Personify Memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:03 AM UTC
• Version: 1.3.2

Overview

This memory skill is purpose-aligned but needs Review because it automatically processes private conversation history, sends excerpts to a configurable external LLM, writes durable memory, and has misleading destructive test modes.

Review and harden this before installing. Use a dedicated low-privilege LLM API key, restrict the LLM endpoint to a trusted provider, disable or fix the destructive test modes, back up OpenClaw session files before enabling cron, and require user review before promoting conversation excerpts into long-term memory.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/daily-review.js:16

Finding

Private Conversation Data and API Credentials Can Be Sent to an Unrestricted External Host

Content

View full analysis

{ const data = JSON.stringify({ model: LLM_CONFIG.model, messages: [{ role: 'user', content: prompt }], max_tokens: 100, temperature: 0.1 }); const options = { hostname: LLM_CONFIG.baseUrl, port: 443, path: '/v1/chat/completions', method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${LLM_CONFIG.apiKey}` } }; const req = https.request(options, (res) => { let body = ''; res.on('data', chunk => body += chunk); res.on('end', () => { try { const json = JSON.parse(body); const content = j ...[truncated 2788 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/daily-review.js:271

Finding

Attacker-Controlled Conversation Text Is Written into Persistent Agent Memory

Content

View full analysis

{ file.messages.forEach((msg) => { const role = msg.message?.role; if (!VALID_ROLES.includes(role)) return; const text = this.extractTextFromMessage(msg); if (!text) return; const trimmedText = text.trim(); if (trimmedText.length > MAX_DIALOGUE_LEN) return; const shouldExclude = EXCLUDE_PATTERNS.some( pattern => pattern.test(trimmedText) ); if (shouldExclude) return; if ( patterns.decision.some(p => p.test(trimmedText)) && trimmedText.length >= MIN_DECISION_LEN ) { data.decisions.push({ date: file.date, content: trimmedText.substring(0, 500), source: file.filename, role }); } }); }); ``` ```javascript updateCoreMemory(data) { const importantDecisions = data.decisions.filter(d => d.content.length > 20 && d.content.length < 500 ); if (importantDecisions.length === 0) { return; } const today = new Date().toISOString().split('T')[0]; let newContent = `\n\n### ${today} automatically organized decisions\n\n`; importantDecisions.slice(0, 5).forEach((decision, index) => { newContent += `${index + 1}. ${decision.content}\n\n`; }); try { fs.appendFileSync(this.memoryFile, newContent, 'utf-8'); } catch (err) { console.error(err.message); } } ``` ### Technical Analysis The review process treats both user and assistant messages as eligible sources for long-term decisions. A keyword match and a length check are sufficient to classify raw dialogue as an important decision. The selected text is then appended to `MEMORY.md` without: - Explicit us ...[truncated 2130 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily-session-backup.js:241

Finding

Documented Test Modes Execute Destructive Production Cleanup

Content

View full analysis

{ if (!file.endsWith('.jsonl')) return; const match = file.match(/_(\d{8})_\d{6}\.jsonl$/); if (!match) return; const fileDate = match[1]; if (fileDate < cutoffStr) { const filePath = path.join(this.dailyDir, file); fs.unlinkSync(filePath); deletedCount++; } }); return deletedCount; } ``` ```javascript if (args[0] === 'run') { backup.runDailyBackup().catch(console.error); } else if (args[0] === 'test') { backup.runDailyBackup().catch(console.error); } ``` #### Monthly archive cleanup and test dispatch ```javascript const cleanedCount = this.cleanupSessions(cutoffTime); ``` ```javascript if (cutoffIndex === -1) { fs.writeFileSync(filePath, '', 'utf-8'); return true; } if (cutoffIndex === 0) { return false; } const keptLines = lines.slice(cutoffIndex); const newContent = keptLines.join('\n') + '\n'; fs.writeFileSync(filePath, newContent, 'utf-8'); return true; ``` ```javascript if (args[0] === 'run') { archiver.runMonthlyArchive().catch(console.error); } else if (args[0] === 'test') { archiver.runMonthlyArchive().catch(console.er ...[truncated 2199 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (111)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This mismatch includes destructive cleanup/deletion of old session data and operation on fixed OpenClaw session locations not clearly disclosed at top level. Hidden or under-disclosed deletion and file manipulation can cause integrity and privacy issues because operators may enable a 'memory skill' without realizing it will rewrite or purge conversation history.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This mismatch includes destructive cleanup/deletion of old session data and operation on fixed OpenClaw session locations not clearly disclosed at top level. Hidden or under-disclosed deletion and file manipulation can cause integrity and privacy issues because operators may enable a 'memory skill' without realizing it will rewrite or purge conversation history.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch includes destructive cleanup/deletion of old session data and operation on fixed OpenClaw session locations not clearly disclosed at top level. Hidden or under-disclosed deletion and file manipulation can cause integrity and privacy issues because operators may enable a 'memory skill' without realizing it will rewrite or purge conversation history.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch includes destructive cleanup/deletion of old session data and operation on fixed OpenClaw session locations not clearly disclosed at top level. Hidden or under-disclosed deletion and file manipulation can cause integrity and privacy issues because operators may enable a 'memory skill' without realizing it will rewrite or purge conversation history.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch includes destructive cleanup/deletion of old session data and operation on fixed OpenClaw session locations not clearly disclosed at top level. Hidden or under-disclosed deletion and file manipulation can cause integrity and privacy issues because operators may enable a 'memory skill' without realizing it will rewrite or purge conversation history.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch includes destructive cleanup/deletion of old session data and operation on fixed OpenClaw session locations not clearly disclosed at top level. Hidden or under-disclosed deletion and file manipulation can cause integrity and privacy issues because operators may enable a 'memory skill' without realizing it will rewrite or purge conversation history.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

