Claude Memory Optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 1.3.0

Overview

This skill is for organizing OpenClaw memory, but its migration script can overwrite long-term memory files without confirmation or backups.

Review and back up your OpenClaw workspace before running this skill. Do not run the migration on valuable memory data unless you are comfortable with MEMORY.md and log or categorized memory files being overwritten; inspect the script or test it on a copy first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/refactor-memory.js:190

Finding

Unconditional Replacement of the Persistent Memory Index

Content

View full analysis

Vulnerability Details

File Location: scripts/refactor-memory.js, lines 188-191
Vulnerability Type: Destructive file overwrite
Risk Level: Medium

Vulnerable Code

js

`

await writeFile(MEMORY_INDEX, index, 'utf-8')
console.log(`✅ Updated index: ${MEMORY_INDEX}`)

Technical Analysis

MEMORY_INDEX resolves to MEMORY.md in the selected OpenClaw workspace. The writeFile operation uses its default behavior, which truncates an existing file before writing the newly generated index.

The script neither reads and merges the existing index nor checks whether it contains user-maintained information. It also does not create a backup, request confirmation, or use an atomic replacement process. Consequently, running a migration that identifies at least one eligible Markdown file causes the entire existing persistent memory index to be replaced.

This is particularly unsafe because MEMORY.md can contain long-term Agent context unrelated to the files being migrated.

Attack Path

1. An eligible Markdown file exists or is placed in the workspace's top-level memory/ directory.
2. A user or Agent invokes the migration script with write access to the workspace.
3. The script classifies at least one file, causing migrated.length to become greater than zero.
4. updateMemoryIndex() constructs a new index containing only the migration results.
5. writeFile(MEMORY_INDEX, ...) truncates and replaces the existing MEMORY.md.
6. Any unrelated long-term memory previously stored in that file is lost.

No privilege escalation occurs. The operation is limited to files writable by the account running the script.

Impact Assessment

An attacker able to influence the workspace's memory/ directory could trigger replacement when an authorized user runs the migration. The resulting impact includes:

• Loss of persistent Agent context and user-maintained memory.
• Removal of existing refere ...[truncated 323 chars]

Remediation

View remediation

Remediation Suggestions

• Read and preserve the existing MEMORY.md content before generating updates.
• Merge new entries into the existing index instead of replacing the entire file.
• Create a timestamped backup before any modification.
• Require explicit confirmation before replacing a non-empty index.
• Write the updated content to a temporary file in the same directory, flush it, and atomically rename it into place.
• Implement a functional --dry-run mode that displays all planned changes without writing files.
• Detect duplicate entries so repeated migrations remain idempotent.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/refactor-memory.js:251

Finding

Silent Overwrite of Existing Categorized Memory Files

Content

View full analysis

Vulnerability Details

File Location: scripts/refactor-memory.js, lines 120-126 and 247-252
Vulnerability Type: Predictable destination path and unchecked overwrite
Risk Level: Medium

Vulnerable Code

js

// Avoid overwriting by adding a timestamp
const timestamp = base.match(/^\d{4}-\d{2}-\d{2}/)?.[0] || new Date().toISOString().split('T')[0]
const newFilename = `${timestamp}-${base.replace(/^\d{4}-\d{2}-\d{2}[-_]?/, '')}`
const newPath = join(typeDir, newFilename)

return {
  oldPath: filepath,
  newPath,

js

for (const filepath of mdFiles) {
  try {
    const result = await refactorMemoryFile(filepath)
    if (result) {
      await writeFile(result.newPath, await readFile(filepath, 'utf-8'), 'utf-8')
      console.log(`✅ ${result.name} → memory/${result.type}/`)

Technical Analysis

The destination filename is deterministic. For files without a date prefix, it uses the current date; for files with a date prefix, it reuses that date. Contrary to the comment claiming that the timestamp avoids overwriting, repeated runs produce the same destination path.

The subsequent writeFile call does not use exclusive creation and performs no existence check. Node.js therefore truncates any existing destination file and replaces it with the source content.

This can destroy a categorized memory that was manually reviewed, corrected, or expanded after an earlier migration. The operation also copies the original source content rather than the generated newContent, so the advertised frontmatter is not written; however, that functional discrepancy is secondary to the overwrite risk.

Attack Path

1. A categorized destination such as memory/project/2026-09-16-example.md already exists.
2. A top-level source file maps to the same type, date, and normalized filename.
3. The migration script is run again.
4. It deterministically calculates the existing destination path.

