Security audit

mnemospark memory-backup

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent memory-backup purpose, but its helper scripts and cloud-plugin guidance create real risk of archiving or exporting unintended local files.

Install only if you are comfortable reviewing every canonical path before backup, keeping archives local unless explicitly needed, and avoiding the unsafe mnemospark install path. Do not use this on untrusted workspaces or with discovery JSON you did not just generate and inspect.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/package_memory_backup.py:56
Finding: Untrusted Discovery Data Allows Arbitrary Local File Archiving
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/discover_memory.py:59
Finding: Symlinked Memory Entries Can Escape the Workspace Boundary
Content: View full analysis
dict[str, Any]: return { 'path': str(path.resolve()), 'displayPath': rel_to_workspace(path, workspace), 'kind': 'dir' if path.is_dir() else 'file', 'system': system, 'reason': reason, } ``` ```python if memory_md.exists(): candidates.append(candidate(memory_md, workspace, 'coreMemory', 'long-term memory')) if memory_dir.exists(): for daily in sorted(memory_dir.glob('*.md')): if daily.is_file(): candidates.append(candidate(daily, workspace, 'coreMemory', 'daily or durable markdown memory')) ``` The resolved candidate is subsequently trusted by the packager: ```python src = Path(raw).expanduser().resolve() if not src.exists(): missing_paths.append({'path': item.get('displayPath', raw), 'reason': 'candidate missing at package time'}) continue key = str(src) if key in seen: continue seen.add(key) include_sources.append(src) ``` ### Technical Analysis The discovery script selects entries based on names such as `MEMORY.md` and `memory/*.md`, but it does not use `lstat()` or reject symbolic links. Methods such as `exists()`, `is_file()`, `is_dir()`, and `resolve()` follow symlinks. Consequently, a workspace entry that appears to be a memory file can point to a target outside the workspace. The discovery output records the external canonical target, and the packaging script then archives that target without enforcing workspace containment. The same issue can affect candidate directories. Recursive archive creation may also follow links according to the archive library's behavior and current filesystem state. Missing pac ...[truncated 1321 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Plugin Installation Guidance Explicitly Bypasses Safety Controls
Content: View full analysis
``` ### Technical Analysis The skill repeatedly instructs the agent to install a third-party plugin using an option explicitly named `--dangerously-force-unsafe-install`. This bypasses installation safety controls rather than requirin ...[truncated 1790 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 7)May include surrounding context.
md
This repo starts with one skill: - `memory-backup` — inspect OpenClaw memory systems, propose a safe memory-only backup set, create a deterministic local archive, and optionally hand the archive off to mnemospark for cloud storage. ## Skill included

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to inspect configuration files, validate on-disk paths, and read artifacts via helper scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the runtime to grant broader-than-necessary file/environment access or leave operators unable to enforce least privilege, increasing the risk of unintended data exposure during backup discovery.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 71% confidence
Finding: This skill is explicitly designed to create persistent backup bundles of agent memory artifacts, which introduces retention and exfiltration risk if sensitive memory contents are archived or handed off to external storage. Although the text includes exclusions for secrets, logs, and unrelated config, the capability still increases the attack surface because durable memory may contain sensitive operational context and the workflow optionally transfers archives to another system.
Content: Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.
md
# Memory Backup Create or update backups for OpenClaw memory artifacts only. Follow this workflow:

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest records workspace as str(workspace), which is an absolute local filesystem path. When the backup bundle is shared or stored externally, this leaks host-environment metadata such as usernames, directory layout, or mount structure, which exceeds the stated goal of a memory-only archive. In this skill context, that makes the issue slightly more concerning because the tool is explicitly designed to export and hand off archives.
Content: No source excerpt is available for this finding.