Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local OpenClaw workspace audit helper that inspects private workspace and memory files but does not show hidden exfiltration, destructive behavior, or persistence installation.
Install this only if you want an agent to inspect your OpenClaw workspace, including personal memory and profile files. Keep API keys, passwords, OAuth tokens, and raw sensitive chat content out of memory files, and be cautious with memorySearch.extraPaths or experimental session transcript indexing.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
echo "⚠️ Possible API key found in .md files"
fi
if [ -f ".env" ]; then
echo "⚠️ .env file in workspace (should be gitignored)"
fi
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
fi
if [ -f ".env" ]; then
echo "⚠️ .env file in workspace (should be gitignored)"
fi
echo ""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
fi
if [ -f ".env" ]; then
echo "⚠️ .env file in workspace (should be gitignored)"
fi
echo ""
The skill description uses trigger phrases like 'review workspace', 'audit files', and 'check structure', which are broad enough to match common user requests and may cause unintended invocation. Over-broad activation increases the chance that the skill runs in contexts where filesystem inspection or memory-file review was not explicitly intended.
The 'When to Run' section includes ambiguous conditions such as 'periodically', 'when asked to review', and 'during heartbeat maintenance cycles', which do not sufficiently constrain execution. This can cause the skill to activate without precise user intent, expanding access to workspace metadata and file contents beyond what is necessary.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- [ ] Old daily files reviewed and distilled to MEMORY.md periodically
- [ ] No sensitive data (API keys, passwords) in memory files
**Automatic Memory Flush:** OpenClaw triggers a silent agent turn before session compaction to write durable memories. The agent receives a prompt to flush important context to `memory/YYYY-MM-DD.md`. This is automatic — no action needed, but be aware your context WILL be compacted after ~180k tokens.
### 4. Vector Search Alignment
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Look for files that don't fit the standard layout:
ls -la ~/.openclaw/workspace/
Flag anything that:
The file instructs the agent to persist session content into daily memory files and later curate it into long-term memory. This creates a real privacy and data-retention risk because sensitive conversation details, personal data, or secrets disclosed during sessions may be stored beyond the original interaction and then automatically reloaded in future sessions.
## Memory Workflow
1. **During sessions:** Write notable things to `memory/YYYY-MM-DD.md`
2. **Periodically:** Review daily files, distill insights to `MEMORY.md`
3. **On session start:** Read today + yesterday's daily files
4. **In main session:** Also read MEMORY.md
Detected: suspicious.prompt_injection_instructions