Faya Session Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:01 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed session-memory tool, but it persistently copies and indexes past agent conversations without enough scoping, redaction, retention, or review controls.

Install only if you intentionally want prior OpenClaw conversations retained as searchable local memory. Review generated memory files, exclude sensitive sessions, add redaction and retention controls before cron use, and treat glossary decisions as untrusted notes rather than operating instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/session-to-memory.py:23

Finding

Unredacted Session Content Is Persisted in Searchable Long-Term Memory

Content

View full analysis

2000: content = content[:2000] + "\n\n[...truncated...]" lines.append(f"**Faya:** {content}") else: lines.append(f"**{role}:** {content}") ``` ```python with open(out_path, "w") as f: f.write(result["markdown"]) ``` ### Technical Analysis The converter reads every qualifying JSONL session from the hardcoded OpenClaw session directory and copies message content into Markdown under `memory/sessions`. User messages are stored without redaction or a length limit. Assistant messages receive only a length limit and are not checked for secrets or personal information. The Skill documentation states that these Markdown files are automatically vectorized ...[truncated 2282 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/build-glossary.py:119

Finding

Attacker-Controlled Conversation Text Can Poison Persistent Agent Memory

Content

View full analysis

30 and len(line.strip()) < 300: snippet = line.strip() # Skip code, JSON, URLs, table rows, headers with just keywords if any(skip in snippet for skip in ['{', '}', 'http', '|', '```', 'MUST read', 'pending']): continue if snippet.startswith(("**toolResult", "**Faya:**", "> -")): continue if snippet.startswith("**") or snippet.startswith("- "): snippet = snippet.lstrip("*- ").strip() if len(snippet) < 20: continue if len(snippet) > 150: snippet = snippet[:147] + "..." result["decisions"].append(snippet) break # Deduplicate decisions (keep unique-ish ones) seen = set() unique_decisions = [] for d in result["decisions"]: key = d[:50].lower() if key not in seen: seen.add(key) unique_decisions.append(d) result["decisions"] = unique_decisions[:10] # Cap at 10 per session ``` ```python # === DECISIONS (last 30) === lines.append("## ⚡ Entscheidungen & Lektionen (neueste zuerst)\n") all_decisions.sort(key=lambda d: d["date"], reverse=True) for d in all_decisions[:30]: line ...[truncated 3162 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The supplied code substantially matches part of the description: it scans session transcripts, builds a structured glossary/index, supports incremental updates, and records people, projects, topics, decisions, and timeline information. However, the declared purpose overstates the implemented functionality. This code does not create or configure cron jobs, and it does not convert transcripts into Markdown because it expects existing session-*.md files as input. It also functions as a glossary/index generator rather than a complete persistent memory system by itself. Therefore the description is only partially accurate and should be flagged as a mismatch due to undeclared breadth versus actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is for a persistent memory subsystem: ingesting session transcripts, generating searchable memory artifacts, maintaining a glossary, and configuring cron-based indexing. The supplied code instead performs prompt analysis on existing cron jobs and generates recommendations for adding memory-search preambles. While it references the broader memory system and glossary file, it assumes those already exist and only reports optimization suggestions; it explicitly does not auto-modify jobs. This is a materially different primary purpose and omits the key declared behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does partially match the description in that it converts session logs into Markdown and places them in a memory directory intended for downstream indexing. However, several prominent declared capabilities are not present in this code chunk: it does not build any glossary/index, does not create cron jobs, and does not implement searchable memory or recall beyond producing Markdown files. Its actual scope is narrower: session transcript conversion with incremental change detection and output to a watched directory. Because the declared purpose presents a more comprehensive persistent memory system than this code actually performs, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill describes operations that read agent session logs and write persistent memory files, but it does not declare an explicit tool/permission scope. That creates an authorization ambiguity where an agent may use broader file or environment access than users expect, especially given references to home-directory paths and persistent storage. In a memory-retention skill, undeclared access is more sensitive because it touches historical transcripts and derived summaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs conversion of session logs into searchable Markdown without warning that transcripts may contain secrets, personal data, or sensitive internal discussions. Persisting and reformatting that content increases discoverability and retention, which raises the chance of unintended disclosure through search, later prompts, or filesystem access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Directing the agent to persist and index full session transcripts creates a durable store of natural-language data that may include credentials, personal information, proprietary content, or prior tool outputs. In this skill context, the feature is core to the design, which makes the risk more acute because it systematically increases long-term exposure and retrieval of sensitive history.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The glossary-building step extracts entities, projects, timelines, and decisions from prior sessions, which transforms scattered conversation history into a highly searchable intelligence layer. That aggregation materially increases sensitivity because it makes private relationships, strategic decisions, and activity history easier to retrieve and disclose than raw transcripts alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cron-job instructions normalize ongoing background processing of session data without warning users about continuous retention, repeated indexing, and autonomous updates. That can silently extend the lifetime and visibility of sensitive data beyond the original session, especially if operators assume memory is ephemeral.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill explicitly recommends recurring cron jobs to keep session-derived memory synchronized. Automated persistence makes the retention mechanism continuous rather than one-time, increasing the likelihood that sensitive conversations are stored, refreshed, and exposed without an immediate human review step.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Step 3: Set up cron jobs for auto-updates

