Savemaintenance

• Outcome: Pass
• Latest audit: Jul 19, 2026 · 3:08 PM UTC
• Version: 1.0.0

Overview

This is a local OpenClaw memory-maintenance tool whose file changes, backups, and index rebuilds are mostly disclosed and purpose-aligned, though users should note implementation bugs and local data duplication.

Install only if you want a local tool that can rewrite OpenClaw saved-conversation metadata, rebuild the memory index, and create extra local copies of memory data. Run dry-run first, review backups/snapshots as sensitive files, and be aware the current full-reconcile.py has a runtime bug that prevents the main pipeline from working until fixed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return
    
    log("Running memory audit...")
    result = subprocess.run(
        ["python3", str(AUDIT_SCRIPT)],
        capture_output=True, text=True, timeout=30
    )

• Confidence: 92% confidence
• Finding: The script executes an external Python file referenced by AUDIT_SCRIPT via subprocess, which extends trust beyond this file into another script whose contents and integrity are not validated. In this skill, that is especially risky because the maintenance tool is presented as deterministic/safe, yet it can run arbitrary code from the workspace path during an audit operation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

log("Rebuilding FTS5 index + stub-index.md...")
    
    if not dry_run:
        result = subprocess.run(
            ["python3", str(INDEX_SCRIPT), "build"],
            cwd=str(WORKSPACE),
            capture_output=True, text=True, timeout=60

• Confidence: 91% confidence
• Finding: The rebuild step launches an external script (memory-index.py) using subprocess, meaning the behavior depends on code outside this file that could be replaced or modified in the saved workspace. Although arguments are passed as a list and shell injection is avoided, this still creates an arbitrary-code-execution trust boundary if an attacker can alter that script.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly includes shell execution plus filesystem reads and writes across the user's persistent workspace and shared-memory database. That mismatch is dangerous because it hides the true privilege level from users and policy controls, making a maintenance tool capable of modifying or deleting conversation metadata without explicit authorization boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The skill description frames the behavior as deterministic reconciliation, but the file also advertises broader actions such as automatic snapshots, backup creation, snapshot listing, and invoking additional audit functionality. This is a security-relevant transparency failure because users may approve a narrowly described repair tool without realizing it persists extra copies of memory data and performs additional shell-driven maintenance steps.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This maintenance skill executes multiple external Python scripts as part of normal operation, so its effective behavior is not limited to the code under review. In a persistence/maintenance context touching saved conversations and indexes, that increases the chance of hidden side effects, arbitrary code execution, or tampering if those external scripts are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill advertises deterministic reconciliation, but key behavior depends on separately stored scripts, so the actual outcome can vary based on external code state rather than only on the inputs described here. That mismatch is dangerous because users may grant elevated trust to a tool that appears self-contained and predictable when it is not.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly describes behavior that removes log entries, adds inferred entries, rebuilds an index, and updates counts, but it does not prominently warn that running the tool will modify and potentially delete metadata from the memory system. In a maintenance skill that performs destructive reconciliation in one shot, insufficient disclosure increases the risk of accidental data loss or unexpected state changes by a user or calling agent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The audit step runs even when dry_run is requested, violating the user's expectation that dry-run mode should avoid side effects. Because the audit is implemented as an external subprocess, it may perform writes, network access, or other actions despite the safety signal implied by dry-run.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script silently duplicates conversation logs, topic indexes, and an FTS database into snapshot directories, all of which may contain sensitive user data. In a memory-maintenance skill context, creating additional persistent copies increases exposure surface, retention time, and the chance of unintended disclosure if backups are browsed, synced, or left with weak permissions.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.