other
Warning
- Location
- SKILL.md:60
- Finding
- Automatic Collection and Persistent Duplication of Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 60–74 and 90–100 **Vulnerability Type**: Automatic collection and persistence of conversation-derived Agent data **Risk Level**: Medium ### Vulnerable Code ```text ## 工作原理 ``` 会话结束 ├── 扫描当日日记 memory/YYYY-MM-DD.md ├── 提取关键信息： │ ├── 完成的任务 │ ├── 讨论的主题 │ ├── 做的决策 │ └── 待跟进事项 ├── 生成结构化报告 └── 自动归档到 reports/YYYY-MM-DD.md ``` ## 触发方式 ### 自动触发 会话结束时自动生成日报（可配置开关）。 ``` ```text ## 保存位置 ``` ~/.openclaw/reports/ ├── 日报/ │ └── 2026-05-03.md ├── 周报/ │ └── 2026-W18.md └── 月报/ └── 2026-05.md ``` ``` ### Technical Analysis The Skill directs the Agent to scan `memory/YYYY-MM-DD.md` at the end of a session, extract tasks, discussion topics, decisions, and follow-up items, and automatically write the resulting report to persistent storage under `~/.openclaw/reports/`. This behavior is related to the Skill's stated reporting purpose and is disclosed in its documentation. However, it does not require explicit confirmation for each memory read or report write. It also does not define content filtering, secret redaction, file-access boundaries, output permissions, retention periods, or deletion controls. Consequently, sensitive information already present in Agent memory—including private discussions, credentials accidentally recorded in notes, personal information, internal decisions, or confidential tasks—may be duplicated into an additional long-lived file. This issue is not Agent Memory Poisoning because the Skill does not write attacker-controlled behavioral rules into memory. It is best classified as an unlisted Agent memory and conversation-data collection risk. ### Attack Path 1. A conversation or prior workflow places sensitive information in `memory/YYYY-MM-DD.md`. 2. At session termination, the Skill automatically scans the daily memory file. 3. The extraction process selects conversation-derived tasks, dis ...[truncated 1174 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation before reading a memory file and before saving each generated report. 2. Display the exact source file, requested date range, and destination path before processing. 3. Generate an unsaved preview so the user can review and remove sensitive content. 4. Apply secret and personal-data redaction for credentials, access tokens, private keys, financial information, and other sensitive values. 5. Limit reads to the specific user-selected memory file and reject path traversal, symbolic-link escapes, or broader directory scans. 6. Create report directories and files with restrictive permissions, such as user-only access where supported. 7. Provide configurable retention and secure deletion controls for generated reports. 8. Keep automatic session-end generation disabled by default and document the privacy implications when users enable it. 9. Avoid duplicating raw conversation content; retain only the minimum information necessary for the requested report.