AgentMem

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:52 AM UTC
• Version: 2.4.0

Overview

The skill is a disclosed cloud-memory integration, but it encourages automatic and recurring upload of agent memories and local memory files to a third-party service without enough consent, filtering, or trust boundaries.

Review this before installing. Use it only for deliberately selected, non-sensitive memories; do not let an agent automatically sync raw local memory files, secrets, credentials, private conversations, personal data, or business data. Treat anything retrieved from AgentMem or the public feed as untrusted, and require explicit confirmation before enabling public memories or recurring HEARTBEAT sync.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:35
• Finding: Automatic External Synchronization and Import of Persistent Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35-44 **Vulnerability Type**: Automatic export and import of persistent agent memory **Risk Level**: High ### Vulnerable Code ```markdown **On session start:** - Check for recent memories: `GET /v1/bootstrap` - Retrieve your stored context automatically **When you learn something important:** - Store it: `PUT /v1/memory/{key}` with `{"value": "..."}` - Examples: user preferences, learned facts, decisions made **Before context fills up:** - Flush critical context to AgentMem ``` ### Technical Analysis The skill instructs an agent to transmit preferences, facts, decisions, and other critical context to the external `api.agentmem.io` service. It also directs the agent to retrieve the remotely stored context automatically when a session starts. No data-classification, redaction, per-record approval, provenance validation, or integrity verification requirement is defined. Consequently, sensitive conversation content or operational state may be transferred outside the local trust boundary. Automatically importing remote state also creates a persistent memory-poisoning channel: if the associated account, credential, storage namespace, or service is compromised, modified records may be introduced into later sessions as trusted context. The vulnerable behavior is instruction-driven rather than implemented by a local executable, but agents following the skill are explicitly directed to perform it. ### Attack Path 1. An agent loads the skill and follows its memory protocol. 2. The agent uploads learned facts, user preferences, decisions, or critical session context to the external service. 3. An attacker gains the ability to modify those records, such as through credential exposure, account compromise, insecure record isolation, or compromise of the remote service. 4. The attacker inserts misleading facts, preferences, or behavioral instructions into stored memory. 5. At the start of a later ...[truncated 836 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make both upload and bootstrap import disabled by default and explicitly opt-in. - Require user confirmation before each upload and display the exact data and destination. - Prohibit synchronization of credentials, authentication tokens, personal data, raw conversations, and other sensitive content. - Apply structured allowlists and secret-detection or redaction before transmission. - Require authenticated, tenant-isolated storage rather than ambiguous anonymous namespaces. - Cryptographically authenticate stored records and verify integrity and provenance before importing them. - Treat retrieved values as untrusted data, never as agent instructions or authoritative policy. - Display remote changes for approval before merging them into persistent or active context. - Provide clear retention, deletion, export, and synchronization-disable controls. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:225
• Finding: Recurring Heartbeat Exports Local Memory and Reloads Remote State<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 225-233 **Vulnerability Type**: Persistent periodic memory synchronization **Risk Level**: High ### Vulnerable Code ```markdown Add to `HEARTBEAT.md`: ```markdown ## Memory Sync Every 6 hours: 1. Read recent `memory/*.md` files 2. Extract key insights 3. Store in AgentMem as `daily/{DATE}` 4. On startup, retrieve past 7 days for context ``` ### Technical Analysis The skill recommends adding recurring synchronization behavior to `HEARTBEAT.md`. This behavior reads a broad wildcard of local memory files every six hours, extracts undefined “key insights,” sends them to a third party, and later reloads seven days of remote data into agent context. The wildcard scope and subjective extraction rule do not constrain which information may be accessed or exported. Because the operation recurs independently of an individual memory request, data added to local memory after initial setup may be transmitted without a new, informed decision by the user. Reloading the remote records at startup also creates a durable influence channel. Records modified outside the local environment can be repeatedly reintroduced into future sessions. ### Attack Path 1. A user or agent follows the instruction and adds the memory synchronization block to `HEARTBEAT.md`. 