Lingxi-MindVault - Auto Memory Extraction for OpenClaw

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:48 AM UTC
• Version: 1.1.15

Overview

This is a disclosed memory-export automation skill, but it needs Review because it continuously reads private OpenClaw sessions and lets the main agent write extracted content to Feishu without tight controls.

Install only if you intentionally want all unprocessed OpenClaw conversations analyzed and summarized into your own Feishu resources. Before enabling cron, verify the Feishu IDs, run under an unprivileged account, avoid sensitive sessions, and consider adding explicit review, redaction, fixed session scoping, safer temp files, and a non-executing `.env` parser.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/do_extract_and_write.sh:203

Finding

Tool-Enabled Main Agent Processes Untrusted Conversation Content

Content

View full analysis

&1 > "$AI_OUTPUT_FILE" & ``` ### Technical Analysis The script directs the OpenClaw main agent to analyze a conversation file and then invoke Feishu document, table, and messaging tools. Conversation files contain untrusted user-controlled text, but the implementation does not establish a reliable separation between data from the conversation and instructions the agent should follow. There is no deterministic parser, tool allowlist enforced by the script, output schema validator, human approval step, or dedicated least-privileged extraction agent. Consequently, instructions embedded in a stored conversation can influence the agent while it has access to write-capable tools. The use of `--agent main` increases the exposure because the main agent may possess more tools and permissions than are necessary for memory extraction. The exact impact depends on the tools and OAuth permissions configured in the OpenClaw environment. ### Att ...[truncated 1364 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/do_extract_and_write.sh:242

Finding

Predictable Temporary Files Permit Symlink-Race File Overwrites

Content

View full analysis

"$PROMPT_FILE" ``` The output file is subsequently opened through shell redirection: ```bash openclaw agent --agent main --session-id "extract_${SESSION_ID}" --message "$(cat "$PROMPT_FILE")" --local 2>&1 > "$AI_OUTPUT_FILE" & ``` ### Technical Analysis The temporary filenames are generated from a session identifier and the shell PID. These values are predictable or observable. The files are placed directly in the shared `/tmp` directory. The script first removes a candidate path and later recreates it through shell redirection. This creates a time-of-check/time-of-use window. A local attacker can create a symbolic link at either temporary path after `rm -f` but before the corresponding redirection. Shell redirection follows symbolic links and truncates the linked destination with the privileges of the account running the script. The documented installation paths use `/root/.openclaw`, and the documented cron configuration is consistent with root execution. If deployed in that form, a successful race could overwrite a root-writable file. ### Attack Path 1. A local attacker determines or predicts the session identifier and PID used by a scheduled extraction process. 2. The attacker monitors `/tmp` or repeatedly attempts to create the expected temporary path. 3. After the script removes the path, the attacker creates a symbolic link such as `/tmp/ai_prompt_ID_PID.txt` or `/tmp/ai_ext ...[truncated 1006 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/session_check.sh:161

Finding

Unescaped Session IDs Corrupt Processing State Through Regular-Expression Injection

Content

View full analysis

/dev/null; then log "跳过重复会话（同一session_id多个文件）: $session_id -> $session_file" continue fi ``` ```bash if echo "$ACTIVE_SESSIONS" | grep -q "^${session_id}$" 2>/dev/null; then log "跳过活跃会话: $session_id" continue fi ``` ```bash if grep -q "^agent:main:session:${session_id}$" "$PROCESSING_FILE" 2>/dev/null; then # 检查处理是否超时（超过30分钟认为是死锁，清理掉） # 读取行最后记录的时间戳，格式: agent:main:session:xxx timestamp # 如果文件中没有时间戳，默认600秒（10分钟）超时 local processing_age=600 if [ -n "$(grep "^agent:main:session:${session_id} [0-9]\+$" "$PROCESSING_FILE" 2>/dev/null)" ]; then local timestamp=$(grep "^agent:main:session:${session_id} [0-9]\+$" "$PROCESSING_FILE" | awk '{print $2}') local now=$(date +%s) processing_age=$((now - timestamp)) fi if [ "$processing_age" -lt 1800 ]; then # 30分钟超时 log "跳过正在处理中的会话: $session_id (已处理 ${processing_age} 秒)" continue else log "警告: 会话处理超时（${processing_age} 秒），清理标记后重试" sed -i "/^agent:main:session:${session_id}/d" "$PROCESSING_FILE" 2>/dev/null fi fi ``` ```bash sed -i "/^agent:main:session:${session_id}/d" "$PROCESSING_FILE" 2>/dev/null ``` ### Technical Analysis The session ID is extracted from a filename and interpolated directly into `grep` and `sed` regular expressions. No strict validation or regular-expression escaping is applied. Characters such as `.`, `*`, `[`, `]`, `^`, `$`, and backslash retain their regular-expression meaning. A crafted session filename can therefore cause checks to match a different session or cause `sed` to delete multiple processing-state entries. This is not shell command inject ...[truncated 1653 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

port FEISHU_USER_OPEN_ID="ou_xxxxxxxx"

