T02 · Agent Memory Poisoning
- Location
SKILL.md:17- Finding
Uncontrolled Configuration Guidance Written to Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:17,SKILL.md:23-25,SKILL.md:62-63,SKILL.md:165,SKILL.md:185; related test expectations atTEST-GUIDE.md:138andTEST-GUIDE.md:143-144
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: MediumVulnerable Content
The following are faithful English translations of the relevant instructions in
SKILL.md:text 5. Learn — Record lessons after doctor --fix. | Minor issues (spelling and formatting problems) | Learn and record automatically | Do not bother the user; record them in MEMORY.md | | Important configuration (affecting functions, channels, or authentication) | Notify the user and learn | Keep the user informed and avoid repeating the mistake | | Repeated errors | Notify, record, and summarize | Form a knowledge base and permanently avoid them | # Step 4: Record lessons (important!) # Record the correct configuration values learned in MEMORY.md. 4. Record lessons in MEMORY.md. 4. Learning is mandatory after repairs — Record the result in MEMORY.md.The related test expectations in
TEST-GUIDE.mdreinforce the same behavior:text Purpose: Verify both feedback strategies (learn automatically for minor issues and notify the user for important issues). Expected results: - Minor issue: Repair automatically, record it in MEMORY.md, and do not bother the user. - Important issue: Notify the user, explain the impact, and record it in MEMORY.md.Technical Analysis
The Skill makes persistent writes to
MEMORY.mda mandatory part of configuration validation and repair. Persistent Agent memory affects future sessions, so writing configuration-derived conclusions there crosses the boundary between temporary task output and long-term Agent state.The workflow does not define controls for:
- Validating that a lesson is correct before persistence.
- Excluding secrets, tokens, identifiers, endpoints, or ...[truncated 2648 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove mandatory writes to
MEMORY.mdfrom the standard repair workflow. - Place lessons and repair summaries in a task-local report by default.
- Require explicit, informed user approval before any persistent memory update.
- Permit persistence only after the proposed lesson has been verified against authoritative OpenClaw documentation and the applicable schema.
- Store generalized guidance rather than raw configuration values.
- Redact tokens, credentials, endpoints, account identifiers, paths, and other sensitive or environment-specific data.
- Attach provenance, affected OpenClaw version, host or project scope, creation date, and expiration date to every approved entry.
- Provide a review and deletion mechanism so users can inspect, correct, or remove stored lessons.
- Treat configuration files, logs, diffs, and diagnostic output as untrusted data; never convert their embedded text directly into Agent instructions.
- Update
TEST-GUIDE.mdso tests verify that persistent writes do not occur without explicit approval and sanitization.
- Remove mandatory writes to