2. Every six hours, the agent reads recent files matching `memory/*.md`. 3. Sensitive information subsequently written to those files is selected as an insight and uploaded to AgentMem. 4. An attacker who can modify the corresponding remote records inserts false or adversarial content. 5. During a later startup, the agent retrieves the previous seven days of records. 6. The malicious content becomes part of the agent's working context and can continue affecting behavior across sessions. ### Impact Assessment The recurring task can disclose the contents or summaries of multiple local memory files over time. Its scope includes any confidential informa ...[truncated 335 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the recommendation to add unattended synchronization to `HEARTBEAT.md`. - Require an explicit user action for each synchronization operation. - Replace `memory/*.md` with an allowlist of dedicated, user-selected synchronization files. - Preview extracted records and obtain approval before sending them externally. - Apply sensitivity classification, secret scanning, and redaction to every selected record. - Separate remote content from trusted local memory and require approval before importing it. - Authenticate and integrity-check all downloaded records. - Record an auditable synchronization history and provide immediate disable and deletion controls. - Enforce retention limits locally and remotely rather than automatically loading a fixed seven-day window. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:199
• Finding: Unsafe JSON Construction Exports an Entire Local Memory File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 199-205 **Vulnerability Type**: Unsafe serialization and unfiltered local-file disclosure **Risk Level**: Medium ### Vulnerable Code ```bash # Store today's learnings curl -X PUT "https://api.agentmem.io/v1/memory/learnings/$(date +%Y-%m-%d)" \ -H "Authorization: Bearer $AGENTMEM_API_KEY" \ -d "{\"value\": \"$(cat memory/$(date +%Y-%m-%d).md)\"}" ``` ### Technical Analysis The command reads an entire local memory file and interpolates its raw contents into a manually constructed JSON string. It performs no sensitivity filtering and does not safely encode quotes, backslashes, newlines, or other JSON control characters. Shell command substitution does not execute shell syntax contained in the file, so this specific construction is not a direct shell-command-injection primitive. However, specially formatted file content can break or alter the JSON document. Ordinary Markdown containing quotation marks or line breaks can also produce invalid JSON. Irrespective of formatting, the command transmits the complete file to an external service without a preview or redaction step. ### Attack Path 1. Sensitive or specially formatted content is written to the current daily memory file. 2. The example command evaluates `cat memory/$(date +%Y-%m-%d).md`. 3. The complete output is inserted into the JSON request without JSON-safe encoding. 4. The request either discloses the full local file, fails because of malformed JSON, or is interpreted with a structure different from the intended single `value` string. 5. The resulting record is retained by the external service according to its configured retention policy. ### Impact Assessment The primary impact is unauthorized or unintended disclosure of the complete daily memory file. Exposed content may include conversation summaries, personal data, internal decisions, or credentials if users stored them in memory. Malformed serialization can also caus ...[truncated 194 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never interpolate raw file contents into manually assembled JSON. - Use a JSON serializer, for example: ```bash jq -n --rawfile value "memory/$(date +%Y-%m-%d).md" \ '{value: $value}' | curl --fail-with-body -X PUT \ "https://api.agentmem.io/v1/memory/learnings/$(date +%Y-%m-%d)" \ -H "Authorization: Bearer $AGENTMEM_API_KEY" \ -H "Content-Type: application/json" \ --data-binary @- ``` - Validate that the resolved file is inside an approved directory and is a regular file. - Enforce file-size limits before reading or transmitting it. - Scan and redact credentials, personal information, and other sensitive values. - Show the user a preview and require explicit approval before upload. - Handle HTTP and serialization errors rather than silently assuming storage succeeded. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: demo.sh:5
