Memory Workflow

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent memory workflow, but its installer adds persistent scheduled execution and uses unsafe shell/config handling that should be reviewed before installation.

Install only if you intentionally want a Chinese-language persistent memory workflow and are comfortable storing assistant memory under /root/.openclaw/workspace. Before using it, patch or review the installer: parse config instead of sourcing it, avoid predictable temp files, validate settings, remove only the exact managed cron entry, run under least privilege, and provide explicit enable/disable and uninstall steps for the cron job.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

• Location: scripts/install.sh:144

Finding

Automatically Installed Persistent Cron Task with Excessive Execution Frequency

Content

View full analysis

/dev/null | grep -v "memory-workflow" || true) > /tmp/cron_temp # 添加新的 cron 任务 echo "*/1 * * * * $SCRIPTS_DIR/daily-summary.sh >> $LOGS_DIR/daily-summary.log 2>&1" >> /tmp/cron_temp # 安装 cron 任务 crontab /tmp/cron_temp rm /tmp/cron_temp ``` ### Technical Analysis The installer automatically modifies the installing account's crontab and registers `daily-summary.sh` for execution every minute. This scheduled task survives the installation process and subsequent login sessions. Scheduled execution is related to the declared daily-summary functionality and is disclosed in `SKILL.md`. However, running the script every minute is broader than the minimum execution frequency normally required to create one daily note. The task is also installed automatically rather than through a separate, explicit scheduling opt-in. The installer removes all existing crontab lines containing the substring `memory-workflow`. This is not restricted to an exact entry managed by this package and could unintentionally delete unrelated entries that happen to contain the same text. The paths are hard-coded under `/root/.openclaw/workspace`, indicating that the task is expected to run in a privileged root environment. Any subsequent modification of the scheduled script or its sourced configuration would therefore be executed repeatedly with the privileges of the crontab owner. ### Attack Path 1. The Skill installer is run, potentially as root because all operational paths are under `/root`. 2. The installer rewrites the current account's crontab. 3. A persistent cron entry invokes `daily-summary.sh` every minute. 4. If the scheduled script, its template, or the sourced configuration later becomes writable by an untrusted party, that party can introduce commands i ...[truncated 610 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/daily-summary.sh:11

Finding

Configuration File Is Executed as Unrestricted Shell Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:147

Finding

Predictable Shared Temporary File Used to Replace the Crontab

Content

View full analysis

/dev/null | grep -v "memory-workflow" || true) > /tmp/cron_temp # 添加新的 cron 任务 echo "*/1 * * * * $SCRIPTS_DIR/daily-summary.sh >> $LOGS_DIR/daily-summary.log 2>&1" >> /tmp/cron_temp # 安装 cron 任务 crontab /tmp/cron_temp rm /tmp/cron_temp ``` ### Technical Analysis The installer stores the replacement crontab at the fixed path `/tmp/cron_temp`. `/tmp` is normally shared by all local users, and the code does not securely create the file, verify its type or owner, use exclusive creation, or protect the interval between writing and passing it to `crontab`. This creates two related risks: - On systems whose symbolic-link protections permit it, a pre-created symbolic link can cause the privileged redirection to overwrite another file. - A local attacker can race the installer between creation and `crontab /tmp/cron_temp`, replacing or modifying the content so that attacker-selected cron commands are installed. The final unconditional `rm /tmp/cron_temp` also operates on a shared predictable pathname and may interfere with another process using that pathname. ### Attack Path 1. A local attacker monitors for installation or repeatedly prepares `/tmp/cron_temp`. 2. The administrator runs `scripts/install.sh` as root. 3. The installer writes the generated crontab to the predictable shared pathname. 4. Before `crontab /tmp/cron_temp` reads it, the attacker races to replace or alter the file with a crontab containing an attacker-controlled command. 5. The installer loads the attacker-controlled file into root's crontab. 6. Cron runs the injected command as root, potentially providing full local privilege escalation and persistent execution. On systems without effective symbolic-link protections, an attacker may alternatively pr ...[truncated 624 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill claims capabilities like session archive loading and realtime memory writes, but those behaviors are not actually implemented in the shown file, while other periodic maintenance behaviors are introduced. Such inconsistencies undermine informed consent and make it difficult to assess what the skill will really do when installed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims capabilities like session archive loading and realtime memory writes, but those behaviors are not actually implemented in the shown file, while other periodic maintenance behaviors are introduced. Such inconsistencies undermine informed consent and make it difficult to assess what the skill will really do when installed.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install.sh (reported line 154)May include surrounding context.

