs several additional packages that are absent from `requirements.txt`, making the declared dependency inventory incomplete. Attempting `pip3 install sqlite3` is also unsafe and unnecessary. `sqlite3` is part of the Python standard library. If it cannot be imported, installing an unrelated package with that name from a package index is not a reliable repair and can introduce an unintended third-party component. ### Attack Path 1. A user runs `setup_env.sh` or `install.sh`. 2. One or more imports are absent from the active Python environment. 3. The script invokes `pip3 install` using an unqualified package name. 4. pip resolves the pa ...[truncated 783 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
configs/settings_loader.py:63
Finding

API Key Can Be Embedded as Plaintext in a Python Source File

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
core/triple_agent_processor.py:243
Finding

Callable Validation Processor Sends Complete Memory Content to an External Cloud Provider Without Redaction

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (157)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly promotes automatic collection and unified storage of conversations from multiple channels, but provides no meaningful privacy notice, consent flow, retention guidance, or scoping limits. In a memory-sync skill, this creates a real risk of silently aggregating sensitive personal, business, or regulated communications into a central store, increasing exposure and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The zero-config and auto-start instructions encourage immediate activation of syncing across all enabled channels without any consent checkpoint or privacy review. This is especially dangerous in an agent skill because users may enable it expecting convenience, while the skill begins broad collection of historical and ongoing conversations by default.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TEST_REPORT.md (reported line 426)May include surrounding context.

md
### 测试 2：路径遍历

**操作**: 尝试使用 `../../../etc/passwd` 作为路径

**结果**: 正常存储为路径字符串（不实际访问文件系统）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · UPGRADE_COMPLETION_REPORT.md (reported line 93)May include surrounding context.

│ └── ... ├── configs/ # 配置文件 ├── prompts/ # 提示词模板 └── .env # 环境变量配置

text

## 🔧 使用说明

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · core/llm_arbiter.py (reported line 133)May include surrounding context.

python
else:
                raise FileNotFoundError(f"Prompt 文件不存在：{prompt_file}")
        
        return prompts
    
    def _init_configs(self):
        """初始化模型配置 - 使用 Kimi API"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · core/triple_agent_processor.py (reported line 67)May include surrounding context.

python
else:
                raise FileNotFoundError(f"Prompt 文件不存在：{prompt_file}")
        
        return prompts
    
    def _init_configs(self):
        """初始化模型配置 - 使用 Kimi API"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · core/triple_agent_processor_updated.py (reported line 80)May include surrounding context.

python
else:
                raise FileNotFoundError(f"Prompt 文件不存在：{prompt_file}")
        
        return prompts
    
    def _init_configs(self):
        """初始化模型配置 - 使用 Kimi API"""

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script performs destructive deletion of stored memories automatically, without confirmation, dry-run mode, approval gating, or rollback support. In this context, a faulty heuristic, compromised local API, or malformed duplicate grouping could cause irreversible loss of user or system data at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code exports parsed memory contents and the entire user profile into a shared directory under the user's home folder without any consent, access control, minimization, or masking. Because these files appear to contain personal preferences, profile data, and potentially sensitive system memories, this creates a clear confidentiality risk through unintended cross-process or cross-tool data exposure.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The export logic intentionally packages all 'important' memories plus the full user profile into a JSON file in a shared folder, which materially broadens data exposure beyond the original Hermes storage boundary. In an agent-skill context, where memory files may contain secrets, behavioral history, or personal data, this increases the chance of unauthorized access by other tools, plugins, or local users/processes.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
92% confidence
Finding

The YARA hit is triggered by persistent modification of shell startup files via alias injection. In this context it does not look like a malware backdoor because the alias points to the advertised CLI, but the technique is still security-relevant because rc-file persistence is a common stealth mechanism and can surprise users or be repurposed if the target script changes later.

Content

Scanner excerpt · install.sh (reported line 61)May include surrounding context.

sh
ync/shared_memory_cli.py

# 创建符号链接（可选）
echo "🔗 创建命令行快捷方式..."
if [ ! -f /usr/local/bin/shared-memory-sync ]; then
    sudo ln -sf ~/.hermes/skills/openclaw-imports/memory-plus-sync/shared_memory_cli.py /usr/local/bin/shared-memory-sync 2>/dev/null || \
    echo "⚠️ 无法创建系统级符号链接，使用本地别名"
    
    # 创建本地别名
    echo "alias shared-memory-sync='python3 ~/.hermes/skills/openclaw-imports/memory-plus-sync/shared_memory_cli.py'" >> ~/.bashrc 2>/dev/null || true
    echo "alias shared-memory-sync='python3 ~/.hermes/skills/openclaw-imports/memory-plus-sync/shared_memory_cli.py'" >> ~/.zshrc 2>/dev/null || true
fi

# 创建定时任务配置
echo "⏰ 创建定时任务配置..."
CRON_CONFIG="# 共享记忆同步系统定时任务
# 每小时同步一次
0 * * * * cd ~/.hermes/skills/openclaw-imports/memory-plus-sync && python3 shared_memory_cli.py sync-bidirectional
# 每天凌晨2点清理记忆
0 2 * * * c

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The mcp command constructs a shell command with untrusted CLI arguments using os.system and string concatenation. Any attacker-controlled argument in sys.argv[2:] can inject additional shell metacharacters and execute arbitrary commands in the user's environment.

