Continuous Learning

• Outcome: Review
• Latest audit: May 28, 2026 · 2:44 PM UTC
• Version: 1.1.1

Overview

This skill is a disclosed continuous-memory system, but it can run in the background, send remembered content to external services, and rewrite files that shape future agent behavior.

Install only if you intentionally want an always-learning memory system. Before enabling it, disable notifications unless needed, avoid storing credentials in AGENTS.md or TOOLS.md, keep API keys out of shared files, review MiniMax data-sharing implications, and require backups or manual review before automatic updates to core agent documents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities that read and write local files, invoke shell commands, and communicate over the network, but it does not declare corresponding permissions or present bounded access expectations. This creates a transparency and review gap: users and platforms may enable a skill with broader effective access than is explicitly disclosed, increasing the chance of unsafe execution and abuse.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script sends MemPalace diary/memory fragments to a third-party MiniMax API for analysis. Because these entries can contain sensitive user data, project context, or credentials, this creates a real data-exfiltration/privacy risk that is broader than a purely local memory-management workflow suggests.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The scheduler can send external OpenClaw startup notifications based on local configuration, which adds outbound communication capability beyond core learning-state maintenance. In a continuous-learning skill, this increases data-flow and operational surprise risk because the component can contact external recipients automatically when started, potentially leaking status, environment details, or enabling unwanted messaging if the config is modified.

Description-Behavior Mismatch

Medium

• Confidence: 72% confidence
• Finding: The file implements a generic long-running scheduler with automatic execution of other scripts and optional messaging, which is broader than a narrowly scoped memory-management workflow. In this skill context, that broader autonomy makes the package more dangerous because it establishes persistent background execution and a framework for running additional tasks, increasing blast radius if related scripts or configuration are altered.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script invokes an external CLI to send Weixin messages, which creates an outbound communication channel not clearly aligned with the stated continuous-learning and memory-management purpose. Even though the current message body is static status text, this capability can disclose activity metadata externally and broadens the skill's privileges beyond its advertised scope.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The code manages notification delivery and fallback queueing despite the manifest describing learning and memory workflows, creating a scope mismatch between declared and actual behavior. Undisclosed side effects like messaging and persistence can surprise users and may be abused to exfiltrate status information or leave unintended artifacts on disk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README advertises automatic daily chat archiving and cross-session memory retention but does not clearly warn users that their conversations may be stored persistently and reused later. In a memory-management skill, this creates a real privacy and consent risk because sensitive user content could be collected, retained, and surfaced across sessions without explicit informed opt-in.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill describes scheduled automatic analysis and document updates at fixed times, but does not clearly disclose that user-derived data will be processed in the background without an immediate user action. This is risky because users may not realize their prior chats or memories are being reprocessed automatically, potentially including sensitive information and causing unintended external API exposure if third-party analysis is enabled.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README highlights boot-time auto-start and scheduled task installation without a strong warning that the skill may persist and run in the background after setup. Persistent background execution increases the attack surface and privacy risk because the agent can continue processing or transmitting stored conversation data without the user actively invoking it.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The advertised trigger phrases such as '持续学习', '记忆管理', and '自我改进' are broad, natural-language concepts that can appear in ordinary conversation. A skill with persistent storage and automation features may therefore activate unintentionally, causing recording, file access, or workflow changes without a deliberate user request.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The 'new task' detection criteria rely on vague heuristics like topic shifts, first-seen keywords, or phrases such as '开始做', which are common in normal conversation. In this skill, ambiguous activation is particularly risky because a false positive can trigger reading multiple sensitive documents and persisting conversation content across sessions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill prominently describes automatic conversation recording, memory extraction, and cross-session learning but does not provide a clear privacy notice, consent flow, retention policy, or deletion mechanism. Because it persists user preferences, project context, and derived summaries, users may disclose sensitive information without understanding that it will be stored and reused later.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that synchronization and dream-analysis completion generate WeChat notifications, but it does not warn that operational details or potentially sensitive status data may be transmitted to an external messaging channel. Even minimal notifications can leak timing, project activity, or memory-processing events to third-party services or unintended recipients.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code transmits memory fragments to an external API without any user-facing warning or consent flow. In a continuous-learning skill, stored diary entries are especially likely to contain sensitive personal or organizational information, making silent transmission materially dangerous.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The notification queue persists message content and recipient information to a workspace file without clear disclosure or retention controls. Writing user-facing data to disk can expose operational metadata to other local processes or users and may create an unexpected privacy footprint.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The WeChat/Weixin notification path transmits message content to an external channel without clear user disclosure or consent. External transmission of even simple status data can reveal usage patterns, timestamps, and account associations, and in a broader system this mechanism could be repurposed to send more sensitive content.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs persistent storage and later reuse of conversation summaries, preferences, project background, decisions, and lessons learned. Cross-session persistence increases the blast radius of any accidental capture, prompt-triggered overcollection, or compromise of the memory store because sensitive context is centralized and repeatedly reintroduced into future tasks.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The 'dream analysis' step reads all memory fragments and promotes extracted user background and preferences into persistent core documents, amplifying any prior overcollection or misclassification. This consolidation makes sensitive personal or project data easier to retrieve, reuse, and exfiltrate, especially when combined with scheduled automation and external model analysis.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: These instructions direct the agent to record user conversations into long-term memory, sync them on a daily schedule, and send external notifications. That creates a clear data leakage path for sensitive user content, especially if conversations contain credentials, personal data, or proprietary business information, and the wording implies broad capture rather than minimization or consent-gated retention.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The startup flow requires reading and maintaining long-term memory files such as MEMORY.md for every new task, which encourages broad reuse of previously collected user data across contexts. In practice, this increases the chance of over-retention, inappropriate cross-task data exposure, and accidental disclosure of stale or sensitive information unrelated to the current request.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The prompt explicitly instructs the model to distill diary fragments into long-term core documents such as MEMORY.md and SOUL.md. This creates a retention pipeline for user-provided information, increasing the chance that sensitive or irrelevant data persists indefinitely and is later surfaced in other contexts.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The script explicitly initializes a dated memory file for storing conversation records, and the skill description emphasizes autonomous memory management and recording dialogs. Persisting user conversations by default can capture sensitive data, secrets, or personal information without clear consent, retention limits, minimization, or access controls; in this skill context, that makes the behavior materially more dangerous rather than merely informational.

External Transmission

Medium

• Category: Data Exfiltration

Content

"analysis_model": {
    "provider": "minimax",
    "model": "MiniMax-M2.7",
    "api_url": "https://api.minimax.chat/v1",
    "api_key": "your_api_key_here"
  }
}

• Confidence: 89% confidence
• Finding: The skill is configured to send memory-analysis data to an external API endpoint, which introduces data exfiltration and third-party processing risk. In context, the danger is elevated because the workflow may upload accumulated conversation-derived memories, preferences, and project background rather than a narrowly bounded prompt.

Static analysis

No suspicious patterns detected.