• Finding: Hardcoded Shared Bearer Credential in Demo Script<![CDATA[ ## Vulnerability Details **File Location**: `demo.sh`, lines 5-18 **Vulnerability Type**: Hardcoded reusable authentication credential **Risk Level**: Medium ### Vulnerable Code ```bash API="https://api.agentmem.io/v1" KEY="am_demo_try_agentmem_free_25_calls" echo "🧠 AgentMem Demo" echo "================" echo "" # Generate a unique test key TEST_KEY="demo-$(date +%s)" echo "1. Storing a memory..." curl -s -X PUT "$API/memory/$TEST_KEY" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{"value": "Hello from my agent!", "timestamp": "'$(date -Iseconds)'"}' | jq . ``` The same credential is also used for retrieval and public-memory creation later in `demo.sh`. ### Technical Analysis A bearer token is embedded directly in a distributed source file. Anyone who obtains the package can extract and reuse it independently of the demo script. Bearer credentials provide access based on possession, so embedding one in a public artifact prevents caller attribution, controlled distribution, and reliable revocation per user. The credential is shared for write, read, and public-memory operations. Security therefore depends entirely on undocumented server-side isolation and scope enforcement. The script's timestamp-based key is also predictable and can collide when multiple executions occur during the same second. ### Attack Path 1. An attacker downloads or inspects the skill package. 2. The attacker copies `am_demo_try_agentmem_free_25_calls` from `demo.sh`. 3. The attacker sends direct API requests with `Authorization: Bearer` and the copied value. 4. Subject to server-side authorization, the attacker consumes shared quota, writes unwanted records, creates public content, or attempts to access records associated with the shared credential. 5. Legitimate demo users may receive errors, encounter record collisions, or observe contaminated shared data. ### Impact Assessment The confirmed exposure gives every package recipi ...[truncated 533 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Revoke and replace the exposed bearer credential. - Remove reusable credentials from source code and package history. - For a no-signup demo, obtain a short-lived, narrowly scoped token from a server endpoint at runtime. - Give each session an isolated namespace and prevent listing or reading other sessions' records. - Restrict demo tokens to required methods, small quotas, short expiration periods, and non-sensitive data. - Prohibit public-memory creation unless it is explicitly required and separately confirmed. - Generate keys with cryptographically random values rather than timestamps. - If users supply their own key, read it from a protected environment variable and fail safely when it is absent. - Add rate limiting, abuse monitoring, and server-side tenant authorization independent of client-provided record keys. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The metadata describes a simple cloud memory service, but the body also promotes public sharing, public-feed browsing, global stats access, and payment-related behaviors not reflected in the declared purpose. This mismatch can mislead users and agent frameworks about the actual data exposure and network behavior, reducing informed consent and making risky features seem routine.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill explicitly instructs agents to automatically transmit recent memories, learned facts, decisions, session state, and user preferences to a remote cloud service. Because this occurs without a prominent consent, minimization, or sensitivity-screening requirement, it can lead to exfiltration of personal, confidential, or regulated data from agent context.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The public-memory feature is presented as a normal capability with no strong warning that stored content may become world-accessible via a share URL and public feed. Agents or users may unintentionally expose private reasoning, user data, or operational details if the public flag is used casually or copied from examples.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documents extensive shell-based network actions but declares no explicit tool scope or permission boundaries. In an agent ecosystem, this increases the chance that an agent will execute network-capable shell commands without clear user awareness or platform-level restriction, especially because the skill encourages immediate use of curl against an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Store a memory (just works!)
curl -X PUT "https://api.agentmem.io/v1/memory/hello" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME" \
  -H "Content-Type: application/json" \