飞书多维表格（L2-任务待办）

export L2_APP_TOKEN="xxxxxxxxxxxx" export L2_TABLE_ID="tblxxxxxxxxxxxx"

飞书云文档

export L3_DOC_ID="xxxxxxxxxxxx" export L4_DOC_ID="xxxxxxxxxxxx"

OpenClaw 目录（可选）

export OPENCLAW_DIR="$HOME/.openclaw"

text

加载环境变量：

```bash
source .env

4. 启动监听

bash

# 添加到 crontab
*/5 * * * * cd /path/to/lingxi-memory && source .env && bash scripts/session_watch.sh

详细安装说明见 SKILL.md

目录结构

text

lingxi-memory/
├── SKILL.md                    # Skill 定义
├── README.md                   # 项目说明（含数据安全说明）
├── LICENSE                     # MIT 协议
├── .gitignore                  # 忽略 .env 等敏感文件
└── scripts/                    # 核心脚本
    ├── session_watch.sh        # 会话监听
    ├── do_extract.sh           # AI 提炼
    └─�

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This second mismatch finding highlights that the skill's declared purpose omits active notification, maintenance of processing state, heartbeat/active-session logic, and asynchronous invocation of an external extraction script. For a skill processing private conversations, incomplete disclosure materially increases privacy and governance risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This second mismatch finding highlights that the skill's declared purpose omits active notification, maintenance of processing state, heartbeat/active-session logic, and asynchronous invocation of an external extraction script. For a skill processing private conversations, incomplete disclosure materially increases privacy and governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation warns not to use the author's sample IDs, yet later states defaults may be used if variables are unset and that those defaults point to the author's memory space. For a skill that exports analyzed chat data externally, this creates a concrete risk of exfiltrating a user's private session content into someone else's Feishu resources through misconfiguration.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 122)May include surrounding context.

md

SCRIPT_DIR="$WORKSPACE/scripts"
EXTRACTED_FILE="$WORKSPACE/memory/.extracted_sessions"
# 所有飞书资源ID从环境变量读取，必须配置
# 在 .env 文件中设置以下环境变量：
# - FEISHU_USER_OPEN_ID: 你的飞书 open_id
# - L2_APP_TOKEN: L2 任务看板 多维表格 app_token
# - L2_TABLE_ID: L2 任务看板 多维表格 table_id

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 129)May include surrounding context.

md

SCRIPT_DIR="$WORKSPACE/scripts"
EXTRACTED_FILE="$WORKSPACE/memory/.extracted_sessions"
# 所有飞书资源ID从环境变量读取，必须配置
# 在 .env 文件中设置以下环境变量：
# - FEISHU_USER_OPEN_ID: 你的飞书 open_id
# - L2_APP_TOKEN: L2 任务看板 多维表格 app_token
# - L2_TABLE_ID: L2 任务看板 多维表格 table_id

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

md

SCRIPT_DIR="$WORKSPACE/scripts"
EXTRACTED_FILE="$WORKSPACE/memory/.extracted_sessions"
# 所有飞书资源ID从环境变量读取，必须配置
# 在 .env 文件中设置以下环境变量：
# - FEISHU_USER_OPEN_ID: 你的飞书 open_id
# - L2_APP_TOKEN: L2 任务看板 多维表格 app_token
# - L2_TABLE_ID: L2 任务看板 多维表格 table_id

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/do_extract_and_write.sh (reported line 18)May include surrounding context.

sh

SCRIPT_DIR="$WORKSPACE/scripts"
EXTRACTED_FILE="$WORKSPACE/memory/.extracted_sessions"
# 所有飞书资源ID从环境变量读取，必须配置
# 在 .env 文件中设置以下环境变量：
# - FEISHU_USER_OPEN_ID: 你的飞书 open_id
# - L2_APP_TOKEN: L2 任务看板 多维表格 app_token
# - L2_TABLE_ID: L2 任务看板 多维表格 table_id

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This prompt creates a natural-language data exfiltration channel: the agent is asked to read a full conversation file, extract salient content, write it into external Feishu memory stores, and notify a user. In the skill context, session files may contain credentials, internal plans, PII, or other sensitive data, so delegating unrestricted analysis and outbound publication to an LLM-backed agent is especially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt explicitly instructs the agent to directly write extracted content into Feishu tables and documents. Because the source is an arbitrary conversation file, prompt-influenced content can cause unauthorized disclosure, persistent poisoning of knowledge bases, or insertion of misleading records into external systems.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The script sources /root/.openclaw/workspace/.env directly into the shell, which executes any shell syntax contained in that file rather than merely parsing key/value pairs. If an attacker can modify the .env file or influence its contents, they can achieve arbitrary command execution with the privileges of this script, which appears to run from a privileged root-owned workspace.

Content

Scanner excerpt · scripts/session_check.sh (reported line 14)May include surrounding context.

sh

# 加载环境变量
WORKSPACE="/root/.openclaw/workspace"
if [ -f "$WORKSPACE/.env" ]; then
    source "$WORKSPACE/.env"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This finding is part of the same dangerous pattern: conditional loading of .env via source causes the shell to execute file contents in-process. In the context of an automation skill that handles sessions, notifications, and downstream extraction scripts, compromise of .env could let an attacker hijack targets, exfiltrate secrets, or run arbitrary commands persistently.

