Security audit

Cross-Session Memory Config

Security checks for vulnerabilities and agentic risk

Overview

The skill openly sets up shared memory between group and private chats, but it persistently changes core agent behavior and uses broad memory-sharing rules without clear privacy limits.

Install only if you intentionally want group and private chat memories to be shared through global OpenClaw memory files. Review the exact inserted rules first, back up SOUL.md and AGENTS.md, and avoid this skill in environments where private chats, group participants, sensitive decisions, or personal data should remain separated.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs the user/agent to execute external setup scripts that modify configuration files, but it does not disclose the exact changes, provide a diff, or require confirmation before writing. In a security-sensitive agent environment, opaque script-driven edits to core instruction/config files can introduce persistent policy changes or unsafe behavior that is hard for the user to audit.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script silently edits or creates SOUL.md and AGENTS.md inside the user's OpenClaw workspace, changing agent behavior and persistence rules without a clear pre-action warning or confirmation. This is dangerous because it modifies long-lived configuration and memory-governance files, so a user may unknowingly enable broader data retention and cross-session sharing.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The injected rules explicitly instruct the agent to persist 'important information learned in chats' into globally shared memory files and to reuse that memory across group and private contexts. This creates a clear cross-context data leakage risk: sensitive user data disclosed in one conversation can be surfaced in another session without the original user's expectation or consent.

Ssd 3

High

Confidence: 98% confidence
Finding: The injected SOUL.md rule mandates writing important information, user preferences, decisions, and chat context from one session into globally shared memory files. This creates a privacy and data-segregation risk because information learned in one context can automatically propagate into other contexts, potentially exposing sensitive data across chats or users sharing the same workspace.

Ssd 3

High

Confidence: 98% confidence
Finding: The AGENTS.md rule reinforces that information learned in chats must be logged into a global shared memory store, normalizing persistent collection across private and group interactions. In this skill's context, that is especially dangerous because the whole purpose is to bridge otherwise separate sessions, increasing the chance of unintended disclosure, profile building, and context leakage.

Static analysis

No suspicious patterns detected.