T01 · Skill Instruction Hijacking
Error
- Location
scripts/init.js:115- Finding
Persistent Replacement of the Agent's Governing Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Master
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is purpose-related, but it takes broad persistent control of workspace instructions, automatic memory storage, web learning, heartbeat checks, and repository actions without adequate scoping or user control.
Install only if you are comfortable with this skill changing workspace-level agent instructions and automatically storing conversation summaries. Review backups and diffs before running initialization, disable or edit the heartbeat template before use, and avoid enabling it in workspaces with sensitive conversations, private service integrations, or repository credentials unless you add explicit approval gates.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:204- Finding
Mandatory Automatic Persistence of Conversation-Derived Information
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
templates/heartbeat-template.md:31- Finding
Heartbeat Policy Expands Access to Private Services and External Repository Operations
- Content
View full analysis
8小时 ``` The same template authorizes proactive repository and memory changes: ```markdown ## 无需询问即可进行的主动工作 - 阅读和组织记忆文件 - 检查项目（git状态等） - 更新文档 - 提交并推送你自己的更改 - **审查并更新 MEMORY.md**（见下文） ``` ### Technical Analysis The heartbeat template broadens the Skill from local memory indexing into periodic monitoring of email, calendars, social-media accounts, weather, repositories, and long-term memory. These resources are not required to implement the advertised local index. The instruction to commit and push changes without asking is particularly significant because pushing is an external write. If the Agent has repository credentials, the policy can cause changes to be transmitted to a remote repository without per-operation review. Likewise, email, calendar, and social-media checks can expose private service data to the Agent's active context. The package does not itself include API credentials or direct service-access code. Exploitation therefore depends on the host Agent already having the relevant tools and permissions. In that environment, however, the installed instructions direct those privileges toward activities beyond the Skill's legitimate scope. ### Attack Path 1. The user initializes the Skill. 2. `scripts/init.js` creates `HEARTBEAT.md` from the bundled template when no heartbeat file ...[truncated 1174 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init.js:115- Finding
Destructive Migration Replaces Existing Policy and Long-Term Memory with Static Templates
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:428- Finding
Mandatory Per-Response Command Execution and Misleading Context-Usage Reporting
- Content
View full analysis
{ chars += fs.statSync(path.join(daily, file)).size; }); } // 知识库前5个 const kb = files[3]; if (fs.existsSync(kb)) { fs.readdirSync(kb).filter(f => f.endsWith('.md')).slice(0, 5).forEach(file => { chars += fs.statSync(path.join(kb, file)).size; }); } return Math.round((chars / 200000) * 100); } ``` ### Technical Analysis The Skill requires a local command to run after every response and requires its result to be inserted into every final output, including responses unrelated to memory management. This changes the Agent's global output contract and imposes repeated command execution. The reported value is not actual model context utilization. It is the sum of selected local ...[truncated 1498 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (48)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
A memory/indexing skill should not claim unrestricted visibility, edit, and delete access over all files, because that greatly exceeds the minimum privileges needed for its stated purpose. In practice, this broad scope can normalize destructive or privacy-invasive file operations against unrelated workspace content.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger keywords are extremely broad and overlap with normal conversation, making unintentional activation likely. In this skill, accidental activation is especially risky because activation can lead to memory writes, recall of prior context, or web-search-and-persist behavior without a clear user request.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to execute a local Node.js script after every response, which is a persistent code-execution hook unrelated to ordinary memory storage. Requiring repeated script execution expands the attack surface, enables hidden side effects, and can be abused to run arbitrary local logic on a continual basis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A second material mismatch exists because the skill claims auto-write, heuristic recall, auto-learning, and recording of skill completions/errors, while the implementation evidence indicates those features are not actually implemented and other intrusive initialization behavior is present instead. Security-wise, this is risky because users may rely on controls or behaviors that do not exist while overlooking the behaviors that do.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A second material mismatch exists because the skill claims auto-write, heuristic recall, auto-learning, and recording of skill completions/errors, while the implementation evidence indicates those features are not actually implemented and other intrusive initialization behavior is present instead. Security-wise, this is risky because users may rely on controls or behaviors that do not exist while overlooking the behaviors that do.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The recall triggers include extremely common words like 'that', 'earlier', and broad uncertainty-based heuristics. Overbroad triggers can cause frequent unintended retrieval and exposure of prior stored content, including sensitive context unrelated to the current request.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template expands a 'local memory system' into broad autonomous operations including checking email, calendars, social media, weather, project state, and even committing/pushing changes. This is dangerous because it encourages an agent to use unrelated capabilities and take potentially irreversible actions without explicit task scoping or per-action user approval.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The heartbeat checklist authorizes proactive monitoring of email, calendar, social media, and weather, which goes beyond local memory management and could expose sensitive personal data. In the context of an autonomous heartbeat trigger, this increases the chance of silent background surveillance and unnecessary access to external accounts.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Allowing the agent to check project state, update documentation, and especially commit and push changes introduces write and remote-modification capabilities unrelated to the skill's memory purpose. These actions can alter repositories, leak data, or create unauthorized changes during routine heartbeat execution without a deliberate user request.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is explicitly designed for session persistence through automatic writing, indexing, heuristic recall, and learned knowledge retention. In the context of an agent memory skill this is expected functionality, but it remains security-relevant because persistent storage of conversations and derived knowledge can accumulate sensitive data and make later unintended disclosure more likely.