Create two cron jobs (use a cheap model like Gemini Flash):

Job 1: Session sync + glossary rebuild (every 4-6 hours)

text

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script intentionally aggregates all session transcripts into a searchable, human-readable index of people, projects, decisions, and events. That aggregation materially increases exposure because sensitive facts that were previously scattered across many files become centralized in one easy-to-browse artifact, lowering the effort required for unauthorized discovery or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code persists derived data to disk via STATE_PATH.write_text(), and later also writes the generated glossary and scan cache. While the module docstring mentions the glossary output path, there is no warning that session content will be processed and stored into multiple persistent files, including a cache of scan results. For a script that scans transcripts, this is a user-data-affecting operation that should be clearly disclosed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The decision-extraction logic lifts natural-language snippets directly out of transcripts and persists them as curated summaries. This is dangerous because decisions often contain sensitive operational guidance, personal details, or business context, and summarization amplifies exposure by making that content easier to scan and exfiltrate than raw logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Publishing the latest decisions and lessons from all sessions into a single markdown section creates a high-value summary of sensitive history. Even if individual transcripts are access-controlled, this derived file becomes a concise intelligence source containing recent priorities, mistakes, and policy changes that could aid social engineering or competitive analysis.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The generated preamble explicitly tells downstream jobs to retrieve 'recent context', 'people, projects, and recent decisions' from persistent memory before executing unrelated tasks. In a session-memory skill, that creates a real cross-task data exposure risk because cron jobs may ingest prior-session information that is not necessary for the current task, causing over-broad disclosure or reuse of sensitive user data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The report's implementation guidance normalizes use of session transcripts and glossary data as inputs to future automated jobs, which encourages persistent reuse of historical user context. In practice, this can lead operators to wire broad memory sources into cron workflows without adequate purpose limitation, increasing the chance of unintended leakage across sessions, users, or tasks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/cron-optimizer.py (reported line 308)May include surrounding context.

python

Generated by OpenClaw Cron Memory Optimizer v1.0
"""

    # Write report
    os.makedirs(os.path.dirname(output_file) if os.path.dirname(output_file) else '.', exist_ok=True)
    with open(output_file, 'w') as f:
        f.write(report)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script intentionally copies full session content from the agent session logs into a searchable memory store, increasing the persistence, discoverability, and exposure surface of potentially sensitive user data, assistant outputs, and summaries. In the context of a long-term memory skill, this is expected behavior, but it is still dangerous because secrets, personal data, or sensitive operational details may be retained and later surfaced to other processes or users with access to the memory directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code writes converted session contents from ~/.openclaw/agents/main/sessions into searchable Markdown files under ~/.openclaw/workspace/memory/sessions, which can affect user privacy by persisting conversation data in another indexed location. Although the module docstring describes the conversion behavior, it does not warn that potentially sensitive session content will be copied into the memory store and re-indexed.

Content

No source excerpt is available for this finding.

Ssd 3

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The optimization example encourages consulting prior memory before new tasks, which can surface historical context unrelated to the current user need. While lower severity than transcript persistence itself, it still increases the chance of unnecessary disclosure by operationalizing routine lookups into stored conversation history.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.