T02 · Agent Memory Poisoning
Error
- Location
scripts/session-to-memory.py:49- Finding
Untrusted Session Content Is Persisted in Searchable Long-Term Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Session Memory
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says at a high level, but it persists broad private agent history into searchable memory with weak scoping and some inaccurate safety claims.
Review before installing. This skill is best treated as a broad local memory indexer: it can copy past OpenClaw conversations, names, decisions, file paths, and cron prompts into durable searchable files. Use it only for workspaces where that retention is acceptable, and consider adding redaction, role filtering, narrower session selection, retention limits, and a cleanup process before enabling cron-based updates.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The supplied code does perform part of the declared functionality: it builds an auto-updating glossary/index from session transcripts and supports incremental reruns that could be invoked by cron externally. However, the declared description is broader and presents a full memory-fix system with three layers, transcript-to-Markdown conversion, glossary generation, and cron-based automation. This specific code chunk only covers glossary generation from existing markdown session files. It neither converts transcripts to markdown nor implements scheduling/cron itself, and the broader 'three-layer memory system' is not represented here. Therefore the description does not accurately match this code chunk on its own.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a memory automation system centered on ingesting session transcripts, generating searchable markdown, maintaining a glossary, and running via cron. The supplied code chunk does something materially different: it inspects cron job JSON definitions and writes a report recommending prompt preambles that reference memory_search and SESSION-GLOSSAR.md. It explicitly does not modify jobs automatically, does not create or update memory files, and does not implement indexing or transcript processing. This is a clear description-behavior mismatch in primary purpose and capabilities.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents scripts that read agent session logs from the user's home directory and write derived memory files into the workspace, but it does not declare any explicit tool scope or permissions. That creates an under-specified trust boundary: users are not clearly informed that local transcript data and cron configuration will be accessed and persisted.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The core purpose of the skill is persistent storage of prior session content across compaction boundaries, including potentially sensitive names, decisions, and file paths. In context this persistence is intentional, but it still enlarges the exposure surface by retaining searchable historical data that may later be accessed by other agent workflows, subagents, or cron tasks.
- Content
md names, decisions, file paths, reasoning. The agent retains a summary but loses the ability to recall "What exactly did Sarah say?" or "When did we decide on that approach?" Most memory skills on ClawHub are just SKILL.md instructions — "write stuff to MEMORY.md." That's not a solution. **This skill ships real scripts that do real work.** ## The Solution: Three-Layer Memory Architecture
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup indexes and stores local session transcripts into workspace memory files, including sensitive content such as names, decisions, reasoning, and file paths, but the description does not provide a clear warning. This creates a real privacy and data-governance risk because users may unintentionally centralize confidential session history into searchable artifacts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill claims a 'clean security score' and 'no suspicious flags' while explicitly describing access to local session transcripts and cron job data. Security-reassurance language that downplays sensitive data handling is dangerous because it can cause users to approve installation without understanding the privacy and persistence implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This script processes full session transcripts from a workspace memory directory and derives a consolidated glossary of people, projects, and decisions without any notice, consent prompt, retention control, or redaction step. In the context of agent conversation history, that can silently persist and amplify sensitive information such as personal data, internal project names, or strategic decisions into a new index file that is easier to search and exfiltrate than the original transcripts.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The generated preamble instructs future tasks to pull broad prior-session context about people, projects, and recent decisions before executing. This creates a cross-task data propagation channel where unrelated or sensitive historical information may be surfaced to later jobs, increasing the risk of overcollection, prompt contamination, and unintended disclosure in downstream outputs.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The report explicitly encourages using session transcripts and glossary data as inputs to optimize future cron prompts. In a memory-oriented skill this is intentional, but it still increases the chance that prior user-provided content is carried into later automated tasks without strong relevance checks or sensitivity controls, which can leak private context or bias future agent behavior.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
The script persists an analysis report to disk, which is expected behavior, but in this context the persisted report contains derived summaries and copied cron prompt content from prior jobs. That creates additional retained artifacts that may outlive the original task context and be accessible to other processes or users, making session persistence a real but lower-severity issue here.
- Content
python Generated by OpenClaw Cron Memory Optimizer v1.0 """ # Write report os.makedirs(os.path.dirname(output_file) if os.path.dirname(output_file) else '.', exist_ok=True) with open(output_file, 'w') as f: f.write(report)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script writes a markdown report that includes raw cron-job prompt content, suggested optimized prompts, and inferred entities/topics to disk. Cron job messages can easily contain sensitive operational instructions, file paths, internal project names, or secrets, so copying them into a new report expands the persistence and exposure surface without any sanitization, minimization, or warning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script is explicitly designed to copy full session transcripts from the agent's session log directory into a searchable memory store, but the file contains no consent, notice, opt-in, or filtering for sensitive content before persistence. Because these transcripts can include user prompts, pasted secrets, personal data, and prior context, silently making them durable and searchable increases privacy and data-retention risk beyond normal ephemeral session expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code persists user-provided conversation content into Markdown files under the memory store for later indexing and reuse, which materially expands the exposure surface of any sensitive content present in chats. In the skill context, the whole purpose is long-term memory across sessions, so the behavior is intentional, but it is still security-relevant because it preserves and republishes untrusted conversation data into a secondary searchable repository.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file states that all three layers live under
memory/, but the documented pre-compaction workflow later instructs the agent to write tomemory/YYYY-MM-DD.mdwhile the listed layer-1 file isMEMORY.mdwithout thememory/prefix. This creates a semantic mismatch in the described storage layout and could mislead users about where the primary memory files actually reside.- Content
Static analysis
No suspicious patterns detected.