OpenClaw 记忆系统

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This looks like a persistent memory skill with sharing and webhook features, but the package is under-scoped and under-discloses privacy and install impact.

Review this before installing. It claims broad persistent memory, cross-user sharing, import/export, deletion, cleanup, and Feishu webhook behavior, but the package does not ship the advertised implementation files and does not clearly explain privacy, retention, consent, or exactly what data may leave the workspace.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The quickstart instructs users to copy files directly into the user's workspace under ~/.openclaw without any warning about overwriting existing skills or configs. In a security-sensitive agent ecosystem, undocumented file replacement can clobber trusted local state, introduce unexpected behavior, or make it easier for a user to install unreviewed code blindly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide tells the user to execute an installation script but does not describe what changes the script performs, what files it touches, or whether it accesses the network or updates configuration. Encouraging execution of opaque setup scripts is dangerous because users may run code with local file access before understanding its effects.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The entire skill description, usage guidance, examples, and troubleshooting content are presented in Chinese, with no indication that other languages are supported or that the locale restriction is intentional for a region-specific use case. This can constitute a language-policy violation because it effectively forces a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly promotes persistent memory, multi-user support, and cross-user sharing, but it does not clearly warn users about privacy, retention, consent, or access-control risks. In a memory system that stores user content, tool-call history, images, and shared project data, omission of these warnings can lead operators to deploy data collection and sharing features without understanding the confidentiality impact.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes storing user memories, images, tool-call history, and correction data, but it does not disclose privacy, retention, consent, or data-handling expectations. In a memory skill, this omission can cause operators to collect sensitive personal or behavioral data without adequate notice or safeguards, increasing the chance of privacy misuse or noncompliant deployment.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document states that image memories are automatically cleaned after 30 days of no access, but does not warn users that stored data may be deleted automatically. For a memory system, silent retention-based deletion can cause unexpected loss of evidence, history, or user data, especially if users assume persistence.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The release notes advertise cross-user memory sharing, project sharing controls, and memory import/export, but provide no warning about privacy boundaries, data sensitivity, or the risk of accidental disclosure. In a memory system, these features directly affect confidential stored content, so underspecified sharing semantics can lead users to expose one user's or project's memories to others without understanding the consequences.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill description and operational guidance are presented in Chinese, which effectively forces a specific language for users reading the documentation. The file does not offer an alternative language or explain that the skill is intended only for a Chinese-speaking audience.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly advertises natural-language memory correction, deletion, and rollback features, but does not warn users that their stored data may be altered or removed. In a memory-management skill, undocumented mutation and deletion behavior can cause integrity loss, accidental data destruction, and unsafe operator assumptions about persistence.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to configure a Feishu webhook URL but does not warn that memory-related content or metadata may be sent to an external third-party service. This creates a privacy and data-governance risk, especially for a memory system that may contain personal, project, or sensitive operational information.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: This manifest presents the skill display name, description, tags, and features entirely in Chinese, but does not state that the skill is China-specific or that users can choose another language. That can violate a language/locale policy when a skill is distributed broadly without explicit user opt-in to a forced language.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The manifest’s user-facing natural-language fields, including the top-level description and all skill/config/test descriptions, are written only in Chinese. This creates a language policy concern because the skill presents a fixed language experience without offering any user choice or documenting that the skill is intentionally region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The package description is written only in Chinese, which signals a language-specific presentation in the skill metadata without any indication that users can choose another language or that the skill is intentionally region-specific. Under the policy rule for natural-language violations, forcing a single language without opt-in or clear justification should be flagged.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: All user-facing instructional text in this file is written in Chinese, with no indication that another language version is available or that Chinese is required for a region-specific purpose. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The file consistently forces a single language for all user-facing instructions and descriptions. Per the policy rule, this is a natural-language locale restriction unless the skill offers language choice or clearly states that the skill is intentionally region- or locale-specific.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

]
  },
  "devDependencies": {
    "jest": "^29.0.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The file's comment and all user-facing console messages are written in Chinese, which imposes a specific language on users without any opt-in or alternative locale. This matches the policy category for language or locale constraints expressed in natural-language content.

Static analysis

No suspicious patterns detected.