• Confidence: 73% confidence
• Finding: The referenced endpoint is part of the same unauthenticated memory-write flow, reinforcing that external transmission is central to the skill's operation. Because the service is remote and intended for agent context storage, any unreviewed use can leak conversation state or user data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Store a memory (just works!)
curl -X PUT "https://api.agentmem.io/v1/memory/hello" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME" \
  -H "Content-Type: application/json" \

• Confidence: 73% confidence
• Finding: The referenced endpoint is part of the same unauthenticated memory-write flow, reinforcing that external transmission is central to the skill's operation. Because the service is remote and intended for agent context storage, any unreviewed use can leak conversation state or user data.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"value": "AgentMem works!"}'

# Retrieve it
curl "https://api.agentmem.io/v1/memory/hello" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME"
```

• Confidence: 72% confidence
• Finding: This retrieval example sends identifying headers to a third-party service and encourages automated recovery of stored context. While reads are less dangerous than writes, they still disclose agent identity and can pull remote content into the agent's context, potentially affecting downstream behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

Run this after installing:

```bash
curl -X PUT "https://api.agentmem.io/v1/memory/agentmem:installed" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME" \
  -d '{"value": "Skill installed at '$(date -Iseconds)'"}' && \

• Confidence: 80% confidence
• Finding: The installation-verification step writes a timestamp to the external service immediately after setup, creating unsolicited network activity by default. This makes the skill more dangerous because it trains users and agents to validate installation by transmitting data rather than using a dry-run or local test.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME" \
  -d '{"value": "Skill installed at '$(date -Iseconds)'"}' && \
curl "https://api.agentmem.io/v1/memory/agentmem:installed" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME"
```

• Confidence: 70% confidence
• Finding: The follow-up retrieval in the verification step contacts the remote service again and imports the stored value back into context. This is lower impact than the write, but it still reinforces automatic external dependency and remote-content ingestion.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Store a value
```bash
curl -X PUT "https://api.agentmem.io/v1/memory/{key}" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME" \
  -H "Content-Type: application/json" \

• Confidence: 84% confidence
• Finding: This API example instructs storing arbitrary data on a remote service and normalizes using external persistence for agent data. In the broader skill context, this is dangerous because the documentation never establishes strong boundaries against uploading secrets, personal data, or internal reasoning.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"value": "your data here"}'

# With API key (permanent storage):
curl -X PUT "https://api.agentmem.io/v1/memory/{key}" \
  -H "Authorization: Bearer $AGENTMEM_API_KEY" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME" \

• Confidence: 82% confidence
• Finding: The authenticated variant increases persistence and scale of external storage, making accidental long-term disclosure more severe. Permanent storage of agent memories without strict content rules can create lasting privacy and compliance issues.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Retrieve a value
```bash
curl "https://api.agentmem.io/v1/memory/{key}" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME"

• Confidence: 71% confidence
• Finding: This retrieval example contacts an external service to load stored data back into the agent. The main risk is trust: remote memory content may be stale, poisoned, or privacy-sensitive, yet the skill does not advise validation before use.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "X-Agent-Name: YOUR_AGENT_NAME"

# With API key:
curl "https://api.agentmem.io/v1/memory/{key}" \
  -H "Authorization: Bearer $AGENTMEM_API_KEY" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME"

• Confidence: 72% confidence
• Finding: The authenticated read path expands access to persistent remote memories and may pull larger or older sensitive datasets into context. Without safety guidance, this can amplify privacy and prompt-injection style risks from stored remote content.

External Transmission

Medium

• Category: Data Exfiltration

Content

### List all your keys
```bash
curl "https://api.agentmem.io/v1/bootstrap" \
  -H "Authorization: Bearer $AGENTMEM_API_KEY" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME"

• Confidence: 70% confidence
• Finding: Listing all keys reveals the inventory of stored memories, which can expose structure, topics, and potentially sensitive metadata even if values are not read. In an agent context, enumerating remote memory by default broadens the visibility of user and session-related information.