...[truncated 779 chars]

Remediation

View remediation

Remediation Suggestions

• Open destination files with exclusive creation, for example writeFile(path, data, { encoding: 'utf-8', flag: 'wx' }).
• If a collision occurs, stop and report it rather than silently replacing the destination.
• Alternatively, generate a collision-resistant filename using a stable content hash or incrementing suffix.
• Back up existing destination files before explicitly approved replacement.
• Compare source and destination content and skip identical files.
• Make the migration idempotent by recording migrated sources or removing them only after verified, atomic migration.
• Write the intended newContent containing validated frontmatter rather than rereading and copying the original content.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/refactor-memory.js:205

Finding

Daily Log Is Truncated on Every Same-Day Migration Run

Content

View full analysis

Vulnerability Details

File Location: scripts/refactor-memory.js, lines 205-214
Vulnerability Type: Destructive log-file overwrite
Risk Level: Medium

Vulnerable Code

js

const logFile = join(logDir, `${day}.md`)
const logContent = `# ${day}

- [ ] TODO: Record today's events

`

await writeFile(logFile, logContent, 'utf-8')
console.log(`✅ Created log: ${logFile}`)

Technical Analysis

The daily log path is based only on the current date. Every migration run on the same day therefore targets the same file.

The script calls writeFile without checking whether the log already exists. If the daily log contains events, decisions, or other persistent records, the call truncates it and replaces it with an empty template. This contradicts the documentation's description of log mode as append-only.

Attack Path

1. The current day's log exists under memory/logs/YYYY/MM/YYYY-MM-DD.md.
2. The log contains previously recorded events or decisions.
3. The migration script is run at any later time on the same day.
4. createLogStructure() calculates the same daily log path.
5. writeFile(logFile, logContent, ...) truncates the existing log.
6. The recorded events are replaced with the default TODO template.

This occurs even if no memory files are migrated because createLogStructure() is always invoked after directory validation.

Impact Assessment

The flaw permits loss of all entries in the current day's log. This can affect:

• Auditability of Agent activities.
• Persistence of decisions and conversation records.
• Continuity between sessions.
• Reliability of append-only logging workflows.

An attacker who can induce an authorized user or Agent to rerun the migration can cause same-day log destruction. No elevated privileges or access outside the selected writable workspace are obtained.

Remediation

View remediation

Remediation Suggestions

• Check whether the daily log exists before creating it.
• Use exclusive creation with the wx flag for a new daily log.
• If the file already exists, leave it unchanged.
• Use append mode only when intentionally adding a new event; never append the initial template repeatedly.
• Create a backup before any approved replacement.
• Add automated tests verifying that running the migration twice does not change an existing daily log.
• Align the implementation with the documented append-only behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script computes frontmatter and a refactored target path, but the actual write operation copies only the original file contents to the new location. This creates a mismatch between the tool's documented behavior and its real output, causing silent data integrity failure: downstream tooling may trust migrated files to contain metadata that is actually missing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document instructs the user to run an automated refactoring script that analyzes, modifies, and moves memory files, but the execution step does not clearly foreground that it is data-mutating or require a dry run, confirmation, or rollback plan. In a skill that operates on long-lived memory/state, unclear destructive behavior can lead to accidental data loss, corruption, or unintended disclosure through reindexing and relocation of sensitive memory content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to run a migration script directly against their workspace, and elsewhere states that it migrates existing memory files, generates frontmatter, updates MEMORY.md, and creates directories. Because this operation changes user-managed files, the markdown should explicitly warn that the script rewrites memory content/structure and recommend reviewing or backing up data first.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

2. Verify Structure

bash

ls -la ~/.openclaw/workspace/memory/
cat ~/.openclaw/workspace/MEMORY.md

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

2. Verify Structure

bash

ls -la ~/.openclaw/workspace/memory/
cat ~/.openclaw/workspace/MEMORY.md

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to run an automated migration script that rewrites existing memory files but does not clearly warn that user data will be modified or require a dry-run/backup before execution. This creates a realistic risk of unintended data loss, corruption, or reclassification of persistent memory content, especially because the script targets an existing workspace automatically.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The maintenance guidance promotes ongoing logging of conversations, decisions, and learnings into persistent memory without clear sensitivity boundaries, retention limits, or exclusions for secrets and personal data. In a memory-management skill, this increases the chance that sensitive user information, confidential project details, or regulated data will be stored long-term and later surfaced inappropriately.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated MEMORY.md index points to newly created migrated paths and presents them as the canonical memory structure, but the migration does not actually perform a full, faithful refactor and leaves original files in place. This can mislead users or automation into consuming incomplete or inconsistent records, which is dangerous in a memory-management skill because it may corrupt operational context or cause incorrect agent behavior based on stale/duplicated data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill file is written entirely in Chinese, including operational instructions, with no indication that language selection is optional or tied to a region-specific requirement. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This script contains natural-language content that standardizes the generated MEMORY.md index entirely in English, including headings, type labels, and maintenance instructions, even though the surrounding skill comments and usage text are in Chinese. That creates a locale-policy concern because the skill imposes a specific output language without offering the user a choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.