Save

• Outcome: Review
• Latest audit: Jul 19, 2026 · 3:17 PM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it should be reviewed because it automatically creates persistent memory and indexes workspace Markdown files, not just saved conversations.

Install only if you are comfortable with a local memory system that saves conversation summaries and indexes Markdown files in the configured OpenClaw workspace. Review the workspace path before use, avoid saving secrets or private data, and be aware that reinstall/init may overwrite the conversation log and regenerate searchable metadata on disk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tainted flow: 'WORKSPACE' from os.environ.get (line 17, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

# Fallback: try grep
            print("No FTS5 matches. Trying grep fallback...")
            import subprocess
            result = subprocess.run(
                ["grep", "-rl", "-m5", query, WORKSPACE],
                capture_output=True, text=True,
                env={"HOME": os.environ.get("HOME", os.path.expanduser("~"))}

• Confidence: 72% confidence
• Finding: WORKSPACE comes from an environment variable and is passed directly to grep as a path to recursively search. In a skill context that may process sensitive local data, an attacker who can influence the environment could cause the fallback search to read and enumerate files outside the intended workspace boundary, broadening data exposure.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while instructing the agent to use environment variables, read and write local files, and execute shell/Python commands. This under-specifies its capabilities and can mislead users or policy engines, increasing the chance that persistence and indexing actions occur without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose says the skill saves conversations, but the described behavior expands into broader workspace indexing, search, topic-map generation, and grep-based fallback over general markdown files. This mismatch matters because users may consent to saving one conversation, while the skill also enables discovery and indexing of unrelated workspace content, broadening data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The file discovery logic indexes all markdown files under the workspace plus saved conversations, which exceeds a narrow 'save conversations to memory index' purpose. In an agent skill, this capability expansion matters because it silently broadens the corpus of accessible content, increasing the chance of unintended collection and later retrieval of sensitive workspace data.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The search, tags, and topic commands add discovery and browsing features beyond the declared save/dispatch behavior. In a memory skill, these extra retrieval capabilities make the broader indexing more dangerous because they operationalize access to collected data rather than merely storing it.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: Spawning grep introduces an external file-search capability not justified by the manifest's save-to-memory scope. This becomes more concerning in an agent environment because fallback behavior can search raw workspace contents outside the structured index, increasing unintended data access and reducing auditability.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase 'save this conversation' is broad enough that normal dialogue could unintentionally invoke persistence of sensitive content. Because the action writes local files and updates a retrievable index, accidental activation creates durable data retention risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Additional examples like 'save this' remain overly generic and lack guardrails, making accidental invocation more likely during ordinary conversation. In a persistence skill, broad natural-language triggers are especially risky because the consequence is durable storage and indexing of conversation-derived content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill does not clearly warn users that '/save' persists conversation-derived content to local storage and indexes it for later retrieval. Without a prominent retention warning, users may not understand that summaries, filenames, and searchable artifacts will remain on disk beyond the session.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to persist conversation-derived data and make it searchable based on a broad 'save' trigger, which creates a real data-retention and later-disclosure risk. Even if the summary is not verbatim chat, it can still contain secrets, internal decisions, or sensitive personal data that become discoverable through the index.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# Fallback: try grep
            print("No FTS5 matches. Trying grep fallback...")
            import subprocess
            result = subprocess.run(
                ["grep", "-rl", "-m5", query, WORKSPACE],
                capture_output=True, text=True,
                env={"HOME": os.environ.get("HOME", os.path.expanduser("~"))}

• Confidence: 69% confidence
• Finding: Although this is not shell injection, passing unvalidated user input directly to grep can still alter grep's behavior if the query begins with option-like prefixes, and the fallback searches raw files outside the FTS query parser's controls. In this skill context, that can expand file enumeration and produce unintended disclosure from the workspace when the indexed search fails.

Session Persistence

Medium

• Category: Rogue Agent

Content

install:
      - id: setup
        kind: setup
        label: "Create saved conversations directory"
        run: "mkdir -p ~/.openclaw/workspace/saved"
      - id: init-log
        kind: init

• Confidence: 89% confidence
• Finding: The install/init steps create persistent storage and initialize a conversation log, establishing durable session memory on disk. Persistence itself is intentional here, but it increases sensitivity because data survives session boundaries and may be accessed or searched later without the original conversational context or consent expectations.

Session Persistence

Medium

• Category: Rogue Agent

Content

#    - Python 3.8+ (stdlib only — no pip packages needed)
#    - An OpenClaw agent with write/edit/exec/read tools

# 1. Create the saved conversations directory (inside the workspace)
mkdir -p ~/.openclaw/workspace/saved

# 2. Initialize the conversation log

• Confidence: 88% confidence
• Finding: The manual setup instructions again emphasize creating persistent local storage and a log file, reinforcing that this skill is designed for retention across sessions. In context, that is expected functionality, but it is still security-relevant because retained summaries and indexes can outlive user intent and expand the blast radius of accidental saves.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.