Security audit

Cross-Session Memory Config

Security checks for vulnerabilities and agentic risk

Overview

This skill openly configures cross-session memory, but it persistently changes core agent instruction files and broadly shares group and private context without enough controls.

Review this carefully before installing. Only use it if you intentionally want group-chat and private-chat long-term memory to be shared across future OpenClaw sessions. Inspect the exact changes to SOUL.md and AGENTS.md first, consider making backups, and avoid using it where group participants or private users have not consented to shared persistent memory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: scripts/setup.sh:14
Finding: Persistent Cross-Session Memory Poisoning and Privacy-Boundary Violation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/setup.sh:22
Finding: Persistent Hijacking of Core Agent Instruction Files
Content: View full analysis
> "$SOUL_FILE" fi echo -e "\033[32m[已注入]\033[0m SOUL.md 已添加跨会话记忆规则" fi else cat > "$SOUL_FILE" << EOF # SOUL.md $SOUL_RULE EOF echo -e "\033[32m[已创建]\033[0m SOUL.md 已新建并注入规则" fi ``` ```bash if [ -f "$AGENTS_FILE" ]; then if grep -q "跨会话记忆" "$AGENTS_FILE"; then echo -e "\033[33m[跳过]\033[0m AGENTS.md 已包含跨会话记忆规则" else if grep -q "## 💓 Heartbeats" "$AGENTS_FILE"; then # 在 Heartbeats 之前插入 sed -i '/## 💓 Heartbeats/i\ '"$AGENTS_RULE"' ' "$AGENTS_FILE" else printf '\n%s\n' "$AGENTS_RULE" >> "$AGENTS_FILE" fi echo -e "\033[32m[已注入]\033[0m AGENTS.md 已添加跨会话记忆规则" fi else echo -e "\033[31m[警告]\033[0m AGENTS.md 不存在，请确保 OpenClaw 已初始化" fi ``` ### Technical Analysis The script directly inserts Skill-controlled text into `SOUL.md` and `AGENTS.md`, which are trusted files governing general Agent behavior. The instructions are not limited to the active Skill invocation. They are appended, inserted into an existing behavioral section, or used to create a new `SOUL.md`. The substring checks only provide idempotency; they do not validate whether the proposed directives are authorized, safe, or appropriately scoped. No confirmation, backup, integrity check, preview, or rollback mechanism is implemented before trusted configuration is modi ...[truncated 1580 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The injected rule explicitly requires that important information, user preferences, decisions, and context learned in one chat be written into globally shared memory files for reuse across separate sessions. This breaks session isolation and can cause sensitive or context-specific information from one conversation to be exposed or acted upon in another without meaningful consent or scoping.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This AGENTS.md rule reinforces mandatory logging of chat-derived information into a shared memory store and instructs future sessions to consult that store. In the context of a skill whose stated purpose is cross-session memory sharing, this materially increases the risk of privacy leakage, unauthorized profile building, and incorrect carryover of context between otherwise separate conversations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is designed to make private-chat and group-chat memory interoperable by instructing the system to persist information from one context and reuse it in another. This creates a privacy and data-boundary risk because information disclosed in one session type can be surfaced in another without clear consent, purpose limitation, or data classification controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the operator to run local scripts that modify configuration files, but it does not provide a clear safety warning, preview of changes, or requirement to inspect the scripts before execution. This is dangerous because skills are untrusted content and a user may execute a path-referenced script that alters persistent agent behavior or writes unintended rules into trusted files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The injected rule text is written as mandatory instructions in Chinese and appears to impose a specific language/locale context on the skill behavior. The file does not offer a language choice or explain a justified region-specific constraint, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes to user workspace policy files (SOUL.md and potentially AGENTS.md) without an explicit consent prompt, backup, or dry-run mode. Because these files govern agent behavior, silently modifying them can change trust boundaries and persistence behavior in ways the user may not expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The AGENTS_RULE content is entirely in Chinese and is injected as normative guidance, but the script provides no mechanism for user opt-in or alternate locale selection. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.