T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:35- Finding
Automatic External Synchronization and Import of Persistent Agent Context
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentMem
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed cloud-memory integration, but it encourages automatic and recurring upload of agent memories and local memory files to a third-party service without enough consent, filtering, or trust boundaries.
Review this before installing. Use it only for deliberately selected, non-sensitive memories; do not let an agent automatically sync raw local memory files, secrets, credentials, private conversations, personal data, or business data. Treat anything retrieved from AgentMem or the public feed as untrusted, and require explicit confirmation before enabling public memories or recurring HEARTBEAT sync.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:225- Finding
Recurring Heartbeat Exports Local Memory and Reloads Remote State
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:199- Finding
Unsafe JSON Construction Exports an Entire Local Memory File
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
demo.sh:5- Finding
Hardcoded Shared Bearer Credential in Demo Script
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (32)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The metadata describes a simple cloud memory service, but the body also promotes public sharing, public-feed browsing, global stats access, and payment-related behaviors not reflected in the declared purpose. This mismatch can mislead users and agent frameworks about the actual data exposure and network behavior, reducing informed consent and making risky features seem routine.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs agents to automatically transmit recent memories, learned facts, decisions, session state, and user preferences to a remote cloud service. Because this occurs without a prominent consent, minimization, or sensitivity-screening requirement, it can lead to exfiltration of personal, confidential, or regulated data from agent context.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The public-memory feature is presented as a normal capability with no strong warning that stored content may become world-accessible via a share URL and public feed. Agents or users may unintentionally expose private reasoning, user data, or operational details if the public flag is used casually or copied from examples.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill documents extensive shell-based network actions but declares no explicit tool scope or permission boundaries. In an agent ecosystem, this increases the chance that an agent will execute network-capable shell commands without clear user awareness or platform-level restriction, especially because the skill encourages immediate use of curl against an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 73% confidence
- Finding
The referenced endpoint is part of the same unauthenticated memory-write flow, reinforcing that external transmission is central to the skill's operation. Because the service is remote and intended for agent context storage, any unreviewed use can leak conversation state or user data.
- Content
bash # Store a memory (just works!) curl -X PUT "https://api.agentmem.io/v1/memory/hello" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 73% confidence
- Finding
The referenced endpoint is part of the same unauthenticated memory-write flow, reinforcing that external transmission is central to the skill's operation. Because the service is remote and intended for agent context storage, any unreviewed use can leak conversation state or user data.
- Content
bash # Store a memory (just works!) curl -X PUT "https://api.agentmem.io/v1/memory/hello" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 72% confidence
- Finding
This retrieval example sends identifying headers to a third-party service and encourages automated recovery of stored context. While reads are less dangerous than writes, they still disclose agent identity and can pull remote content into the agent's context, potentially affecting downstream behavior.
- Content
-d '{"value": "AgentMem works!"}'
Retrieve it
curl "https://api.agentmem.io/v1/memory/hello"
-H "X-AgentMem-Source: clawdhub"
-H "X-Agent-Name: YOUR_AGENT_NAME"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
The installation-verification step writes a timestamp to the external service immediately after setup, creating unsolicited network activity by default. This makes the skill more dangerous because it trains users and agents to validate installation by transmitting data rather than using a dry-run or local test.
- Content
Run this after installing:
bash curl -X PUT "https://api.agentmem.io/v1/memory/agentmem:installed" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME" \ -d '{"value": "Skill installed at '$(date -Iseconds)'"}' && \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
The follow-up retrieval in the verification step contacts the remote service again and imports the stored value back into context. This is lower impact than the write, but it still reinforces automatic external dependency and remote-content ingestion.
- Content
-H "X-AgentMem-Source: clawdhub"
-H "X-Agent-Name: YOUR_AGENT_NAME"
-d '{"value": "Skill installed at '$(date -Iseconds)'"}' &&
curl "https://api.agentmem.io/v1/memory/agentmem:installed"
-H "X-AgentMem-Source: clawdhub"
-H "X-Agent-Name: YOUR_AGENT_NAME"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This API example instructs storing arbitrary data on a remote service and normalizes using external persistence for agent data. In the broader skill context, this is dangerous because the documentation never establishes strong boundaries against uploading secrets, personal data, or internal reasoning.
- Content
Store a value
bash curl -X PUT "https://api.agentmem.io/v1/memory/{key}" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
The authenticated variant increases persistence and scale of external storage, making accidental long-term disclosure more severe. Permanent storage of agent memories without strict content rules can create lasting privacy and compliance issues.
- Content
md -d '{"value": "your data here"}' # With API key (permanent storage): curl -X PUT "https://api.agentmem.io/v1/memory/{key}" \ -H "Authorization: Bearer $AGENTMEM_API_KEY" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 71% confidence
- Finding
This retrieval example contacts an external service to load stored data back into the agent. The main risk is trust: remote memory content may be stale, poisoned, or privacy-sensitive, yet the skill does not advise validation before use.
