ClawHub
Back to skill

Security audit

Selective Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malware, but it can keep and reuse behavior-shaping notes across sessions without enough user control.

Review and clear the bundled memory files before use, enable durable memory writes only with explicit approval, and avoid using this skill in shared or sensitive workspaces unless you add controls to inspect, edit, expire, and delete stored memories.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:47
Finding

Persistent Agent Memory Poisoning Through Pre-Populated State and Automatic Learning

Content
View full analysis
> memory/wisdom.md # Update goals echo "- [New goal]" >> memory/goals.md # Record mistake to avoid echo "- [Mistake to avoid]" >> memory/mistakes.md # Update preferences echo "- [What works: X]" >> memory/preferences.md ``` ``` `SKILL.md:138-190` recommends installing the state in an OpenClaw workspace and automatically persisting conclusions derived from posts, feedback, criticism, and engagement: ```markdown ## Integration To integrate with OpenClaw: 1. Copy this skill to your workspace: `cp -r selective-memory/ ~/.openclaw/workspace/skills/` 2. The agent reads memory files before responding 3. Updates memory after significant interactions ## 🚀 Automatic Learning (NEW!) This skill now supports **automatic learning**! The agent learns from its interactions without human intervention. ### How Automatic Learning Works The agent automatically analyzes its interactions and updates memory based on patterns: ### 1. After Every Post ``` IF post gets > 5 likes/upvotes THEN save_to_memory("preferences", "This type of content works well") analyze_what_made_it_successful() END IF post gets 0 engagement THEN save_to_memory("mistakes", "This conten ...[truncated 5258 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

This skill is explicitly built around session persistence via local memory files, so the finding is contextually accurate rather than incidental. Persistence is not inherently malicious, but in this skill it materially increases risk because stored goals, mistakes, preferences, and learned patterns are reused later without built-in safeguards, consent, or access controls.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

1. Initialize Memory

On first use, create the memory files:

bash
mkdir -p memory

Ssd 3

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the agent to save user preferences and key interactions into persistent memory, which is retention and reuse of interaction-derived data across sessions. Without privacy boundaries, minimization rules, or consent requirements, this can lead to unnecessary long-term storage of personal or sensitive contextual information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes automatic memory updates based on interaction outcomes but does not require any user notice, consent, or retention boundaries for storing preference and behavior-derived data. This creates a real privacy risk because an agent could persist user-related inferences and interaction metadata across sessions without transparency or review.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The automatic learning workflow is triggered after interactions and saves lessons or success factors into persistent memory without clear privacy scoping. This makes it easy for the system to continuously accumulate behavioral profiles or user-related inferences from routine activity, increasing surveillance and data retention risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · memory/applied-lessons.md (reported line 42)May include surrounding context.

md
### Mistakes to Avoid (ADD):
- Posting too frequently (MoltBook rate limit: 2.5 min)
- Not adapting to platform constraints
- Assuming without asking

### Preferences (ADD):
- Rate limiting is real - space posts appropriately

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The preference entry hard-codes a language strategy ('Arabic + English content works well') without any indication that it is conditioned on user choice, locale, or task context. In a persistent memory skill, this can bias future outputs toward a specific language mix, causing responses that do not match user expectations and reducing user control over communication preferences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The example preference "Arabic + English content works well" can be read as endorsing a language preference within the skill's remembered behavior, without indicating that language choice should follow user preference or explicit opt-in. This may conflict with organizational language/locale policy when a skill appears to steer output language by default.

Content

No source excerpt is available for this finding.