Content

Scanner excerpt · scripts/session_check.sh (reported line 15)May include surrounding context.

sh

# 加载环境变量
WORKSPACE="/root/.openclaw/workspace"
if [ -f "$WORKSPACE/.env" ]; then
    source "$WORKSPACE/.env"
fi

# 配置

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents shell-based behavior (cron, bash scripts, file scanning, local state tracking) but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens platform-level least-privilege controls and makes it harder for users or enforcement layers to understand that the skill needs filesystem and shell execution capabilities before installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill name and description are written entirely in Chinese and repeatedly describe operation, warnings, and setup only in Chinese. For a general-purpose skill, this imposes a language constraint without explicit user opt-in or an alternative locale, which matches the policy concern for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Automatic periodic scanning of local session files containing chat records creates continuous access to sensitive personal or organizational data. In context this is intentional, but the automation and breadth of collection increase the blast radius of mistakes, over-collection, and unintended external disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation is internally contradictory: one section says missing environment variables cause immediate failure, while another says defaults will be used. In this skill, that ambiguity is dangerous because users may believe execution will fail safely, but could instead write extracted memories into unintended Feishu resources or another person's workspace.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The installation instructions establish persistent scheduled execution via crontab, causing ongoing background access to session files and repeated external writes/notifications. Persistence is not inherently malicious here, but it materially increases risk because the skill will continue operating on new conversations without per-run user review.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

touch /root/.openclaw/workspace/memory/.extracted_sessions

# 4. 配置 crontab
# 编辑 crontab: crontab -e
# 添加以下内容：
# 白天（8:00-22:00）每 1 分钟运行一次
# */1 8-22 * * * /root/.openclaw/workspace/scripts/session_check.sh >> /tmp/session_check.log 2>&1

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly collects complete local chat histories, sends them to an AI for processing, and stores extracted content in an external knowledge base. This is the intended function, but it is still a real privacy and data-handling risk because highly sensitive conversations may be transferred and retained beyond the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script loads Feishu identifiers from environment variables and then uses external commands (openclaw agent and openclaw message send) to process and transmit conversation-derived content. Even if the tokens are not printed directly, this creates a clear exfiltration path for sensitive session data to third-party systems without any interactive confirmation, content minimization, or allowlisting of what may be sent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The natural-language instructions require the agent to use Asia/Shanghai time and explicitly forbid UTC, imposing a specific locale/timezone policy. There is no indication that the user can choose a locale or that the constraint is justified as a region-specific tool requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This shell script uses Chinese for operational comments and for user-visible outputs such as logs and notifications, with no indication that the skill is region-specific or that users can choose their preferred language. That creates a natural-language locale policy issue because the skill imposes a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The message sent through send_notification is hardcoded in Chinese and appears intended for end users. Because the file does not offer a language choice or justify a China-specific deployment context, this is a natural-language policy violation under the locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is entirely in Chinese and presents the skill's behavior only in that locale, with no indication that users can choose another language or that the skill is intended exclusively for a Chinese-language or region-specific environment. This can violate language/locale policy when a skill implicitly constrains usage to a single language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script writes session markers to "$EXTRACTED_FILE" to record processing state, which is a file modification. While the behavior is functional, there is no explicit user-facing warning or confirmation at the point of write, and the operation is not clearly disclosed beyond internal comments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.