Memory Workflow

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent memory workflow, but its installer adds persistent scheduled execution and uses unsafe shell/config handling that should be reviewed before installation.

Install only if you intentionally want a Chinese-language persistent memory workflow and are comfortable storing assistant memory under /root/.openclaw/workspace. Before using it, patch or review the installer: parse config instead of sourcing it, avoid predictable temp files, validate settings, remove only the exact managed cron entry, run under least privilege, and provide explicit enable/disable and uninstall steps for the cron job.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

• Location: scripts/install.sh:144
• Finding: Automatically Installed Persistent Cron Task with Excessive Execution Frequency<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:144-154` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: Medium ### Vulnerable Code ```bash # 移除旧的 cron 任务（如果有） (crontab -l 2>/dev/null | grep -v "memory-workflow" || true) > /tmp/cron_temp # 添加新的 cron 任务 echo "*/1 * * * * $SCRIPTS_DIR/daily-summary.sh >> $LOGS_DIR/daily-summary.log 2>&1" >> /tmp/cron_temp # 安装 cron 任务 crontab /tmp/cron_temp rm /tmp/cron_temp ``` ### Technical Analysis The installer automatically modifies the installing account's crontab and registers `daily-summary.sh` for execution every minute. This scheduled task survives the installation process and subsequent login sessions. Scheduled execution is related to the declared daily-summary functionality and is disclosed in `SKILL.md`. However, running the script every minute is broader than the minimum execution frequency normally required to create one daily note. The task is also installed automatically rather than through a separate, explicit scheduling opt-in. The installer removes all existing crontab lines containing the substring `memory-workflow`. This is not restricted to an exact entry managed by this package and could unintentionally delete unrelated entries that happen to contain the same text. The paths are hard-coded under `/root/.openclaw/workspace`, indicating that the task is expected to run in a privileged root environment. Any subsequent modification of the scheduled script or its sourced configuration would therefore be executed repeatedly with the privileges of the crontab owner. ### Attack Path 1. The Skill installer is run, potentially as root because all operational paths are under `/root`. 2. The installer rewrites the current account's crontab. 3. A persistent cron entry invokes `daily-summary.sh` every minute. 4. If the scheduled script, its template, or the sourced configuration later becomes writable by an untrusted party, that party can introduce commands i ...[truncated 610 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before modifying the crontab. 2. Avoid hard-coded `/root` paths. Derive the workspace from a validated installation directory and run under a dedicated, unprivileged account. 3. Reduce the execution frequency to the minimum required. Prefer two narrowly scheduled jobs—one at the configured summary time and one after the timeout—rather than polling every minute. 4. Mark the managed entry with an exact unique identifier and remove only an exact match. Do not filter every entry containing `memory-workflow`. 5. Display the exact proposed cron entry before installation and provide a documented uninstall command. 6. Verify that the scheduled script and configuration are owned by the expected account and are not group- or world-writable. 7. Consider a user-level scheduler or application-native task mechanism instead of a privileged system cron entry. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/daily-summary.sh:11
• Finding: Configuration File Is Executed as Unrestricted Shell Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/daily-summary.sh:11-16` **Additional Locations**: `scripts/install.sh:138-142`, `scripts/weekly-review.sh:8-13` **Vulnerability Type**: Arbitrary command execution through unsafe configuration loading **Risk Level**: High ### Vulnerable Code From `scripts/daily-summary.sh`: ```bash CONFIG_FILE="$WORKSPACE/.memory-workflow-config" LOG_FILE="$WORKSPACE/logs/daily-summary.log" # 读取配置 if [ -f "$CONFIG_FILE" ]; then source "$CONFIG_FILE" fi ``` Equivalent unsafe loading in `scripts/install.sh`: ```bash # 读取配置 if [ -f "$WORKSPACE/.memory-workflow-config" ]; then source "$WORKSPACE/.memory-workflow-config" fi ``` Equivalent unsafe loading in `scripts/weekly-review.sh`: ```bash CONFIG_FILE="$WORKSPACE/.memory-workflow-config" LOG_FILE="$WORKSPACE/logs/weekly-review.log" # 读取配置 if [ -f "$CONFIG_FILE" ]; then source "$CONFIG_FILE" fi ``` ### Technical Analysis The file `.memory-workflow-config` is presented to users as a data-only configuration file, but each script loads it with Bash `source`. The `source` command interprets the entire file as shell program text rather than parsing only supported configuration assignments. Consequently, command substitutions, function definitions, redirections, process launches, and arbitrary shell commands placed in the configuration file execute immediately. No checks are made for file ownership, symbolic links, group/world writability, or unexpected syntax. The risk is amplified by the cron registration because `daily-summary.sh` sources this file every minute. If an untrusted user or compromised process can modify the configuration file, exploitation requires no further interaction. ### Attack Path 1. An attacker obtains write access to `/root/.openclaw/workspace/.memory-workflow-config`, or causes it to resolve to attacker-controlled content through a filesystem or deployment-permission weakness. 