Chat Memory

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed local chat-memory tool, but it broadly copies and indexes private agent conversations without redaction, retention controls, or strong scoping.

Install only if you are comfortable turning your OpenClaw chat history and some cron prompts into long-lived searchable local memory. Avoid using it on workspaces that may contain credentials, customer data, legal/medical/HR content, or confidential business material unless you add redaction, session allowlists, retention limits, and a purge process first.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/session-to-memory.py:78

Finding

Unredacted Session Conversations Are Persisted in Auto-Indexed Memory

Content

View full analysis

2000: content = content[:2000] + "\n\n[...truncated...]" lines.append(f"**Faya:** {content}") else: lines.append(f"**{role}:** {content}") ``` ```python with open(out_path, "w") as f: f.write(result["markdown"]) ``` ### Technical Analysis The converter scans every JSONL session under the configured OpenClaw agent directory and copies qualifying conversations into persistent Markdown files. User messages are retained without a size limit or sensitive-data filtering. Assistant messages are retained up to 2,000 characters. There is no redaction for API keys, bearer tokens, passwords, private keys, personal information, client data, or other secrets that may occur in a conversation. The ge ...[truncated 1769 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/build-glossary.py:110

Finding

Attacker-Controlled Transcript Text Can Be Promoted into Persistent Agent Decisions

Content

View full analysis

30 and len(line.strip()) < 300: snippet = line.strip() # Skip code, JSON, URLs, table rows, headers with just keywords if any(skip in snippet for skip in ['{', '}', 'http', '|', '```', 'MUST read', 'pending']): continue if snippet.startswith(("**toolResult", "**Faya:**", "> -")): continue if snippet.startswith("**") or snippet.startswith("- "): snippet = snippet.lstrip("*- ").strip() if len(snippet) < 20: continue if len(snippet) > 150: snippet = snippet[:147] + "..." result["decisions"].append(snippet) break ``` ```python # === DECISIONS (last 30) === lines.append("## ⚡ Entscheidungen & Lektionen (neueste zuerst)\n") all_decisions.sort(key=lambda d: d["date"], reverse=True) for d in all_decisions[:30]: lines.append(f"- [{d['date']}] {d['text']}") ``` ```python # Build glossary glossary = buil ...[truncated 3328 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cron-optimizer.py:215

Finding

Cron Job Prompts Are Duplicated into Plaintext Workspace Reports Without Redaction

Content

View full analysis

200 else ''} ``` **Suggested memory preamble:** ``` {analysis['preamble']} ``` **Full optimized prompt:** ``` {analysis['optimized_message'][:500]}{'...' if len(analysis['optimized_message']) > 500 else ''} ``` ``` ```python # Write report os.makedirs(os.path.dirname(output_file) if os.path.dirname(output_file) else '.', exist_ok=True) with open(output_file, 'w') as f: f.write(report) ``` ### Technical Analysis The optimizer reads operational cron-job definitions from `~/.openclaw/cron/jobs.json` or another JSON file in the same directory. For jobs considered optimizable, it copies the first 200 characters of the original prompt and the first 500 characters of the enhanced prompt into a Markdown report. Cron prompts may contain credentials, authorization headers, internal paths, customer identifiers, endpoint detail ...[truncated 1814 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a working memory automation system with scripts for transcript conversion, glossary building, and cron-based indexing. The supplied code instead implements a 'cron optimizer' that inspects cron job messages and writes a recommendation report about adding memory_search and SESSION-GLOSSAR references. While it is thematically related to memory usage, its primary function is materially different from the advertised memory system components. There is no evidence here of transcript ingestion, searchable Markdown generation, glossary construction, or hands-free indexing automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The provided code accurately supports part of the description: it is a real Python script that converts session JSONL logs into searchable Markdown and writes them into a memory directory for downstream indexing, with incremental processing via a state file. However, the declared purpose describes a broader system with three layers, including an auto-updating glossary and cron-based continuous automation. None of those capabilities appear in this code chunk. Because the description presents those features as core functionality, while the supplied code only performs transcript conversion and limited indexing support, the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to scan JSONL session logs and convert them into searchable Markdown memory files, but it gives no warning about preserving secrets, personal data, internal file paths, or sensitive reasoning traces. Persisting and re-indexing transcripts expands the blast radius of any accidental disclosure and makes future retrieval of sensitive content easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The cron automation advice sets up unattended recurring processing of new sessions without warning that newly created conversations will be continuously persisted and indexed. Automated background ingestion increases the likelihood that sensitive content is stored without review and propagated into search results or downstream prompts.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is explicitly designed to build a cross-session memory layer by scanning transcripts and persisting a structured index of entities, topics, and decisions. In this context, that is materially risky because it centralizes sensitive historical user data into durable, searchable artifacts, magnifying exposure if the workspace is accessed by other agents, users, or backup/sync systems.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generated glossary is intended as a broad cross-session index of who, what, and when, which meaningfully increases discoverability of accumulated personal and organizational information. Even without raw transcripts, this kind of aggregation can reveal relationships, timelines, decisions, and project involvement that would otherwise be harder to enumerate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents scripts that read agent session logs from the home directory and write converted transcripts and indexes into the workspace, but it does not declare any tool scope or permissions boundaries. That mismatch can cause users or platforms to underestimate the skill's access needs and the privacy implications of file and environment access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill uses broad, marketing-style invocation language without clear trigger constraints, exclusions, or situations where it should not be used. In practice, that encourages indiscriminate deployment on all agent sessions, including those containing sensitive or regulated content that should not be persisted.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

