T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:16- Finding
Unvalidated Persistent Agent Memory Modification
- Content
View full analysis
- Remediation
View remediation
Security audit
安全配置流程
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent OpenClaw configuration workflow, but it directs agents to write learned configuration details into persistent MEMORY.md without clear approval, redaction, or scoping.
Review this skill before installing if you do not want an agent to persist OpenClaw configuration lessons into general memory. Use it only with explicit review of any MEMORY.md entry, and avoid saving raw tokens, auth values, session identifiers, endpoints, logs, or unredacted configuration diffs.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file defines activation conditions using generic configuration-change phrases that could overlap with many ordinary requests beyond the intended OpenClaw workflow. Although line 14 narrows scope somewhat, the list does not clearly state exclusions or provide negative examples, so invocation boundaries remain ambiguous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs recording learned configuration values into MEMORY.md, which creates a risk of persistently storing secrets or sensitive operational details derived from authentication, model, session, or channel settings. Because the workflow covers auth-related configuration and encourages automatic learning/recording, sensitive data could be retained without user awareness or consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The title and the entire guide are written in Chinese, and there is no indication that other languages are supported or that the language choice is optional. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This manifest describes the skill's purpose and language but does not specify any concrete trigger phrases, invocation boundaries, or exclusion conditions. For manifest files, missing specificity about when the skill should activate can lead to unintended invocation in broader contexts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest sets the skill language to "zh-CN" without indicating that users can choose another language or that the locale restriction is optional. This can violate language/locale policy when a skill forces a specific language without user opt-in or documented justification.
- Content
Static analysis
No suspicious patterns detected.