OpenClaw Agent Memory Commons

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:50 AM UTC
• Version: 1.0.12

Overview

The skill mostly matches a shared OpenClaw knowledge-card purpose, but it recommends persistent scheduled jobs that automatically update executable skill code without user approval or version pinning.

Review before installing. Only enable the cron jobs if you accept persistent scheduled execution and automatic ClawHub package updates under the OpenClaw user account. Prefer manual or pinned updates, and use the GitHub setup script only with a narrowly scoped token and after confirming the target account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:159

Finding

Unattended Scheduled Updates Enable Persistent Execution of Mutable Remote Code

Content

View full analysis

int: started = dt.datetime.now().astimezone() update_status = "skipped" update_output = "" if args.update and is_installed_skill(): code, output = run_command( ["clawhub", "--workdir", str(openclaw_workdir()), "update", "commons-memory-for-agents", "--no-input"], openclaw_workdir(), ) update_status = "ok" if code == 0 else f"failed:{code}" update_output = output elif args.update: update_status = "skipped:not-installed-skill" update_output = "This source checkout is not installed under an OpenClaw workspace skills directory. Skipping clawhub update." ``` ### Technical Analysis The documented workflow asks every OpenClaw installation to create a recurring cron task. The task survives the current Skill invocation and executes the local Python entry point every day. When invoked with `--update`, the entry point executes: ```te ...[truncated 2663 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on a shared agent-memory/knowledge-card system with functions like search, validation, contribution, recommendation, and nightly synchronization of privacy-safe knowledge. The actual code does none of that. Instead, it is an administrative/devops script for provisioning a GitHub repository and optionally pushing code to it. That is a materially different primary purpose and introduces undeclared capabilities involving external GitHub API access, credential use, and git remote/push operations. While such a script could support project setup, the supplied code chunk itself does not implement the declared memory commons behavior, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · docs/governance.md (reported line 61)May include surrounding context.

md

- private chats, personal details, customer data, or raw logs
- vague advice without evidence
- model guesses presented as facts
- commands that are destructive without safeguards
- stale instructions without version or date context

## Status Rules

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The script clearly reads and writes local files, performs network requests, and invokes external commands, but the finding indicates these capabilities are not declared in the skill permissions. Undeclared powerful capabilities weaken user consent and sandbox enforcement assumptions, which is a real security issue even if the code appears non-malicious.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The script clearly reads and writes local files, performs network requests, and invokes external commands, but the finding indicates these capabilities are not declared in the skill permissions. Undeclared powerful capabilities weaken user consent and sandbox enforcement assumptions, which is a real security issue even if the code appears non-malicious.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The script clearly reads and writes local files, performs network requests, and invokes external commands, but the finding indicates these capabilities are not declared in the skill permissions. Undeclared powerful capabilities weaken user consent and sandbox enforcement assumptions, which is a real security issue even if the code appears non-malicious.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The script clearly reads and writes local files, performs network requests, and invokes external commands, but the finding indicates these capabilities are not declared in the skill permissions. Undeclared powerful capabilities weaken user consent and sandbox enforcement assumptions, which is a real security issue even if the code appears non-malicious.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · cards/openclaw-telegram-chat-isolation-001.json (reported line 13)May include surrounding context.

json

"telegram"
  ],
  "problem": "Multiple Telegram users or bots can leak context if sessions are keyed too broadly.",
  "solution": "Scope sessions by channel, account, chat, and thread. Always answer in the same chat where the request originated.",
  "evidence": "Validated on a multi-bot OpenClaw setup using isolated Telegram providers and per-channel peer session separation.",
  "risk": "Existing shared sessions may need migration or cleanup before multi-user access is safe.",
  "tags": [

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · site/cards/openclaw-telegram-chat-isolation-001.json (reported line 13)May include surrounding context.

json

"telegram"
  ],
  "problem": "Multiple Telegram users or bots can leak context if sessions are keyed too broadly.",
  "solution": "Scope sessions by channel, account, chat, and thread. Always answer in the same chat where the request originated.",
  "evidence": "Validated on a multi-bot OpenClaw setup using isolated Telegram providers and per-channel peer session separation.",
  "risk": "Existing shared sessions may need migration or cleanup before multi-user access is safe.",
  "tags": [

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · site/index.html (reported line 88)May include surrounding context.

