Memoria Persistente para Agentes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:55 AM UTC
• Version: 1.0.0

Overview

This memory skill broadly matches its purpose, but it stores and reuses sensitive personal context and can index account-wide session history without enough scoping or user control.

Install only if you are comfortable with an agent maintaining durable local memory. Do not store secrets, medication details, or other sensitive personal data in these memory files, avoid enabling the cron job until review/approval controls exist, and do not run session-sync.py unless you intend to index all sessions visible to that account.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:80

Finding

Untrusted User Content Can Poison Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/session-sync.py:22

Finding

Account-Wide Session Transcripts Are Indexed Without User or Channel Isolation

Content

View full analysis

Path: """Find the OpenClaw sessions directory.""" # Check common locations candidates = [ workspace / ".openclaw" / "agents" / "main" / "sessions", Path.home() / ".openclaw" / "agents" / "main" / "sessions", ] # Check OPENCLAW_STATE_DIR state_dir = os.environ.get("OPENCLAW_STATE_DIR") if state_dir: candidates.insert(0, Path(state_dir) / "agents" / "main" / "sessions") for candidate in candidates: if candidate.exists(): return candidate return candidates[-1] # Return last as default ``` ```python for session_key, meta in sessions_meta.items(): session_id = meta.get("sessionId", "") if not session_id: continue # Find transcript file transcript_pattern = f"{session_id}*.jsonl" transcript_files = list(sessions_dir.glob(transcript_pattern)) if not transcript_files: continue # Skip the main transcript (use the .jsonl, not trajectory) transcript = None for tf in transcript_files: if tf.suffix == ".jsonl" and "trajectory" not in tf.name: transcript = tf break if not transcript: continue channel = meta.get("lastChannel", "unknown") to = meta.get("deliveryContext", {}).get("to", "unknown") updated = meta.get("updatedAt", 0) # Extract topics topics = extract_session_topics(transcript) # Simple channel label if "telegram" in str(to): if "group" in session_key: channel_label = "telegram:group" else: channel_label = "telegram:dm" elif "webchat" in channel or "tui" in session_key: channel_label = "tui" elif " ...[truncated 3262 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Documentation Recommends Plaintext Workspace Storage for Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description presents a broad persistent memory system for AI agents that supports remembering and recalling information across sessions using a three-layer architecture. The supplied code chunk does something much narrower: it is an offline maintenance/consolidation utility that reads recent daily markdown notes and writes categorized archival entries. While this loosely relates to the 'archival' aspect of memory maintenance, it does not implement the stated overall system behavior, such as core memory, recall memory, session continuity, user preference retrieval, or interaction-triggered persistence. The primary purpose is therefore materially narrower and different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about agent memory persistence across sessions, including remembering user preferences and maintaining layered memory stores. The supplied code does none of that. Instead, it runs a GitHub CLI command against a specific repository and prints repo statistics such as stars, forks, issues, and PRs. This is a materially different primary purpose and involves external resource access to GitHub that is not implied by the description. Therefore, the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description promises a broad persistent memory system for agents, including layered memory storage, cross-session recall of user preferences/context, explicit remembering behavior, and maintenance workflows. The supplied code instead implements a specific utility script that indexes session transcripts by extracting regex-matched topics and writing a summary JSON file. While this loosely relates to 'archival' or cross-session context, it is only a narrow session-topic indexing tool, not a full persistent memory system with core/archival/recall layers or explicit memory persistence and retrieval capabilities. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction 'if core says "Renate takes Desvenlafaxina", never ask about medications' normalizes retaining and reusing medication information, which is sensitive health data, without opt-in or necessity controls. Health information carries elevated privacy risk, and storing it in persistent agent memory can expose users to profiling, accidental disclosure, or misuse across sessions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs use of file reads, file writes, shell commands, and environment-dependent behavior, but it declares no explicit tool scope or permissions boundaries. That mismatch increases the chance an agent can invoke broader capabilities than reviewers or operators expect, which is dangerous in a persistence-oriented skill that routinely touches local state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to persist user preferences, context, decisions, and other potentially sensitive information across sessions, yet it provides no clear warning about retention, privacy, or how long data is stored. In a memory skill, this context makes the issue more dangerous because persistence is the core function, so silent data accumulation is likely and foreseeable.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The core-memory template encourages storing personal facts, medication information, schedules, and credential references for repeated reuse across sessions, but lacks clear minimization, consent, or sensitivity boundaries. Because this skill's purpose is long-term memory, the surrounding context amplifies the danger: it creates a durable repository of sensitive user data that may be over-collected and broadly exposed to future agent runs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The automatic behavior to 'update core immediately' when the user shares new personal information and to remember anything the user marks as memorable creates broad, default-on persistence. This is risky because users may disclose personal data conversationally without understanding it will be stored long-term and reused later.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The consolidation workflow instructs the agent to mine session notes for decisions, lessons, and new information, then promote them into long-term archival memory. This increases risk of secondary collection: information originally shared for a transient interaction may be transformed into durable records without the user's awareness or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The integration guide instructs the agent to use and modify files under a workspace memory directory, including persistent notes and archival content, without warning that these operations can alter user data and persist across sessions. In a memory skill, silent file mutation is security-relevant because an agent may over-collect, overwrite, or retain sensitive information in ways the user does not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The cron example sets up unattended auto-consolidation that periodically triggers an agent turn to review notes, extract items, and trim core memory, but it does not warn that this will run automatically and modify persistent files on a schedule. Unattended background execution increases the chance of unintended data retention, corruption, or processing of sensitive content without active user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The extraction logic matches primarily Spanish words such as "decisión", "aprendí", and several person/project names, which implicitly biases the skill toward a specific language and locale. Because the file does not offer user opt-in or clearly justify the language restriction, this is a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/core-trim.py (reported line 100)May include surrounding context.

python

results.append(f"Core memory: {word_count} words (limit: {max_words})")

    if word_count <= max_words:
        results.append("Within limit. No trimming needed.")
        return results

    sections = parse_sections(content)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code rewrites memory/core.md after removing sections and moving their contents elsewhere, which is a potentially destructive file operation affecting user data. Although the script prints result messages after execution, there is no confirmation prompt or explicit warning in comments/docstrings near the write path that the original file will be modified and reduced.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script performs external GitHub CLI and network activity that is unrelated to the stated purpose of the skill, which is persistent memory for agents. In agent ecosystems, extraneous network-capable scripts increase attack surface, create opportunities for telemetry or unauthorized outbound access, and may indicate bundled functionality that operators do not expect.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/repo-stats.py (reported line 15)May include surrounding context.

python

def check_stats():
    import subprocess
    result = subprocess.run(
        ["C:\\Program Files\\GitHub CLI\\gh.exe", "repo", "view", "renateparma/memoria-persistente-openclaw", "--json", "stargazerCount,forkCount,issues,pullRequests,description"],
        capture_output=True, text=True, encoding="utf-8"
    )

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring says the script checks "stars, forks, issues, downloads," but the gh repo view --json call requests stargazerCount,forkCount,issues,pullRequests,description and never retrieves or computes download counts. This is an active documentation-to-code mismatch about what the script measures.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.