T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
Unrestricted Session Collection and Persistent Personal Profiling
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw记忆管理系统v2
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is coherent and not malicious, but it asks the agent to broadly scan sessions and persist personal or sensitive context without clear user controls.
Install only if you want an agent to maintain an ongoing local memory of your work. Before use, restrict which sessions can be scanned, avoid exposing secrets or private personal data, review memory changes regularly, and add your own deletion/redaction and backup practices because the skill does not provide them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description advertises heartbeat writes, nightly reflection, CRUD updates, and active forgetting, but gives no retention warning to users about discoverability loss, archival semantics, or the possibility that information may become harder to find or effectively disappear from normal indexing. This is risky because memory systems shape future agent behavior, and silent forgetting or cold-storage policies can affect correctness, audits, and user expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction that the daily log records 'everything that happened that day' promotes indiscriminate retention. In practice, this broad scope can sweep in sensitive user inputs, secrets, confidential decisions, and irrelevant personal data, increasing leakage, over-collection, and downstream misuse risk when the archive is later searched, summarized, or surfaced to agents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs periodic writes, overwrites, cleanup, and archival of workspace files, including NOW.md refreshes, nightly reflection updates, CRUD write-backs, and weekly GC archival, but does not include any user warning, confirmation boundary, backup guidance, or dry-run mode. In a memory-management skill, automated mutation is expected, but without safeguards it can silently alter or remove user-relevant data and create integrity and retention risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to scan active sessions, extract important information, write logs, route knowledge into files, and later read broader context for reflection and CRUD updates. Those directions encourage persistence and summarization of broad session/user data into long-lived memory stores, which can capture secrets, personal data, internal reasoning artifacts, or sensitive project context beyond what is necessary.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language instructions and operational guidance are presented in Chinese, which effectively imposes a specific language on users. Under the policy, language constraints should either be optional for the user or clearly documented as a justified region- or locale-specific requirement.
- Content