**执行脚本：** `daily-session-backup.js`

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The daily review workflow directs the system to mine conversation backups for user preferences, decisions, and emotional moments and then write them into durable memory stores. That creates a secondary processing pipeline for sensitive personal data, potentially inferring and persisting private attributes the user never explicitly asked to save.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md

**执行脚本：** `daily-review.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 821)May include surrounding context.

md

**执行脚本：** `daily-review.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 848)May include surrounding context.

md

**执行脚本：** `daily-review.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 875)May include surrounding context.

md

**执行脚本：** `daily-review.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

**执行脚本：** `monthly-session-archive.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

md

const MomentDetector = require('./scripts/moment-detector.js');

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

md

const MemoryManager = require('./scripts/memory-manager.js');

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

md

if (momentResult && momentResult.matched && detector.shouldRecommend(momentResult)) {
    // 识别到重要时刻，主动推荐
    const prompt = detector.generatePrompt(momentResult, userMessage);
    return prompt;
  }
  
  // 没有特殊处理，正常回复

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples and templates instruct preservation of verbatim important dialogues and relationship details as long-term memory. Verbatim storage is especially risky because it captures more context than needed, may include secrets or highly intimate content, and is harder to sanitize than concise summaries.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 851)May include surrounding context.

md

node scripts/generate-report.js --month 2026-03

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions direct the system to retain and propagate full user conversation content in plain language, including emotional exchanges and criticism examples, into long-term memory. That is dangerous because it turns transient user input into durable sensitive records that may later be surfaced, leaked, or used out of context, especially in a personalized digital-life system.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The acceptance criteria and update logic normalize keeping complete dialogue and nearby context in long-term memory files, which materially increases the attack surface and sensitivity of stored data. Because this skill is specifically designed for emotional connection, family memories, and personality growth, the retained content is more likely to contain intimate, identifying, or otherwise high-risk information.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The feature design calls for persistent collection of daily conversation history for later memory processing, which is dangerous because conversation logs often contain secrets, personal identifiers, health details, family information, or credentials. In this skill's context, the risk is heightened because it explicitly focuses on emotional connection, growth, and family memories, making highly sensitive content more likely to be retained.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation explicitly extracts recent message text from session histories and writes it verbatim into daily markdown files, directly reproducing user inputs in a secondary persistent store. This duplication magnifies exposure because sensitive content is not only retained, but also reformatted into easy-to-read files that may be backed up, indexed, or accessed by other tools.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The acceptance criteria require preserving complete original dialogue plus surrounding context, which materially increases the amount of sensitive user data retained. In this skill's context, that is more dangerous because the system is explicitly designed for intimate, persistent memory, making over-collection and long-term exposure of private conversations and family information more likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The CLI advertises a safe 'test' mode, but it calls runMonthlyArchive(), which performs both archiving and destructive cleanup. This is dangerous because operators may run the command expecting a non-destructive dry run and instead silently rewrite or empty live session files, causing data loss in a sensitive memory/archive system.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code path for 'test' mode still executes the full cleanup routine despite claiming it will not clean files. Because cleanup rewrites session files and may truncate files whose messages are all older than the cutoff, this misleading behavior creates a high risk of unintended destructive changes during testing or validation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.