Big Memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:07 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent memory-recovery tool, but it persists detailed project context automatically and lacks clear safeguards against saving or replaying sensitive or untrusted content.

Review this skill before installing if you work with secrets, private customer data, proprietary code, or regulated information. Use only explicit save and recall commands where possible, avoid automatic compaction capture until redaction rules are added, and do not enable session transcript indexing or cloud embeddings unless you are comfortable making that content searchable or provider-processed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:130

Finding

Durable snapshots can preserve and reactivate attacker-controlled instructions

Content

View full analysis

` and `` markers 2. Inform the user: "I detected context was compacted. Restoring task state from snapshot taken at {timestamp}..." 3. Present the recovered state concisely: - **Goal:** {from Active Goal} - **Phase:** {from Current State} - **Working on:** {from Files In Play} - **Next up:** {from Next Steps} 4. Ask: "Does this match where we left off? Anything to update before I continue?" 5. Resume work from the Next Steps section ``` The associated precedence rule states: ```markdown - **Latest snapshot wins.** When multiple snapshots exist, the most recent one is the source of truth. Earlier snapshots provide history but should not override later decisions. ``` ### Technical Analysis The skill creates snapshots from current task and conversation state, including free-form decisions, code context, blockers, and next steps. Such task material may originate from untrusted documents, repository content, or other attacker-controlled inputs. During recovery, the skill retrieves the latest s ...[truncated 2176 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:115

Finding

Sensitive task context is persisted in plaintext without redaction or retention controls

Content

View full analysis

... ``` 4. Multiple snapshots in the same file is expected. Each captures a point-in-time state. The most recent snapshot is the source of truth. ``` The required template explicitly requests exact code, identifiers, absolute paths, errors, and configuration values: ```markdown ### [SNAPSHOT] Code Context ```{language} // Only include code that cannot be reconstructed from reading files // Function signatures, error messages, exact patterns, config values // Keep under 50 lines total ``` ### [SNAPSHOT] Key Names & Values - {identifier type}: `{exact value}` - {identifier type}: `{exact value}` ``` ### Technical Analysis The skill deliberately persists broad task context in ordinary Markdown files. Requested snapshot data includes exact code fragments, absolute file paths, API endpoints, environment-variable identifiers, configuration values, error messages, user requirements, and other project-specific information. The design contains no mandatory secret scanning, value redaction, data classification, encryption, restrictive file-permission requirement, retention perio ...[truncated 1991 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Every snapshot MUST follow this exact structure. Do not omit fields -- write "none" if a field is empty. For the full template with field-by-field guidelines, read {baseDir}/references/TASK-SNAPSHOT.md.

markdown

<!-- BIG-MEMORY-SNAPSHOT v1 -->
<!-- timestamp: YYYY-MM-DDTHH:MM:SS -->
<!-- snapshot-id: YYYY-MM-DD-NN -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

text

The HTML comment markers (`<!-- BIG-MEMORY-SNAPSHOT v1 -->` and `<!-- /BIG-MEMORY-SNAPSHOT -->`) are critical. They act as machine-parseable delimiters that `memory_search` matches via BM25 exact-term matching, enabling precise retrieval.

---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

...

text

4. Multiple snapshots in the same file is expected. Each captures a point-in-time state. The most recent snapshot is the source of truth.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises broad activation phrases such as "checkpoint" and "restore context" at the metadata level, which can cause the skill to trigger in conversations where the user did not intend to invoke durable-memory behavior. Because the skill writes structured task state to memory, unintended activation increases the chance of persisting sensitive project details without clear user consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The snapshot schema instructs the agent to store exact code context, identifiers, endpoints, table names, environment variables, errors, file paths, and decisions into long-term memory files. This materially increases the chance of persisting secrets, internal architecture details, or sensitive business logic that may later be exposed through search, recall, or unrelated tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-trigger section explicitly treats the vague word "checkpoint" as a command to immediately create a snapshot. In normal developer conversations, "checkpoint" can be used descriptively rather than as consent to persist memory, so this creates a realistic risk of accidental data capture.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The recovery flow directs the agent to search for, retrieve, and display previously stored snapshots back into the conversation. If snapshots contain sensitive code, internal paths, identifiers, or secrets, this mechanism can resurface that data to the wrong context or user, turning storage risk into direct disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template explicitly asks for exact key names, values, config data, and user-provided requirements, which can cause snapshots to capture secrets, tokens, internal endpoints, or other sensitive operational details. In a memory/recovery skill, this is especially risky because the feature is designed to persist and resurface context, increasing the chance that sensitive data is retained longer than necessary and echoed back later.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The recommended compaction prompt instructs the agent to append structured snapshots containing exact file paths, variable names, code snippets, and key names/values into persistent memory files. This creates durable storage of potentially sensitive implementation details and secrets, and the append-only daily log pattern can accumulate high-value data over time, making accidental disclosure or later retrieval misuse more likely.

Content

Scanner excerpt · references/openclaw-config.md (reported line 20)May include surrounding context.

md

"enabled": true,
          "softThresholdTokens": 40000,
          "systemPrompt": "You are capturing structured task state for post-compaction recovery. Follow the BIG-MEMORY-SNAPSHOT schema exactly. Be precise with file paths, variable names, and code snippets. Do not summarize -- capture specifics.",
          "prompt": "Context compaction is imminent. Create a structured task snapshot following the BIG-MEMORY-SNAPSHOT schema and APPEND it to memory/YYYY-MM-DD.md. Include all sections: active goal, current state, files in play, decisions made, code context (key snippets only), key names/values, blockers, and next steps. Read the existing daily log first and append -- never overwrite existing content. If there is genuinely nothing worth storing, reply NO_FLUSH."
        }
      }
    }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document recommends enabling session transcript indexing and adding sessions as a memory source, but it does not warn that past conversation content may contain sensitive data, secrets, personal information, or user-provided confidential material. In a memory/search feature, indexing transcripts expands the persistence and discoverability of prior chat content, increasing privacy and data-retention risk even if no external service is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The template instructs use of absolute file paths, which can disclose usernames, home directory structures, repository locations, mount points, or organization-specific environment details. While lower severity than secret capture, this still increases environmental exposure and can aid reconnaissance or leak private workstation/server information when snapshots are shared or persisted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.