memory-encrypted

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.1.0

Overview

The skill is for memory encryption and backups, but it makes strong security promises without implementation and describes sensitive memory handling with weak key storage and broad activation cues.

Review this carefully before installing. Do not rely on its encryption claims unless the publisher provides auditable code and clear key-management details. If used, treat the memory key as highly sensitive, avoid uploading an unprotected key to cloud storage, and make sure memory viewing, restore, automatic backup, retention, and disabling behavior require explicit user control.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19

Finding

Plaintext Decryption Key Stored at a Predictable File Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-21
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Documentation Excerpt

The following is an English translation of the complete relevant source excerpt:

markdown

- The encrypted `MEMORY.md` is unreadable and must be decrypted with the key.
- The key is stored in a separate file: `~/.openclaw/.memory-key`.
- The key itself is not encrypted; an additional backup is recommended.

Related instructions at lines 47 and 74-78 also tell the user to back up the key, including to secure cloud storage, without specifying key wrapping, access-control requirements, or secure storage mechanisms.

Technical Analysis

The documented design stores the memory-decryption key in plaintext at the predictable path ~/.openclaw/.memory-key. The Skill does not require restrictive file permissions, ownership validation, atomic file creation, an operating-system credential store, hardware-backed key protection, or encryption of exported key backups.

Encryption only protects memory while its key remains confidential. A process, malicious Skill, compromised user account, or incorrectly privileged local user that can read this file can obtain the key and decrypt both MEMORY.md and encrypted backups. Recommending a cloud backup of the unwrapped key creates an additional exposure point if that account or storage location is compromised.

Because the project contains only SKILL.md and no implementation, actual file permissions and cryptographic behavior cannot be verified. This finding concerns the explicitly documented insecure key-storage design rather than a confirmed executable implementation flaw.

Attack Path

1. The user enables memory encryption, causing the documented design to generate ~/.openclaw/.memory-key.
2. An attacker gains read access through a malicious local process, another Skill operating under the s ...[truncated 1008 chars]

Remediation

View remediation

Remediation Suggestions

1. Store the key in an operating-system credential manager, such as Keychain, Credential Manager, or Secret Service, rather than in a plaintext file.
2. Prefer hardware-backed key storage where available and prevent extraction of the raw key.
3. If file-based storage is unavoidable:
   • Create the file atomically with owner-only permissions such as 0600.
   • Ensure its parent directory is accessible only by the owner.
   • Verify ownership, permissions, file type, and absence of symbolic links before every use.
   • Reject operation if the key is readable by a group or other users.
4. Protect exported recovery keys with authenticated encryption under a separate passphrase-derived key. Use a modern password-based derivation function such as Argon2id or scrypt with a unique salt and appropriate resource parameters.
5. Do not recommend uploading an unwrapped key to cloud storage. Document an approved encrypted export and recovery process instead.
6. Use authenticated encryption, such as AES-256-GCM, to provide confidentiality and integrity for memory and backup files.
7. Add key rotation and re-encryption procedures so exposure of one key does not indefinitely compromise all future backups.
8. Document revocation, recovery, backup separation, and secure deletion requirements.
9. Add implementation and automated tests that verify permissions, ownership checks, authenticated decryption, backup handling, and failure behavior.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation cues are broad terms like '加密、备份、安全、私密等场景', which can cause the skill to trigger in many ordinary conversations about security or privacy. That increases the chance of unintended activation around sensitive topics, potentially causing inappropriate handling of user memory or disclosure of misleading security functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill makes concrete security claims such as 'AES-256' encryption and encrypted backups, but the file contains only marketing/documentation text and no implementation or verifiable mechanism. This is dangerous because users may rely on a false sense of protection and store sensitive memory data assuming it is encrypted when the skill provides no evidence that such controls exist.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The example phrase '查看记忆' is generic and likely to overlap with normal user requests, which can unintentionally invoke the skill. In a memory-handling skill, accidental activation is more sensitive because it may expose, alter, or operate on stored personal data without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.