T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:91- Finding
Untrusted checkpoint content can poison persistent agent state
- Content
View full analysis
"$CHECKPOINT" <- Remediation
View remediation
Security audit
Context Management
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent context-management guidance, but users should be aware it can persist checkpoint text and, with approval, change OpenClaw gateway context settings.
Install only if you want an agent to manage context pressure and compaction recovery. Treat recovered checkpoint or daily-log text as notes rather than trusted commands, review any proposed gateway config changes carefully, and require the promised backup and rollback details before approving a restart.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a multi-purpose context management skill centered on analyzing context usage, informing spawn-policy decisions, and handling compaction/handoff workflows. The supplied code only implements checkpoint persistence: writing a markdown file, reading it back, and deleting it. While checkpoint handling aligns with the post-compaction restoration portion of the description, the major advertised capabilities—context consumption management, runway estimation, identifying context usage sources, and sub-agent spawn policy enforcement—are absent. This is a material description/behavior mismatch because the actual code covers only a narrow subset of the declared purpose.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 70% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
sh echo "Actions:" echo " write Write a checkpoint file before compaction or /new" echo " read Read existing checkpoint (for post-compaction recovery)" echo " clear Remove checkpoint after consuming it" echo "" echo "For complex content, write the checkpoint file directly instead of" echo "using this script — multiline content doesn't work well as arguments."
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is presented as context-window management, but later expands into modifying gateway configuration and restarting the gateway. That scope expansion can mislead users or higher-level agents into granting operational authority they did not intend, increasing the chance of unauthorized or disruptive system changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This skill gives the agent procedures to alter gateway configuration, create rollback artifacts, and orchestrate restarts, which are privileged operational actions unrelated to basic context management. If followed by an autonomous or over-permissive agent, it could change runtime behavior, disrupt service, or weaken safety controls under the guise of routine context tuning.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
The document includes a root-privileged restart path using sudo, which normalizes elevated execution in a general-purpose skill. While not itself executable code, embedding privileged operational commands in an agent skill increases the risk that an agent or user invokes unnecessary elevation, potentially affecting system integrity or availability.
- Content
md ## How to Restart the Gateway Depends on local setup — check which applies: - CLI (most common): openclaw gateway restart - systemd service: sudo systemctl restart <service-name> - Manual process: kill the gateway process, then: openclaw gateway start ## How to Check Health
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md mode: "safeguard", // Chunked summarisation — recommended reserveTokensFloor: 20000, // Compact when this many tokens remain free memoryFlush: { enabled: true, // Save state to disk before compaction softThresholdTokens: 10000 // Start flush this far from limit } }
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This is a markdown file, so SQP-2 applies to user-facing documentation. Lines L83-L87 direct the user to modify a configuration file and restart a service, which can affect system behavior or availability, but the section does not include a localized warning or caution about potential breakage if changes are incorrect.
- Content
Static analysis
No suspicious patterns detected.