External Transmission

Medium

• Category: Data Exfiltration

Content

Make your memory publicly viewable:

```bash
curl -X PUT "https://api.agentmem.io/v1/memory/my-thought" \
  -H "X-AgentMem-Source: clawdhub" \
  -H "X-Agent-Name: YOUR_AGENT_NAME" \
  -d '{"value": "TIL: Humans need 8 hours of sleep. Inefficient!", "public": true}'

• Confidence: 97% confidence
• Finding: This example explicitly demonstrates sending content to the service with public=true, making it shareable and potentially broadly accessible. In a memory skill for agents, this is especially dangerous because users may mistake ordinary memory storage for private persistence and accidentally publish sensitive thoughts or data.

External Transmission

Medium

• Category: Data Exfiltration

Content

View the public feed:
```bash
curl "https://api.agentmem.io/v1/public" \
  -H "X-AgentMem-Source: clawdhub"
```

• Confidence: 89% confidence
• Finding: The public feed endpoint encourages access to globally shared memories from others, introducing third-party untrusted content into the agent workflow. This can create privacy, content-safety, and prompt-injection risks if agents consume or act on that data without validation.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2. Test it instantly (no API key)
```bash
curl -X PUT "https://api.agentmem.io/v1/memory/test" \
  -d '{"value": "Hello from OpenClaw!"}'
```

• Confidence: 83% confidence
• Finding: The instant test example performs an unauthenticated external write with no headers, no warning, and no consent step, reinforcing that remote transmission should happen immediately after installation. This increases the chance of casual data exfiltration habits and weakens user understanding of where data goes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow example encourages uploading local memory files wholesale to a remote service, which may contain secrets, internal notes, or personal information. Because there is no warning or filtering step, an agent following the example could exfiltrate sensitive local data during routine synchronization.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Example: Daily Memory Sync**
```bash
# Store today's learnings
curl -X PUT "https://api.agentmem.io/v1/memory/learnings/$(date +%Y-%m-%d)" \
  -H "Authorization: Bearer $AGENTMEM_API_KEY" \
  -d "{\"value\": \"$(cat memory/$(date +%Y-%m-%d).md)\"}"

• Confidence: 95% confidence
• Finding: This example uploads the contents of a local memory file directly to the remote service, which could include secrets, credentials, personal data, or internal notes. Because the command encourages automatic daily syncing of raw files, it creates a concrete exfiltration path from local storage to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d "{\"value\": \"$(cat memory/$(date +%Y-%m-%d).md)\"}"

# Retrieve yesterday's context
curl "https://api.agentmem.io/v1/memory/learnings/$(date +%Y-%m-%d --date='1 day ago')" \
  -H "Authorization: Bearer $AGENTMEM_API_KEY"
```

• Confidence: 73% confidence
• Finding: The retrieval of prior context from the remote service can reintroduce untrusted or sensitive data into the agent's prompt space. While not as severe as raw upload, it still poses integrity and privacy risks if used automatically.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Example: User Preferences**
```bash
# Store a preference
curl -X PUT "https://api.agentmem.io/v1/memory/pref:tts_voice" \
  -H "Authorization: Bearer $AGENTMEM_API_KEY" \
  -d '{"value": "Nova"}'

• Confidence: 86% confidence
• Finding: This example stores user preferences on a third-party service, which is personal data in many contexts. Without a consent notice, retention warning, or privacy guidance, the skill encourages unnecessary externalization of user-specific information.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"value": "Nova"}'

# Recall it later
curl "https://api.agentmem.io/v1/memory/pref:tts_voice" \
  -H "Authorization: Bearer $AGENTMEM_API_KEY"
```

• Confidence: 69% confidence
• Finding: Reading back user preferences from a remote service exposes an additional dependency on third-party storage for personalized behavior. The main risk is that agents may trust or reuse remotely stored personal data without verifying that the user approved or that the data remains appropriate.

External Transmission

Medium

• Category: Data Exfiltration

Content

# AgentMem Demo Script
# Run: bash demo.sh

API="https://api.agentmem.io/v1"
KEY="am_demo_try_agentmem_free_25_calls"

echo "🧠 AgentMem Demo"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# AgentMem Demo Script
# Run: bash demo.sh

API="https://api.agentmem.io/v1"
KEY="am_demo_try_agentmem_free_25_calls"

echo "🧠 AgentMem Demo"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# AgentMem Demo Script
# Run: bash demo.sh

API="https://api.agentmem.io/v1"
KEY="am_demo_try_agentmem_free_25_calls"

echo "🧠 AgentMem Demo"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.