Security audit

Personal Memory Layer

Security checks for vulnerabilities and agentic risk

Overview

This is a real memory feature, but it automatically builds a broad long-term personal profile from conversations without a clear opt-in or tight limits.

Install only if you want OpenClaw to keep a local, ongoing personal profile from your conversations. Before enabling it, confirm where the memory files live, how to review and delete them, whether automatic extraction can be disabled, and whether AGENTS.md changes require your approval.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:133
Finding: Automatic Persistent Profiling Without Explicit Opt-In
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:96
Finding: Excessive Collection of Sensitive Personal and Behavioral Information
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:35
Finding: Untrusted Conversation Content Can Poison Persistent Agent Memory and Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The top-level description emphasizes personalization benefits but does not prominently warn that the skill persistently stores, extracts, and synthesizes personal interaction data over time. Because users may rely on the metadata description to understand capability scope, this omission increases the risk of uninformed consent and unexpected retention of sensitive personal details.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly describes passive background review of interactions and automatic extraction of personal data into persistent storage. For a memory system handling preferences, context, relationships, and biographical facts, broad automatic operation creates a real over-collection risk and can capture sensitive information without a clear per-interaction consent gate or bounded trigger.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The statement that the skill 'initializes automatically when first used' does not define what counts as first use, creating ambiguity around when persistent tracking starts. In the context of long-term personal memory, vague activation criteria can lead to unintended collection and retention of user data before meaningful consent or awareness is established.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.