Reclaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:40 PM UTC
• Version: 2026.3.11-3

Overview

This memory skill is coherent, but it automatically persists and indexes user-specific conversation context without clear per-item user control.

Install only if you want Reclaw to retain user-specific facts, decisions, tasks, session summaries, and searchable subject files across sessions. Review its memory storage and deletion controls in the underlying Reclaw plugin before using it with sensitive personal, business, or client information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill’s activation criteria are broad enough to trigger on common requests about memory, prior context, or what the agent knows. That increases the chance the skill is invoked in ordinary conversations where users may not expect memory-related tooling or persistence behavior, which can lead to unintended handling of sensitive personal context.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Reclaw Memory System

Reclaw is an append-only event log that replaces daily memory files. It assumes the current OpenClaw environment already has the Reclaw plugin installed. All memory lives in `log.jsonl` as structured entries. Extraction happens automatically at session end — you don't write to the log directly. Your job is to state information clearly in conversation so the extraction hook captures it.

## How Memory Works

• Confidence: 96% confidence
• Finding: The skill instructs the agent to phrase information so an extraction hook captures it automatically, creating session persistence without a direct, user-visible save action. This is dangerous because it operationalizes passive collection of conversational content into long-lived memory artifacts, including session summaries and searchable subject projections, which can expose sensitive personal data across future sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states that information from conversation is automatically extracted and persisted at session end, but it does not require any explicit user notice or consent at the point of collection. In a memory skill handling user-specific facts, decisions, tasks, and transcripts, silent persistence materially raises privacy risk because users may disclose sensitive information without realizing it will be stored and reused later.

Static analysis

No suspicious patterns detected.