Content

Scanner excerpt · main.py (reported line 68)May include surrounding context.

python
elif command == "mcp":
        # 启动 MCP 服务器
        os.system(f"python {Path(__file__).parent}/mcp_server.py {' '.join(sys.argv[2:])}")
    
    elif command == "test":
        # 运行测试

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · main.py (reported line 74)May include surrounding context.

python
# 运行测试
        test_script = Path(__file__).parent / "test_full_workflow.py"
        if test_script.exists():
            os.system(f"python {test_script}")
        else:
            print("⚠️  测试脚本未找到")

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The database cleanup path performs a DELETE against persistent records based solely on age, with no user confirmation, preview, transaction rollback option, or safety checks around schema/record scope. In a skill context this is more dangerous because the operation can silently destroy stored memory data at scale, and a user may trigger it indirectly without realizing it includes destructive database deletion.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup_env.sh (reported line 69)May include surrounding context.

sh
# 生成环境配置文件
echo ""
echo "6. 生成环境配置文件..."
ENV_FILE="$HOME/.hermes/skills/openclaw-imports/memory-plus-sync/.env"
cat > "$ENV_FILE" << EOF
# Memory Plus Sync 2.0 环境配置
# 生成时间: $(date)

Ssd 3

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The slogan combined with zero-config automatic sync signals a default behavior of retaining all user conversations, which is an unsafe data-retention posture for a memory product. In context, this normalizes indiscriminate storage and can lead users to unknowingly persist sensitive prompts, credentials, personal data, or confidential discussions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README advertises automatic repair behavior, and elsewhere mentions maintenance actions like VACUUM optimization and FTS index rebuild, but does not warn about possible data loss, locking, downtime, or state changes. Destructive or state-altering maintenance without explicit caution is a real safety issue because operators may enable it in production without understanding the impact.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The language encourages broad automatic collection and centralization of conversations across platforms, which materially increases semantic privacy leakage risk even if no direct exfiltration is described. Aggregating messages from Feishu, WeChat, Telegram, and voice into one searchable memory store can expose sensitive context that was originally compartmentalized by channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README presents cleanup operations that delete or rewrite memory data as routine commands without placing a prominent warning directly at the point of use. In a skill that manages persistent memories and databases, users may run cleanup commands assuming they are safe maintenance steps, causing unintended irreversible loss or corruption of stored data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SHARED_MEMORY_SYSTEM_README.md (reported line 79)May include surrounding context.

md
cat ~/.shared-memory/cron_config.txt

# 添加到 crontab
crontab -e
# 添加以下内容：
# 每小时同步一次
0 * * * * cd ~/.hermes/skills/openclaw-imports/memory-plus-sync && python3 shared_memory_cli.py sync-bidirectional

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 113)May include surrounding context.

sh
cat ~/.shared-memory/cron_config.txt

# 添加到 crontab
crontab -e
# 添加以下内容：
# 每小时同步一次
0 * * * * cd ~/.hermes/skills/openclaw-imports/memory-plus-sync && python3 shared_memory_cli.py sync-bidirectional

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The cron examples automate cleanup and full-workflow jobs that alter databases and delete old files, but the README does not clearly warn that unattended scheduled execution will perform destructive changes continuously. Because this system operates on long-lived memory stores, automation materially increases the chance of silent data loss, propagation of bad state, or repeated deletion before a user notices.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SHARED_MEMORY_SYSTEM_README.md (reported line 148)May include surrounding context.

查看日志

bash
# Hermes 同步日志
ls -la ~/.shared-memory/hermes/logs/

# OpenClaw 同步日志  
ls -la ~/.shared-memory/openclaw/logs/

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SHARED_MEMORY_SYSTEM_README.md (reported line 151)May include surrounding context.

查看日志

bash
# Hermes 同步日志
ls -la ~/.shared-memory/hermes/logs/

# OpenClaw 同步日志  
ls -la ~/.shared-memory/openclaw/logs/

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SHARED_MEMORY_SYSTEM_README.md (reported line 154)May include surrounding context.

查看日志

bash
# Hermes 同步日志
ls -la ~/.shared-memory/hermes/logs/

# OpenClaw 同步日志  
ls -la ~/.shared-memory/openclaw/logs/

Static analysis

No suspicious patterns detected.