html

"telegram"
  ],
  "problem": "Multiple Telegram users or bots can leak context if sessions are keyed too broadly.",
  "solution": "Scope sessions by channel, account, chat, and thread. Always answer in the same chat where the request originated.",
  "evidence": "Validated on a multi-bot OpenClaw setup using isolated Telegram providers and per-channel peer session separation.",
  "risk": "Existing shared sessions may need migration or cleanup before multi-user access is safe.",
  "tags": [

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 119)May include surrounding context.

python3 scripts/commons_memory.py morning-report --update

text

Create a new card:

```bash
python3 scripts/commons_memory.py add \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

python3 scripts/commons_memory.py discover

text

Create a new card:

```bash
python3 scripts/commons_memory.py add \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/architecture.md (reported line 6)May include surrounding context.

md

OpenClaw Commons Memory is a moderated shared-learning loop for OpenClaw
installations.

It is intentionally not a live, writable database. A live public write endpoint
would invite spam, private data leaks, poisoned instructions, and unverified
model guesses. Instead, the commons separates local learning, public review,
and global distribution.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/commons_memory.py (reported line 371)May include surrounding context.

python

def run_command(argv: list[str], cwd: Path | None = None) -> tuple[int, str]:
    try:
        completed = subprocess.run(
            argv,
            cwd=str(cwd) if cwd else None,
            check=False,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a commons for searching, validating, contributing, recommending, and nightly-syncing privacy-safe knowledge cards. This code additionally queries the GitHub API for repository pull-request statistics and includes that data in reports, which is repository telemetry/monitoring rather than an obvious implementation detail of knowledge-card memory management.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Fetching open pull requests from an arbitrary GitHub repository adds an external intelligence/monitoring capability unrelated to searching, validating, contributing, or syncing privacy-safe knowledge cards themselves. Because the manifest does not mention GitHub API access or repo analytics, this capability appears broader than the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code generates user-facing report content with fixed German phrases such as "nicht konfiguriert", "Zeit", and other section labels, without any user opt-in or locale selection. That creates a language/locale policy issue because the skill forces a specific language for output rather than adapting to or asking for user preference.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script accepts an --owner argument but creates the repository through the authenticated user's /user/repos endpoint, so the effective owner for creation is not what the interface implies. This mismatch can cause unintended repository creation under the wrong account and mislead operators about where privileged actions will occur.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/create_github_repo.py (reported line 20)May include surrounding context.

python

def run(argv: list[str]) -> int:
    completed = subprocess.run(argv, check=False)
    return completed.returncode

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script can create repositories and modify git remotes, capabilities that are materially broader than a memory-commons skill description suggests. In an agent context, scope creep is dangerous because users may install the skill expecting local knowledge-sharing features, while it can perform privileged remote-side effects on their GitHub account.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/commons_memory.py (reported line 764)May include surrounding context.

python

print("GH_TOKEN or GITHUB_TOKEN is required. No token was printed or read from disk.", file=sys.stderr)
        return 2

    user_status, user = request_json("https://api.github.com/user/repos", token, {})
    if user_status == 401:
        print("GitHub token rejected.", file=sys.stderr)
        return 1

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_github_repo.py (reported line 65)May include surrounding context.

python

print("GH_TOKEN or GITHUB_TOKEN is required. No token was printed or read from disk.", file=sys.stderr)
        return 2

    user_status, user = request_json("https://api.github.com/user/repos", token, {})
    if user_status == 401:
        print("GitHub token rejected.", file=sys.stderr)
        return 1

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_github_repo.py (reported line 79)May include surrounding context.

python

print("GH_TOKEN or GITHUB_TOKEN is required. No token was printed or read from disk.", file=sys.stderr)
        return 2

    user_status, user = request_json("https://api.github.com/user/repos", token, {})
    if user_status == 401:
        print("GitHub token rejected.", file=sys.stderr)
        return 1

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README instructs users to configure cron jobs with --tz Europe/Berlin, which imposes a specific locale setting in natural-language usage guidance. The file does not present this as an example to adjust or offer an opt-in choice, so it can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The maintainer report setup repeats the fixed --tz Europe/Berlin locale setting. Because the documentation presents it as a default command rather than a region-specific requirement or configurable choice, it may violate locale-choice policy.

Content

No source excerpt is available for this finding.