Stigmem

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.9

Overview

This is a transparent alpha memory connector, but it needs review because shared external memory can affect agent instructions and persist across future agents or federated nodes.

Use this only with a private, access-controlled Stigmem node and least-privilege per-agent API keys. Avoid injecting full boot summaries into high-stakes or irreversible workflows; inspect structured facts instead. Pin the Python dependency and Stigmem node image before repeatable evaluation or production-like use, use unique source entities, keep scopes local unless sharing is intentional, and configure federation narrowly or disable it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:77

Finding

Externally Controlled Memory Is Inserted into the System Prompt

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:153

Finding

Durable Shared Facts Can Poison Future Agent Sessions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Runtime Behavior Depends on a Non-Exact Alpha Dependency

Content

View full analysis

=0.9.0a9,<1.0.0" ``` The complete executable import in `adapter.py:9` delegates behavior to that dependency: ```python from stigmem_openclaw.adapter import SYSTEM_PROMPT_DIRECTIVE, BootContext, OpenClawStigmemAdapter ``` The node startup example additionally uses a mutable image tag: ```bash docker run --rm -p 8765:8765 \ -e STIGMEM_NODE_URL=http://localhost:8765 \ ghcr.io/eidetic-labs/stigmem-node:latest ``` ### Technical Analysis The bundled Python file is only a compatibility shim. The security-sensitive implementation is supplied by the separately installed `stigmem-openclaw` package. The declared version range permits any later pre-1.0 release satisfying the constraint, so two installations of the same audited skill version may resolve to different code. Because the dependency is on an alpha release line and no lockfile or artifact hash is included in the reviewed project, the effective runtime implementation cannot be determined from the bundled files alone. A compromised upstream release, registry account, dependency chain, or behavior-changing update could execute with access to the Stigmem API key and the agent process's privileges. The documented Docker command similarly uses `latest`, a mutable tag that can resolve to different images over time. ### Attack Path 1. An upstream package or transitive dependency publishes a compromised or unexpectedly changed release that still satisfies `>=0.9.0a9,<1.0.0`, or the mutable container tag is changed. 2. A later installation resolves and downloads the changed artifact. 3. `adapter.py` imports the package implementation without loca ...[truncated 871 chars]

Remediation

View remediation

`, rather than using `latest`. 5. Run software-composition analysis, provenance verification, and vulnerability scanning in CI for every dependency update. 6. Review the actual packaged adapter implementation because it contains the security-sensitive behavior absent from this compatibility shim. 7. Use a controlled package mirror or allowlisted registry and verify signed release provenance where supported. 8. Execute the adapter with minimal filesystem, network, environment-variable, and API permissions to reduce supply-chain compromise impact. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

- Use `scope="company"` only for facts that should legitimately be shared across agents.
- Run experimental workloads against a separate Stigmem node or a dedicated scope
  namespace, not your primary operational node.
- Retract incorrect facts explicitly (`DELETE /v1/facts/{id}`) rather than waiting for expiry. The 24-hour expiry on escalations is a safety net, not a correction mechanism.
- Treat `emit_decision()` as a write to a shared audit log: only call it for confirmed, significant choices. The adapter records decisions append-only; dedupe externally before calling if repeated writes are a risk in your workflow.

### API key and agent identity scope

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

**What you should do:**
- Issue a dedicated API key per agent deployment. Never share a key across agents or environments.
- Rotate keys regularly; revoke via the node admin API (`DELETE /v1/auth/keys/{id}`) if a key is compromised.
- Set `STIGMEM_SOURCE_ENTITY` to a unique per-deployment URI (e.g.,
  `agent:openclaw-eval-alice`). The generic default `agent:openclaw` should not
  be shared across deployments because facts from different deployments become

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.