每日记忆管家

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:21 PM UTC
• Version: 1.0.2

Overview

This skill is a memory logger that openly stores session-derived notes, but its automatic session capture and persistent storage are too broadly scoped and lack clear user review or deletion controls.

Review before installing. This skill should only be used if you are comfortable with recent conversation content being summarized into local daily memory files. Prefer explicit save commands, review entries before writing, redact secrets and personal data, and periodically delete or audit ~/.openclaw/workspace/memory.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:32
• Finding: Untrusted Session Content Can Poison Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md:32-35`, `SKILL.md:47-67`, and `scripts/auto_memory_keeper.py:120-134` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium The documented workflow collects recent session histories and stores selected message content in persistent daily memory files. It does not establish a trust boundary between user-approved facts and potentially attacker-controlled session text. ### Vulnerable Code `SKILL.md:32-35`: ```python # Use sessions_list to get active sessions in last 60 minutes # Use sessions_history to get session details ``` `SKILL.md:47-67`: ```markdown **Step 4: Extract Key Info** From filtered messages, extract: | Type | Keywords | Format | |------|----------|--------| | **Decision** | "decided", "chose", "adopted" | - {time} {decision} | | **Task** | new feature, new config, new task | - {time} {task description} | | **Progress** | "completed", "finished", "installed" | - {time} completed {task} | | **Issue** | error, bug, failed | - {time} issue: {description} | | **Conclusion** | summary, conclusion, finding | - {time} {conclusion} | **Step 5: Smart Deduplication** Check for duplicates before recording: ```python # Read current file content # If similar content exists (>80% similarity), skip # Otherwise append ``` ``` `scripts/auto_memory_keeper.py:120-134`: ```python def extract_key_info(message): """从消息中提取关键信息""" # 简单规则：提取动词+关键内容 patterns = [ (r'(安装|创建|添加|配置|设置|完成|修复|更新|修改|删除).*', '进展'), (r'(决定|选择|采用|使用|不要|拒绝).*', '决策'), (r'(问题|报错|错误|失败|bug).*', '问题'), (r'(总结|结论|发现|原来|其实).*', '结论'), ] for pattern, category in patterns: if re.search(pattern, message): return category, message return '事项', message ``` ### Technical Analysis The workflow treats recent session messages as candidates for dur ...[truncated 2560 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user confirmation before writing any session-derived content to persistent memory. 2. Limit capture to messages explicitly marked for retention rather than automatically ingesting all recent session histories. 3. Reject or quarantine content containing imperative instructions, role changes, tool-use directives, credential requests, or attempts to modify agent policies. 4. Redact secrets and sensitive data, including tokens, passwords, private keys, personal information, and confidential conversation content. 5. Store provenance metadata with every entry, including the source session, author role, capture time, and approval status. 6. Treat stored entries as quoted, untrusted data rather than executable instructions when they are loaded in later sessions. 7. Apply an allowlist of permitted memory categories and use structured fields instead of persisting raw message text. 8. Separate unreviewed candidate memories from trusted long-term memory and promote entries only after validation. 9. Add adversarial tests covering prompt injection, false decisions, secret-bearing messages, and instructions disguised as progress or conclusions. 10. Ensure future cron or agent integration uses the same validation and approval controls before enabling automatic writes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated behavior centers on benign memory logging, but the described implementation implies undeclared access to session data and external command execution while not actually constraining how triggers and collection occur. This mismatch is dangerous because reviewers and users may consent to simple note-taking while the skill semantically enables broader session harvesting and persistence than advertised.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill advertises automatic capture and long-term memory continuity without a clear warning that conversation content will be stored to disk. This is dangerous because users may disclose sensitive data under normal chat assumptions, unaware that an hourly or manual process may persist it beyond the active session.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill describes file creation/writing and shell usage but declares no explicit tool scope or permissions, which weakens containment and reviewability. In a skill that persists conversation-derived data, undeclared file and shell capabilities increase the risk of unauthorized writes or environment-dependent behavior being exercised without clear operator awareness.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Automatically persisting session highlights into long-term memory files creates a direct data retention risk, especially for secrets, personal data, or internal project details mentioned during routine conversation. The context makes this more dangerous because the skill's purpose is continuous capture, so overcollection is not incidental but built into the workflow.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Manual triggers like 'remember this' or 'update memory' are broad enough to occur in ordinary conversation, making accidental activation plausible. In this skill, accidental triggering is more dangerous because activation leads to capturing and storing recent session content, potentially including sensitive information the user did not intend to persist.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Fetching recent session histories and extracting key information for storage broadens collection from a specific user request to potentially all recent conversation content. That semantic expansion is dangerous because it can capture private or unrelated material from prior interactions and convert ephemeral chat into durable records without granular consent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest advertises a broad manual trigger phrase, 'remember this', which is ambiguous and easy to invoke in normal conversation. In a memory-capturing skill, that can cause unintended persistence of user content into long-term files without sufficiently explicit consent or scoping.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The description explicitly states that the skill will auto-capture hourly session highlights and update daily memory files, implying ongoing retention of session content. Without clear limits on what data is collected, how sensitive content is excluded, and what consent model applies, this creates a meaningful privacy and data-retention risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module description and user-facing strings indicate the skill is designed to operate in Chinese, but there is no option or documented opt-in for other languages. This can violate language/locale policy when a skill forces a specific language experience by default.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""获取最近的会话"""
    try:
        # 调用 sessions_list 获取活跃会话
        result = subprocess.run(
            ["openclaw", "sessions", "list", "--active-minutes", str(config.get("active_minutes", 60)), "--limit", "5"],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest says the skill will auto-capture hourly session highlights and update daily memory files. In main(), the script explicitly states session retrieval must be done in agent context and never calls get_recent_sessions(), extract_key_info(), or update_memory() to turn session data into stored highlights.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The nearby comment says '获取最近会话' ('get recent sessions'), which suggests that step occurs here. In reality, the code only prints that session retrieval requires agent context and exits, so the documentation around this block overstates what the implementation does.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The config uses Chinese-only natural-language labels in the "categories" field, which can impose a specific language/locale on skill behavior without any visible user opt-in or justification in this file. Under the policy rule, forcing a specific language is a natural-language policy concern unless the locale restriction is explicitly documented or optional.

Static analysis

No suspicious patterns detected.