Security audit
Security checks for vulnerabilities and agentic risk
This skill is transparent about its self-improving memory purpose, but it persistently records conversations, rewrites agent memory, edits scheduler jobs, and auto-creates new skills in ways that deserve manual review.
Install only if you intentionally want a persistent Chinese-language memory and self-improvement system that can retain conversation history, write long-term memory summaries, update OpenClaw workspace files, and create new skill drafts. Review the hook, cron jobs, ~/SharedSkills writes, and any memory containing credentials or account details before enabling it.
The documentation states that the skill can modify OpenClaw cron jobs through update-cron-date.py, which is a privileged system configuration action unrelated to basic memory recall. Persistence through scheduler changes can let the skill entrench itself, rerun automatically, or alter execution timing without clear user intent at the moment of change.
The skill semantically directs collection of every message through a hook and storage into persistent memory logs, then organizes user, project, and reference details into retrievable structures. This is high risk because it systematizes surveillance-style retention and broadens the blast radius of any later compromise, prompt leak, or unintended retrieval.
The skill is not limited to summarizing memory; it automatically generates new SKILL.md files and placeholder scripts under ~/SharedSkills/, effectively modifying the agent's future behavior surface. A self-improving component that writes deployable skill artifacts can introduce prompt injection, unsafe automation, or persistence without user review.
The memory taxonomy explicitly includes reference items such as credentials as retrievable memory content, which is a direct secret-handling anti-pattern. Persisting credentials in indexed, searchable memory makes accidental disclosure, prompt leakage, and unauthorized reuse far more likely.
The examples explicitly state that OpenClaw account/address data is copied into Hermes USER.md, confirming actual propagation of sensitive information rather than a hypothetical design. In agent-memory contexts, this is more dangerous because such files are often widely consumed by assistants and tools, making inadvertent disclosure, retention, and secondary use more likely.
The script performs autonomous skill creation by writing new directories, SKILL.md files, and executable placeholder scripts into ~/SharedSkills, which exceeds the stated dream/distillation role and creates persistent new agent capabilities without explicit consent. In an agent ecosystem, this is dangerous because generated artifacts can later be discovered, trusted, and executed, turning prior model output into durable code and prompt surface.
The skill advertises nightly review of daily conversations, extraction of insights, memory updates, and automatic learning, all of which imply persistent retention and transformation of user dialogue. This creates a strong data leakage risk because sensitive content can be copied into long-lived memory artifacts and derivative summaries that are easier to access, search, or exfiltrate later.
The trigger phrases for generated skills are intentionally broad and map to common user intents such as research, shell commands, translation, and document summarization. Broad matching increases the risk that automatically generated or unsafe skills activate in ordinary conversation without the user realizing a higher-risk automation path was selected.
Daily report generation compiles summaries, plans, reflections, and skill-development drafts from stored interactions, creating secondary artifacts that may aggregate sensitive details from many conversations. These derived reports can be more revealing than raw logs because they condense and highlight the most important information for later retrieval or sharing.
The distillation workflow instructs the agent to read multiple memory and learning files, synthesize them, and write new memory artifacts and truth files. This cross-file aggregation increases the chance that confidential information is replicated into additional locations, persisted longer than intended, and surfaced in future prompts or reports.
Using dream / 做梦 as a direct trigger is ambiguous because these terms can appear in normal conversation unrelated to memory distillation. In a skill that reads logs, writes reports, and may trigger autonomous workflows, accidental invocation materially increases privacy and integrity risk.
The skill explicitly documents runtime access to environment configuration via openclaw env get, which means it can inspect available secrets and configuration outside the narrow scope of memory distillation. Even if SWARMRECALL_API_KEY is described as optional, normalizing environment access in a self-modifying skill increases the chance of unintended secret exposure or misuse, especially when combined with reporting, logging, and cloud sync features.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
手动修复：
mkdir -p ~/.openclaw/workspace/memory/logs/2026/05
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
手动修复:
mkdir -p ~/.openclaw/workspace/memory/logs/2026/05
This file contains natural-language descriptions and runtime output strings primarily in Chinese, including the top-level description and many status messages. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified or the user is given a choice.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print("\n[All .py files syntax]")
all_ok = True
for py in sorted(skill.rglob('*.py')):
r = subprocess.run(['python', '-m', 'py_compile', str(py)],
capture_output=True, text=True, encoding='utf-8', errors='replace')
status = 'OK' if r.returncode == 0 else 'FAIL'
if status == 'FAIL':
The module name, class docstrings, and report template are written to generate reports in Chinese by default, and there is no indication that users can opt into another language. This is a natural-language policy concern because the skill effectively enforces a specific locale rather than offering a choice or documenting a region-specific justification.
This Python file contains user-facing natural-language strings and descriptions entirely in Chinese, including the module docstring and generated report headings. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in or justification.
The module docstring and user-facing text are written exclusively in Chinese, and the file contains no indication that users can choose another language or that the locale restriction is intentional for a region-specific skill. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Several result and error messages such as '缺少技能名称' and '技能名称格式不正确' are emitted directly to users in Chinese only. Because the file provides no configurable locale handling or documented regional scope, this enforces a specific language contrary to the stated policy.
The top-level docstring states the skill as '技能质量评估器' and describes its behavior entirely in Chinese, with no indication that language is configurable or user-selected. This is a natural-language locale policy issue because the skill appears to impose a specific language by default rather than offering opt-in or documenting a justified region-specific constraint.
The generated remediation messages returned to users are all hard-coded Chinese strings, so users will receive Chinese-language guidance regardless of preference. Because there is no visible locale selection, fallback behavior, or documented regional limitation, this constitutes a policy-relevant forced language choice.
This Python file contains natural-language strings and generated template content entirely in Chinese, including headings, comments, and default documentation text. Because the skill does not offer a language choice or document a justified locale restriction, it violates the language/locale policy for natural-language content.
The module header and in-code docstrings are written in Chinese, which imposes a specific language on maintainers or users reading the skill file. The file does not offer an alternative language, opt-in, or a documented region-specific justification, which matches the language/locale policy violation criteria.
The module title, comments, and docstrings are written entirely in Chinese, signaling a fixed language/locale for user- or maintainer-facing skill content. There is no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking environment.
No suspicious patterns detected.