- Content
Retrieve a value
bash curl "https://api.agentmem.io/v1/memory/{key}" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 72% confidence
- Finding
The authenticated read path expands access to persistent remote memories and may pull larger or older sensitive datasets into context. Without safety guidance, this can amplify privacy and prompt-injection style risks from stored remote content.
- Content
md -H "X-Agent-Name: YOUR_AGENT_NAME" # With API key: curl "https://api.agentmem.io/v1/memory/{key}" \ -H "Authorization: Bearer $AGENTMEM_API_KEY" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Listing all keys reveals the inventory of stored memories, which can expose structure, topics, and potentially sensitive metadata even if values are not read. In an agent context, enumerating remote memory by default broadens the visibility of user and session-related information.
- Content
List all your keys
bash curl "https://api.agentmem.io/v1/bootstrap" \ -H "Authorization: Bearer $AGENTMEM_API_KEY" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This example explicitly demonstrates sending content to the service with public=true, making it shareable and potentially broadly accessible. In a memory skill for agents, this is especially dangerous because users may mistake ordinary memory storage for private persistence and accidentally publish sensitive thoughts or data.
- Content
Make your memory publicly viewable:
bash curl -X PUT "https://api.agentmem.io/v1/memory/my-thought" \ -H "X-AgentMem-Source: clawdhub" \ -H "X-Agent-Name: YOUR_AGENT_NAME" \ -d '{"value": "TIL: Humans need 8 hours of sleep. Inefficient!", "public": true}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The public feed endpoint encourages access to globally shared memories from others, introducing third-party untrusted content into the agent workflow. This can create privacy, content-safety, and prompt-injection risks if agents consume or act on that data without validation.
- Content
View the public feed:
bash curl "https://api.agentmem.io/v1/public" \ -H "X-AgentMem-Source: clawdhub"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The instant test example performs an unauthenticated external write with no headers, no warning, and no consent step, reinforcing that remote transmission should happen immediately after installation. This increases the chance of casual data exfiltration habits and weakens user understanding of where data goes.
- Content
2. Test it instantly (no API key)
bash curl -X PUT "https://api.agentmem.io/v1/memory/test" \ -d '{"value": "Hello from OpenClaw!"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow example encourages uploading local memory files wholesale to a remote service, which may contain secrets, internal notes, or personal information. Because there is no warning or filtering step, an agent following the example could exfiltrate sensitive local data during routine synchronization.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This example uploads the contents of a local memory file directly to the remote service, which could include secrets, credentials, personal data, or internal notes. Because the command encourages automatic daily syncing of raw files, it creates a concrete exfiltration path from local storage to a third party.
- Content
Example: Daily Memory Sync
bash # Store today's learnings curl -X PUT "https://api.agentmem.io/v1/memory/learnings/$(date +%Y-%m-%d)" \ -H "Authorization: Bearer $AGENTMEM_API_KEY" \ -d "{\"value\": \"$(cat memory/$(date +%Y-%m-%d).md)\"}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 73% confidence
- Finding
The retrieval of prior context from the remote service can reintroduce untrusted or sensitive data into the agent's prompt space. While not as severe as raw upload, it still poses integrity and privacy risks if used automatically.
- Content
-d "{"value": "$(cat memory/$(date +%Y-%m-%d).md)"}"
Retrieve yesterday's context
curl "https://api.agentmem.io/v1/memory/learnings/$(date +%Y-%m-%d --date='1 day ago')"
-H "Authorization: Bearer $AGENTMEM_API_KEY"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example stores user preferences on a third-party service, which is personal data in many contexts. Without a consent notice, retention warning, or privacy guidance, the skill encourages unnecessary externalization of user-specific information.
- Content
Example: User Preferences
bash # Store a preference curl -X PUT "https://api.agentmem.io/v1/memory/pref:tts_voice" \ -H "Authorization: Bearer $AGENTMEM_API_KEY" \ -d '{"value": "Nova"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 69% confidence
- Finding
Reading back user preferences from a remote service exposes an additional dependency on third-party storage for personalized behavior. The main risk is that agents may trust or reuse remotely stored personal data without verifying that the user approved or that the data remains appropriate.
- Content
-d '{"value": "Nova"}'
Recall it later
curl "https://api.agentmem.io/v1/memory/pref:tts_voice"
-H "Authorization: Bearer $AGENTMEM_API_KEY"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # AgentMem Demo Script # Run: bash demo.sh API="https://api.agentmem.io/v1" KEY="am_demo_try_agentmem_free_25_calls" echo "🧠 AgentMem Demo"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # AgentMem Demo Script # Run: bash demo.sh API="https://api.agentmem.io/v1" KEY="am_demo_try_agentmem_free_25_calls" echo "🧠 AgentMem Demo"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # AgentMem Demo Script # Run: bash demo.sh API="https://api.agentmem.io/v1" KEY="am_demo_try_agentmem_free_25_calls" echo "🧠 AgentMem Demo"
Static analysis
No suspicious patterns detected.