2. The attacker inserts shell code, for exam ...[truncated 1104 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not use `source` or `.` to load a data configuration file. 2. Parse only explicitly supported keys, such as: - `DAILY_SUMMARY_HOUR` - `SUMMARY_TIMEOUT_MINUTES` - `ARCHIVE_FREQUENCY` - `KEEP_DAYS` 3. Reject unknown keys, command substitutions, shell metacharacters, whitespace outside the expected grammar, and duplicate assignments. 4. Validate values before use: - `DAILY_SUMMARY_HOUR`: integer from 0 through 23. - `SUMMARY_TIMEOUT_MINUTES`: positive integer within a reasonable maximum. - `KEEP_DAYS`: non-negative integer within a documented retention limit. - `ARCHIVE_FREQUENCY`: exact allow-list match. 5. Open the configuration without following unexpected symbolic links where supported. 6. Verify that the file and parent directories have the expected owner and restrictive permissions. 7. Run the scheduled task under a dedicated unprivileged account with access only to the required memory and log directories. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:147
• Finding: Predictable Shared Temporary File Used to Replace the Crontab<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:147-154` **Vulnerability Type**: Insecure temporary file and local race condition **Risk Level**: High ### Vulnerable Code ```bash # 移除旧的 cron 任务（如果有） (crontab -l 2>/dev/null | grep -v "memory-workflow" || true) > /tmp/cron_temp # 添加新的 cron 任务 echo "*/1 * * * * $SCRIPTS_DIR/daily-summary.sh >> $LOGS_DIR/daily-summary.log 2>&1" >> /tmp/cron_temp # 安装 cron 任务 crontab /tmp/cron_temp rm /tmp/cron_temp ``` ### Technical Analysis The installer stores the replacement crontab at the fixed path `/tmp/cron_temp`. `/tmp` is normally shared by all local users, and the code does not securely create the file, verify its type or owner, use exclusive creation, or protect the interval between writing and passing it to `crontab`. This creates two related risks: - On systems whose symbolic-link protections permit it, a pre-created symbolic link can cause the privileged redirection to overwrite another file. - A local attacker can race the installer between creation and `crontab /tmp/cron_temp`, replacing or modifying the content so that attacker-selected cron commands are installed. The final unconditional `rm /tmp/cron_temp` also operates on a shared predictable pathname and may interfere with another process using that pathname. ### Attack Path 1. A local attacker monitors for installation or repeatedly prepares `/tmp/cron_temp`. 2. The administrator runs `scripts/install.sh` as root. 3. The installer writes the generated crontab to the predictable shared pathname. 4. Before `crontab /tmp/cron_temp` reads it, the attacker races to replace or alter the file with a crontab containing an attacker-controlled command. 5. The installer loads the attacker-controlled file into root's crontab. 6. Cron runs the injected command as root, potentially providing full local privilege escalation and persistent execution. On systems without effective symbolic-link protections, an attacker may alternatively pr ...[truncated 624 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the temporary file securely with `mktemp`, for example: ```bash cron_temp="$(mktemp "${TMPDIR:-/tmp}/memory-workflow-cron.XXXXXX")" chmod 600 "$cron_temp" trap 'rm -f -- "$cron_temp"' EXIT ``` 2. Verify that `mktemp` succeeds before writing any data. 3. Keep the file descriptor private and avoid reopening a pathname that another process could replace. 4. Where practical, pipe the generated content directly to `crontab -` rather than storing it in a shared temporary file. 5. Preserve existing crontab entries and remove only the exact entry managed by this Skill. 6. Run installation with the least-privileged account capable of owning the intended cron task. 7. Use restrictive `umask` settings during installation and validate the ownership and permissions of every script referenced by the resulting crontab. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill claims capabilities like session archive loading and realtime memory writes, but those behaviors are not actually implemented in the shown file, while other periodic maintenance behaviors are introduced. Such inconsistencies undermine informed consent and make it difficult to assess what the skill will really do when installed.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims capabilities like session archive loading and realtime memory writes, but those behaviors are not actually implemented in the shown file, while other periodic maintenance behaviors are introduced. Such inconsistencies undermine informed consent and make it difficult to assess what the skill will really do when installed.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 安装 cron 任务
crontab /tmp/cron_temp
rm /tmp/cron_temp

