Memory Audit Guardian

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

This skill performs a disclosed OpenClaw memory audit and does not include hidden code, network access, automatic persistence, or destructive behavior.

Install only if you want an agent to review your OpenClaw memory and governance files. Before running it, assume the audit may place profile details, durable memories, persona notes, tool rules, and governance policy into the active model context; ask for redacted findings or file-size/section checks first if those files may contain secrets or highly private content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Note

• Location: SKILL.md:23
• Finding: Broad Access to Sensitive Agent State Without Explicit Data-Minimization Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 23-28 **Vulnerability Type**: `other: Sensitive Agent State Access` **Risk Level**: Low **Relevant snippet**: ```markdown 1. Read core files: SOUL.md, USER.md, MEMORY.md, TOOLS.md, AGENTS.md 2. Compute file sizes and detect threshold breaches 3. Detect duplication/conflict across files 4. Check MEMORY for noise patterns (long lists, stale one-offs) 5. Verify QMD routing fields exist and are minimal 6. Produce report with: ``` ### Technical Analysis The skill directs the agent to read five classes of internal state in their entirety: persona configuration, user-profile information, persistent memory, tool-execution rules, and agent-governance policy. This access is related to the declared memory-audit purpose, and the reviewed files contain no instruction to transmit the information externally. Nevertheless, the procedure lacks explicit least-privilege and data-minimization controls. In particular, it does not require the agent to inspect metadata before content, limit reads to relevant sections, redact secrets or personal information, avoid reproducing sensitive values in findings, or obtain separate approval for potentially sensitive file classes. Consequently, invoking the skill can place more private and operational information into the active model context than is necessary for a size and role-boundary audit. This issue does not match T01-T09 precisely. No privilege-boundary bypass, malicious execution, persistence, dependency risk, or memory-poisoning behavior was identified. ### Attack Path 1. A user invokes the memory-audit skill. 2. The procedure directs the agent to read `SOUL.md`, `USER.md`, `MEMORY.md`, `TOOLS.md`, and `AGENTS.md`. 3. Personal profile data, durable memories, operational rules, or secrets contained in those files enter the model context. 4. During duplication, conflict, or noise analysis, sensitive content may be quoted or su ...[truncated 1031 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user approval before reading files likely to contain personal data, persistent memory, or operational policy. 2. Apply staged inspection: collect file names and sizes first, then read only sections needed to verify a specific finding. 3. Define a redaction policy covering credentials, tokens, personal identifiers, private communications, and sensitive operational configuration. 4. Prohibit copying raw sensitive values into reports; report categories, counts, and locations instead. 5. Separate policy review from memory-quality review so that `TOOLS.md` and `AGENTS.md` are accessed only when role-boundary verification is explicitly requested. 6. Store generated reports only in a user-approved location and do not transmit or publish them without separate authorization. 7. Add a report-generation rule requiring a final sensitive-data scan before saving or displaying results.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill description uses broad trigger phrases such as 'audit/optimize memory quality' and 'run a periodic memory health check,' which can overlap with ordinary user requests and cause the skill to activate in situations beyond a clearly scoped security or maintenance task. Overbroad activation increases the chance of unintended access to core files and unnecessary analysis of sensitive memory/governance content.

Static analysis

No suspicious patterns detected.