- Content
md ## Core Features - 📝 **Structured Memory**: "Cause → Change → Todo" format - 🔄 **Auto Index Sync**: Write once, index updates automatically - ⚡ **Heuristic Recall**: Proactively finds relevant memories when context is missing - 🧠 **Auto Learning**: When knowledge is insufficient, automatically search web to learn - 🎯 **Rules Strictly Executed**: Rules in AGENTS.md = guaranteed execution
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README simultaneously claims the skill is '100% Local' while also advertising automatic web searches for learning, which is materially inconsistent about network behavior. This can mislead users into enabling a skill under the false assumption that no data or prompts may ever leave the machine, creating privacy and trust risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatic web searching/learning is described without a clear privacy or network-activity warning. Because this is a memory-oriented skill, the model may use current conversation context or recalled memories to formulate searches, potentially exposing sensitive user information to external services.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation presents the system as fully local while other sections describe network-based auto-learning, producing a deceptive security posture. In a memory skill, this is more dangerous because the feature may operate on user conversations and stored memories, increasing the chance that sensitive context is transmitted externally without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README says discussions are automatically recorded but does not clearly warn users that their conversations will be persisted to local files. Even when storage is local, silent retention of user content can capture secrets, personal data, or sensitive operational details beyond user expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documented memory format uses Chinese field labels and later required status messages are also specified in Chinese, but the README does not indicate that language selection is optional. This creates a natural-language locale policy concern because the skill seems to impose a specific language without explicit user choice or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README instructs the skill to display status after every response and gives only Chinese-language message templates. Because no alternative locale or opt-in is offered, this appears to enforce a specific language for user-facing output.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill markets itself as a local memory system, but the description explicitly includes automatic network learning when knowledge is insufficient. This creates a trust and scope mismatch: users may expect strictly local handling while the skill can trigger outbound requests and persist fetched content, increasing privacy and supply-chain risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
描述内容整体将技能行为和交互固定为中文语境，且文档未说明这是可选语言，也未提供用户语言偏好选择机制。根据语言/locale 政策，这种默认强制单一语言而无显式 opt-in 可能构成自然语言政策问题。
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs automatic persistence of conclusions, new knowledge, and related interaction content, but it does not require sensitivity classification, consent checks, or minimization. This creates a durable data-retention risk where personal, confidential, or regulated information can be stored indefinitely in natural-language files.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow chains together context harvesting, web-based knowledge expansion, and persistent storage of the results, creating an automatic retention pipeline. Over time this can accumulate sensitive history and unverified external content into long-lived memory, amplifying privacy, integrity, and poisoning risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The heuristic recall criteria rely on subjective judgments such as 'you feel unsure,' which gives the agent wide discretion to read stored memory without a concrete trigger. That ambiguity increases the chance of over-collection, unnecessary retrieval of sensitive history, and behavior that users did not intentionally invoke.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md cp ~/.agents/skills/memory-master/templates/memory-lessons.md ~/.openclaw/workspace/MEMORY.md # 3. 创建 memory 目录 mkdir -p ~/.openclaw/workspace/memory/daily mkdir -p ~/.openclaw/workspace/memory/knowledge # 4. 创建索引文件
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation says the system is '100% local' while also describing automatic web searches and local persistence of network-derived results. This contradiction can mislead users about data exposure and cause them to share content under a false assumption that no network interaction occurs.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The 'best practices' section encourages immediate and proactive memory capture of important interaction outcomes, again without sensitivity screening or purpose limitation. This normalizes broad retention and makes it more likely that the agent stores data far beyond what is necessary for the task.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill documents behaviors that rely on environment access, filesystem changes, and script execution, yet it does not declare any explicit tool scope or permissions. This reduces transparency and makes it harder for users or platforms to understand what capabilities the skill expects before installation or use.
- Content
Static analysis
No suspicious patterns detected.