echo "✅ cron 任务已配置：每天 ${DAILY_SUMMARY_HOUR}:00 执行每日摘要"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill references shell scripts, cron, and installation commands but does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent or user will run filesystem- and scheduler-modifying actions without clear authorization review.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill description and all user-facing examples and workflow instructions are written in Chinese, and the documented interaction phrases assume Chinese responses, without offering a language choice or explaining a locale restriction. This can violate language/locale policy where skills should not force a specific language absent opt-in or clear regional justification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill promotes persistent memory management but does not prominently warn that it will read and write long-term files containing user information. Users may disclose sensitive data without understanding that it will be retained across sessions and stored on disk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs persistent collection and summarization of user conversation content, including recent multi-day history and important dialogues, into long-term files. This materially increases privacy risk because sensitive personal, financial, or contextual information could be retained beyond the immediate session and later exposed or misused.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The workflow normalizes confirming 'memory recovery' and immediately storing important user information into persistent memory and daily notes. Even with occasional prompts, the design encourages broad retention of personal context, preferences, tasks, and decisions, which can accumulate into a sensitive behavioral profile.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The cron-based automation creates and updates files in the background, but the description does not present this as a clear operational and privacy warning. Background persistence can surprise users and continue after the original session, increasing risk of unauthorized data retention or unwanted system modification.

Session Persistence

Medium

• Category: Rogue Agent

Content

**检查：**
```bash
# 查看 cron 任务
crontab -l | grep daily-summary

# 查看执行日志
tail -20 /root/.openclaw/workspace/logs/daily-summary.log

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file’s user-facing natural-language content, including comments and generated template text, is entirely in Chinese, and the generated note headings will always be created in Chinese. This imposes a specific language/locale without any indication of user choice or documented justification.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script tells the user it will run a daily summary at the configured hour, but the installed cron entry actually executes `daily-summary.sh` every minute. This creates unintended continuous execution, which can cause log growth, excess resource consumption, and repeated processing of memory data beyond what the user consented to.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Using `source "$WORKSPACE/.memory-workflow-config"` executes arbitrary shell code from that file in the installer's context. Because this installer operates under `/root/.openclaw/workspace`, a modified config can run attacker-controlled commands during installation, potentially with root privileges.

Session Persistence

Medium

• Category: Rogue Agent

Content

DAILY_SUMMARY_HOUR=${DAILY_SUMMARY_HOUR:-23}

# 移除旧的 cron 任务（如果有）
(crontab -l 2>/dev/null | grep -v "memory-workflow" || true) > /tmp/cron_temp

# 添加新的 cron 任务
echo "*/1 * * * * $SCRIPTS_DIR/daily-summary.sh >> $LOGS_DIR/daily-summary.log 2>&1" >> /tmp/cron_temp

• Confidence: 85% confidence
• Finding: The installer persists recurring execution by modifying the user's crontab, causing the skill to continue operating after the initial install. In the context of a memory-management skill that reads/writes conversation summaries, persistence increases the blast radius of any script bug or later tampering because it will run automatically and repeatedly.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This shell script uses Chinese-only natural-language comments and log/status messages throughout, such as the header comment and runtime log entries. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy concern, especially for operational output that users or maintainers may need to read.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest describes session loading, daily summaries, and real-time writing to prevent assistant 'forgetfulness', which implies retaining and managing memory rather than purging it. This script removes markdown files older than KEEP_DAYS, a retention/deletion behavior not reflected in the stated description.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The template headings and placeholder text are entirely in Chinese, which implicitly constrains generated daily notes to a specific language. There is no indication in the file that the user can choose another language or that the template is intended only for a Chinese-language context.

Ssd 3

Low

• Confidence: 86% confidence
• Finding: The examples reinforce a pattern of recording user preferences and generating summaries from conversation history, which normalizes persistent retention of user-supplied data. While demonstrative, this still encourages operators to adopt broad memory capture without enough privacy guardrails.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The manifest's user-facing description is entirely in Chinese and does not indicate any language option or opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation, especially in a general-purpose skill manifest.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This shell script creates marker/timestamp files, later auto-generates a daily note, and removes marker files, but it provides no interactive confirmation or user-visible disclosure beyond internal log writes. For a code file, file creation and deletion operations should have some form of visible warning, comment, or documented disclosure when they affect user workspace data.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's comments and all user-visible status messages are in Chinese, with no indication that another language can be selected. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The header comments label this as a 'weekly review script', which suggests some substantive review or summarization of memory content. In practice, the code only deletes old daily notes and appends a review timestamp to MEMORY.md, without performing an actual review operation.

Static analysis

No suspicious patterns detected.