Memory Maintenance

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:18 AM UTC
• Version: 1.0.0

Overview

This memory-maintenance skill is purpose-aligned, but it needs Review because it can send local agent memory to Gemini, install scheduled cleanup, source .env files, and move or delete memory files with incomplete controls.

Install only if you are comfortable with local agent memory being analyzed by Gemini and with scheduled maintenance changing files. Before enabling automation, inspect the scripts, use dry-run/review modes, avoid placing unrelated secrets in the workspace .env, and confirm there is a recoverable trash or backup path for any cleanup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and orchestrates shell-capable behavior, including installation scripts and operational commands, but does not declare corresponding permissions. That creates a transparency and consent gap: users may install or run a skill without understanding that it can execute system-level actions such as file manipulation, scheduling, or invoking external binaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose understates the actual behavior: beyond reviewing memory notes, the skill appears to install itself, register scheduled tasks, read additional files like USER.md, transmit local memory content to the Gemini CLI for analysis, and perform destructive file operations including deletion. This mismatch is dangerous because it obscures sensitive-data exposure and system/file modification risks, preventing meaningful user consent and making unsafe behavior more likely to be triggered automatically.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The script advertises and later contains logic for an `--all` mode, but the argument parser never recognizes `--all` because the branch is missing and the `MODE="all"` assignment is unreachable under the `--safe` case. This creates a dangerous mismatch between operator expectations and actual behavior: users may believe they are invoking a reviewed, confirmed full-apply path when the script instead errors or behaves inconsistently, undermining safeguards and operational reliability in a tool that moves files.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: In all mode, the script warns that it will modify `MEMORY.md`, requests confirmation, and then does not actually apply content suggestions; it only prints manual follow-up instructions. This discrepancy is dangerous because users may approve a high-impact operation based on false assumptions about what was executed, reducing auditability and increasing the chance of incomplete or mistaken memory maintenance in an agent-management workflow.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script performs irreversible deletion with `rm` inside `.consolidated`, which is more destructive than the trash/archive behavior used elsewhere in the script. In a memory-maintenance skill that auto-cleans files on a schedule, hard deletion increases the chance of unintended data loss if the target path or file selection is wrong.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script unnecessarily sources the workspace .env file and exports its contents into the process environment before invoking external tooling. Because the script later sends workspace-derived content to the Gemini CLI, any prompt injection, subprocess behavior, logging, or downstream tool access could expose secrets that were not needed for the review task.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Safe mode automatically moves files marked as `archive` from a review JSON without any per-action confirmation, dry-run diff, or path validation beyond a simple existence check. In the context of a memory-maintenance skill that auto-cleans agent state, this is more dangerous because review data may be wrong or manipulated, and even "recoverable" moves can disrupt workflows, hide files, or archive unintended paths.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script uses destructive deletion without any confirmation, opt-in flag, or clear warning to the operator. Because this skill is designed for unattended cleanup of agent memory, silent `rm` operations can cause unnoticed loss of potentially important memory fragments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer makes persistent changes to the user's environment by creating directories, copying executable scripts, writing configuration files, and registering a cron job without any explicit confirmation or dry-run step. In an agent-skill ecosystem where skills are third-party and potentially adversarial, silent installation of scheduled tasks increases the risk of unexpected persistence and unattended execution.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script aggregates daily notes, MEMORY.md, USER.md, and directory metadata, then transmits that content to an external Gemini CLI service without explicit consent, redaction, or data classification controls. In a memory-management skill, these files are especially likely to contain sensitive personal, operational, or business context, making exfiltration risk significant.

Credential Access

High

• Category: Privilege Escalation

Content

# Check Gemini auth
if [ -z "$GEMINI_API_KEY" ]; then
    if [ -f "$WORKSPACE/.env" ]; then
        set -a
        source "$WORKSPACE/.env"
        set +a

• Confidence: 89% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

if [ -z "$GEMINI_API_KEY" ]; then
    if [ -f "$WORKSPACE/.env" ]; then
        set -a
        source "$WORKSPACE/.env"
        set +a
    fi
fi

• Confidence: 89% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

set -e

# Load environment
if [ -f "/Users/maxhutchinson/.openclaw/workspace/.env" ]; then
    set -a
    source /Users/maxhutchinson/.openclaw/workspace/.env
    set +a

• Confidence: 99% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

# Load environment
if [ -f "/Users/maxhutchinson/.openclaw/workspace/.env" ]; then
    set -a
    source /Users/maxhutchinson/.openclaw/workspace/.env
    set +a
fi

• Confidence: 99% confidence
• Finding: .env

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.