ClawHub
Back to skill

Security audit

elite memory skill

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed AI memory tool, but its GitHub sync can commit and push the whole OpenClaw workspace instead of only memory files.

Review the sync script before installing or enabling cron. Narrow git add -A to an allowlist such as MEMORY.md, SESSION-STATE.md, and memory/, verify the memory remote points to a private repository you control, and only set FEISHU_USER_ID if you want sync metadata sent to Feishu.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises and instructs shell-based operations (git, node, cron, gh) but does not declare corresponding permissions or clearly constrain execution scope. This creates a trust gap where an agent may perform filesystem, process, and network-affecting actions without transparent permission signaling to the user.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The script silently performs a network-backed git fetch and fast-forward merge during a routine 'read memory' operation. In a memory-management skill, automatically incorporating remote content into the local workspace can import attacker-controlled or unexpected data if the remote is compromised or misconfigured, and the user is not clearly warned that synchronization occurs.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill is explicitly designed to write conversation content into local memory files and then sync those files to GitHub, but the description does not give a prominent user-facing warning or require informed consent. This is dangerous because users may share sensitive data in normal conversation without realizing it will be persisted and exported outside the local session.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The Feishu notification feature can send sync details and error information to an external service, but the skill does not present this as a meaningful data egress risk. Error messages and change summaries can contain filenames, metadata, repository information, or memory-related details that should not be transmitted without explicit notice.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The script automatically creates and modifies memory/state files in a user workspace without any consent prompt, dry-run mode, or in-file warning. In a memory-management skill, silent writes are more sensitive because they alter durable personal records and can mislead users about what was preserved or changed.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
Remote synchronization is materially security-relevant because it contacts a network service and merges external repository state into a local memory workspace without explicit disclosure at execution time. In the context of a memory skill handling potentially sensitive notes, hidden sync behavior increases the risk of trust boundary violations and unexpected data manipulation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends synchronization status and metadata to Feishu automatically when FEISHU_USER_ID is configured, without any explicit consent gate, dry-run mode, or data-minimization control. Although it does not directly send full memory contents in this function, it does transmit repository/workflow details and creates an external notification channel around a memory system, which increases privacy and metadata-leak risk in a context likely to involve sensitive personal information.

Ssd 3

Medium
Confidence
97% confidence
Finding
The WAL rules instruct the agent to immediately persist user preferences, decisions, and other conversation-derived content into long-term memory files, and elsewhere the skill supports syncing those memories externally. In context, this creates a direct natural-language data leakage path where sensitive personal, project, or credential-adjacent information could be stored and propagated without adequate filtering or consent.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# 添加到 crontab
crontab -e

# 每日 23:55 同步
55 23 * * * ~/.openclaw/workspace/scripts/sync-memory-to-github.sh
Confidence
90% confidence
Finding
crontab -e

Session Persistence

Medium
Category
Rogue Agent
Content
node scripts/init.mjs

# 2. 配置 GitHub remote
gh repo create ai-memory --private
git remote add memory git@github.com:username/ai-memory.git

# 3. 配置飞书通知 (可选)
Confidence
83% confidence
Finding
create ai-memory --private git remote add memory git@github.com:username/ai-memory.git # 3. 配置飞书通知 (可选) export FEISHU_USER_ID="ou_xxxxx" ``` ### 记忆操作 ```bash # 分析对话并写入临时记忆 node scripts/analyze.mjs

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.