Agent Memory Keeper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.1

Overview

The skill is not destructive, but it directs agents to persist personal conversation memory and behavioral rules without enough user control, review, or deletion guidance.

Install only if you want an agent to maintain local long-term memory files. Review proposed memory entries before saving them, avoid storing secrets or sensitive personal data, periodically inspect and delete memory files, and treat stored rules as low-trust context rather than higher-priority instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:52

Finding

Conversation-Controlled Content Can Be Promoted into Persistent Agent Rules

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52-59
Vulnerability Type: Persistent memory poisoning through untrusted conversation content
Risk Level: Medium

Vulnerable Code

The following is an English translation of the complete relevant source segment:

markdown

## Review Checklist
1. Are there any new decisions or changes in direction? → Record them in MEMORY.md
2. Are there any new projects or terms? → Write them into the corresponding file
3. Has the user provided feedback or criticism? → Extract rules and update the rule repository
4. Is there information that can be inferred across domains? → Perform knowledge expansion
5. Are there any user preferences or habits? → Record them in USER.md

Supporting persistent-storage instructions appear in references/memory-rules.md, lines 12-17:

markdown

| Level | Storage location | Content | Update frequency |
| L1 | MEMORY.md | Long-term memory and distilled summaries | Weekly |
| L2 | memory/YYYY-MM-DD.md | Daily raw logs | Daily |
| L3 | memory/knowledge/*.md | Domain knowledge nodes | As needed |
| L4 | memory/knowledge/rules/rules.md | Behavioral rule repository | Every review |

The review template reinforces this behavior in references/review-template.md, lines 15-18:

markdown

### 3. Feedback Processing
- [ ] Was any criticism received? → Convert it into a rule
- [ ] Are there any new requirements? → Update the task list
- [ ] Was the direction adjusted? → Update the plan

Technical Analysis

The Skill directs the Agent to interpret user feedback, criticism, preferences, and habits and then persist the extracted information. In particular, it instructs the Agent to convert criticism into rules stored in memory/knowledge/rules/rules.md, which is explicitly described as a persistent behavioral rule repository updated after every review.

Conversation content is an untrusted input boundary. ...[truncated 2412 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user approval before creating or modifying persistent behavioral rules.
2. Treat all conversation-derived content as untrusted data and never as higher-priority Agent instructions.
3. Separate factual memory, preferences, task state, and executable behavioral policy into distinct stores with different trust levels.
4. Permit behavioral-rule updates only through a dedicated, authenticated workflow.
5. Record provenance for every memory entry, including the source conversation, author, timestamp, review status, and expiration date.
6. Reject memory entries that request bypassing safety controls, changing instruction precedence, exposing secrets, invoking tools without approval, or modifying security settings.
7. Present proposed memory changes as a diff and require confirmation before committing them.
8. Add retention limits, sensitive-data detection, consent controls, and deletion mechanisms for names, preferences, and other personal information.
9. Ensure stored memory is loaded only as contextual data and cannot override system, developer, security, or current-session instructions.
10. Add periodic integrity reviews and support rollback to a known-safe memory state.
11. Update the documentation to clarify that scripts/review.sh only creates a placeholder and does not securely analyze the supplied conversation log.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises an automated memory system that solves session forgetfulness by reviewing dialogue, distilling important information, storing it as long-term memory, and loading it in future conversations. The provided code does not implement those behaviors. Although it accepts a log file path argument, it never reads or analyzes that file. Instead, it only displays a checklist for human review and creates a daily markdown note template. This is materially different from the claimed automated memory functionality, so the description overstates the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a full memory persistence system: automatic conversation recap, key-information extraction, storage into long-term memory, and automatic retrieval in later sessions. The supplied code only implements a search utility over existing memory-related files. It does not parse conversations, extract facts, save memories, or integrate with future sessions for automatic loading. While searching memory is related to the broad memory theme, the actual primary behavior is much narrower and materially different from the declared end-to-end memory repair system.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill prominently advertises long-term memory of user preferences, project progress, technical decisions, and important information, but does not warn users that personal and conversational data may be persistently stored. That lack of notice undermines informed consent and can lead to unintended retention of sensitive information across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad common-language terms like '记忆', '忘了', and '你还记得', which can activate the skill during ordinary conversation without clear user intent. In the context of a persistence skill, accidental activation is risky because it may cause unsolicited retrieval or storage of conversational and personal data across sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language description, trigger phrases, examples, and operating instructions are entirely presented in Chinese, with no indication that other languages are supported or that the user can opt into this locale. For a general-purpose skill described as applicable to all OpenClaw agents, this can constitute a language/locale policy issue because it implicitly constrains use to one language without explicit choice.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs long-term storage of user preferences, project progress, technical decisions, and other important context derived from conversations. Persisting user-profile and session-derived content without strong minimization, consent, and review controls creates a clear privacy and data retention risk, especially if sensitive information is captured and later resurfaced in unrelated sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The initialization instructions tell the agent to create a memory directory and supporting files, but the skill does not clearly warn that local files may be created and modified automatically. This can surprise users, alter workspace state unexpectedly, and leave sensitive data on disk without the user's awareness.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow directs the agent to automatically review conversations and record user feedback, preferences, and inferred cross-session knowledge into memory files. Automatic extraction and persistence of behavioral and profile data is dangerous because it can capture sensitive or inaccurate information without consent, then influence future interactions in opaque ways.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented storage layout includes persistent user-profile data and daily raw logs of conversation-derived information. Keeping raw logs and user-specific records in a long-lived local knowledge base increases exposure of personal, project, and potentially secret material if the files are accessed by other tools, users, or later prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The rules explicitly direct the agent to persist user-identifying information, preferences, feedback, and other potentially sensitive details to files as a default behavior, but provide no notice, consent mechanism, retention limits, access controls, or minimization guidance. In a memory skill whose purpose is cross-session persistence, this increases the risk of privacy violations, unauthorized retention of personal data, and accidental exposure of sensitive information through local files or downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script creates and persists a dated review log intended to store conversation-derived decisions, preferences, and other potentially sensitive memory content, but it provides no consent prompt, retention notice, access controls, or minimization guidance. In the context of a memory-keeper skill, this increases privacy risk because users may not realize their chat content is being written to disk for future sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All operational guidance in the file is written in Chinese and does not indicate that other languages are supported or that Chinese is optional. Under the language/locale policy, a skill should not force a specific language without user opt-in unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that use of Chinese is optional or limited to a justified region-specific context. Under the language/locale policy rule, forcing a single language without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Comments and terminal output are presented in Chinese, including usage context and review prompts, with no indication that the skill is intended only for Chinese-speaking users. This can violate language/locale policy when a skill imposes a language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script's natural-language comments, usage text, and examples are presented only in Chinese, and the same language choice continues in user-facing output later in the file. Under the stated policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Operational messages such as search status, result headings, and not-found guidance are all hard-coded in Chinese. Because the file does not provide a language choice or explain that the skill is region- or locale-specific, this conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.