This skill is fundamentally about session persistence: preserving names, decisions, file paths, and reasoning beyond compaction. That behavior is risky in security terms because it intentionally defeats natural forgetting and can accumulate sensitive historical context in a retrievable form, even if the author's goal is usability rather than abuse.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

names, decisions, file paths, reasoning. The agent retains a summary but loses the ability
to recall "What exactly did Annika say?" or "When did we decide to use v6 format?"

Most memory skills on ClawHub are just SKILL.md instructions — "write stuff to MEMORY.md."
That's not a solution. **This skill ships real scripts that do real work.**

## The Solution: Three-Layer Memory Architecture

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation promotes retaining and indexing full session transcripts, including user-provided details, across sessions. Even if intended for convenience, this creates a durable cross-session memory store that may contain credentials, personal data, confidential business information, or sensitive prompts that were never meant for long-term retention.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation broadens the skill from local memory indexing into cross-session orchestration for cron jobs, subagents, Telegram sessions, and prompt injection of shared context. Expanding data flow across execution contexts increases the chance of oversharing sensitive information and normalizes reuse of prior-session content without clear access-control guidance.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The cross-session guidance explicitly encourages sharing memory context from prior conversations with cron jobs, subagents, and group sessions. That increases the risk of unauthorized disclosure because contexts with different trust levels may receive information originating from earlier sessions without user review or need-to-know filtering.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill introduces external knowledge-base query scripts and database access patterns that are outside the stated chat-memory purpose. This encourages operators to wire additional data sources into prompts and scripts without clarifying trust boundaries, increasing the attack surface and risk of sensitive data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script reads entire session transcripts and extracts people, projects, topics, and decision snippets into persistent outputs without any consent prompt, redaction step, or sensitivity warning. Because session transcripts commonly contain secrets, personal data, and internal business context, this creates a privacy and data-retention risk rather than a memory-only transient processing flow.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

In incremental mode, the script loads and extends a persistent JSON cache of scan results, retaining transcript-derived metadata and extracted snippets beyond immediate processing. This expands the persistence surface and can keep sensitive information available even after source sessions are removed or users assume processing was ephemeral.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes both a human-readable glossary and a JSON scan cache containing transcript-derived metadata and snippets, but gives no explicit notice that potentially sensitive information is being stored long-term. This increases the chance users unknowingly persist confidential material in files that may later be backed up, synced, searched, or exposed to other tools.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/cron-optimizer.py (reported line 308)May include surrounding context.

python

Generated by OpenClaw Cron Memory Optimizer v1.0
"""

    # Write report
    os.makedirs(os.path.dirname(output_file) if os.path.dirname(output_file) else '.', exist_ok=True)
    with open(output_file, 'w') as f:
        f.write(report)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file implements broad transcript retention as a feature: it converts session logs into searchable Markdown and stores them in a memory location watched by the vector store. That behavior creates a real data exposure pathway because natural-language transcripts often contain sensitive user content, and indexing increases discoverability and reuse of those disclosures beyond the original session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script is explicitly designed to export session content into Markdown under a memory directory that is then auto-indexed, but it does so without any consent gate, sensitivity filtering, or warning about the persistence/retrieval consequences. In practice, this creates a privacy and data-governance vulnerability because users may disclose secrets, personal data, or proprietary information in sessions that become long-lived and searchable by default.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The conversion logic preserves nearly all non-system message text, including user and assistant content, with no sensitivity classification or redaction. This is dangerous because confidential prompts, pasted credentials, business data, or personal information can be silently copied into durable memory and later retrieved by search or downstream tools.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Compaction summaries condense prior session context into short, highly retrievable snippets, which can make sensitive details easier to surface than in raw transcripts. Persisting these summaries therefore increases the chance that confidential decisions, identities, or secrets remain accessible even if the original conversation is long or later truncated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The documentation claims a 'clean security score' and 'no suspicious flags, no external dependencies' while elsewhere promoting integrations, scripts, and broader auxiliary tooling. Such trust-signaling can reduce user scrutiny and is especially concerning because the content itself asks users to persist and share session data across contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated glossary content uses German headings and labels such as 'Automatisch generiert', 'Personen', 'Projekte', and 'Entscheidungen & Lektionen'. This imposes a specific locale in the skill's natural-language output without opt-in or explanation, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.