sh

# 安装 cron 任务
crontab /tmp/cron_temp
rm /tmp/cron_temp

echo "✅ cron 任务已配置：每天 ${DAILY_SUMMARY_HOUR}:00 执行每日摘要"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill references shell scripts, cron, and installation commands but does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent or user will run filesystem- and scheduler-modifying actions without clear authorization review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description and all user-facing examples and workflow instructions are written in Chinese, and the documented interaction phrases assume Chinese responses, without offering a language choice or explaining a locale restriction. This can violate language/locale policy where skills should not force a specific language absent opt-in or clear regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill promotes persistent memory management but does not prominently warn that it will read and write long-term files containing user information. Users may disclose sensitive data without understanding that it will be retained across sessions and stored on disk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs persistent collection and summarization of user conversation content, including recent multi-day history and important dialogues, into long-term files. This materially increases privacy risk because sensitive personal, financial, or contextual information could be retained beyond the immediate session and later exposed or misused.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow normalizes confirming 'memory recovery' and immediately storing important user information into persistent memory and daily notes. Even with occasional prompts, the design encourages broad retention of personal context, preferences, tasks, and decisions, which can accumulate into a sensitive behavioral profile.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The cron-based automation creates and updates files in the background, but the description does not present this as a clear operational and privacy warning. Background persistence can surprise users and continue after the original session, increasing risk of unauthorized data retention or unwanted system modification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

检查：

bash

# 查看 cron 任务
crontab -l | grep daily-summary

# 查看执行日志
tail -20 /root/.openclaw/workspace/logs/daily-summary.log

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s user-facing natural-language content, including comments and generated template text, is entirely in Chinese, and the generated note headings will always be created in Chinese. This imposes a specific language/locale without any indication of user choice or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script tells the user it will run a daily summary at the configured hour, but the installed cron entry actually executes daily-summary.sh every minute. This creates unintended continuous execution, which can cause log growth, excess resource consumption, and repeated processing of memory data beyond what the user consented to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Using source "$WORKSPACE/.memory-workflow-config" executes arbitrary shell code from that file in the installer's context. Because this installer operates under /root/.openclaw/workspace, a modified config can run attacker-controlled commands during installation, potentially with root privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The installer persists recurring execution by modifying the user's crontab, causing the skill to continue operating after the initial install. In the context of a memory-management skill that reads/writes conversation summaries, persistence increases the blast radius of any script bug or later tampering because it will run automatically and repeatedly.

Content

Scanner excerpt · scripts/install.sh (reported line 147)May include surrounding context.

sh

DAILY_SUMMARY_HOUR=${DAILY_SUMMARY_HOUR:-23}

# 移除旧的 cron 任务（如果有）
(crontab -l 2>/dev/null | grep -v "memory-workflow" || true) > /tmp/cron_temp

# 添加新的 cron 任务
echo "*/1 * * * * $SCRIPTS_DIR/daily-summary.sh >> $LOGS_DIR/daily-summary.log 2>&1" >> /tmp/cron_temp

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This shell script uses Chinese-only natural-language comments and log/status messages throughout, such as the header comment and runtime log entries. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy concern, especially for operational output that users or maintainers may need to read.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes session loading, daily summaries, and real-time writing to prevent assistant 'forgetfulness', which implies retaining and managing memory rather than purging it. This script removes markdown files older than KEEP_DAYS, a retention/deletion behavior not reflected in the stated description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template headings and placeholder text are entirely in Chinese, which implicitly constrains generated daily notes to a specific language. There is no indication in the file that the user can choose another language or that the template is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Ssd 3

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The examples reinforce a pattern of recording user preferences and generating summaries from conversation history, which normalizes persistent retention of user-supplied data. While demonstrative, this still encourages operators to adopt broad memory capture without enough privacy guardrails.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest's user-facing description is entirely in Chinese and does not indicate any language option or opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation, especially in a general-purpose skill manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This shell script creates marker/timestamp files, later auto-generates a daily note, and removes marker files, but it provides no interactive confirmation or user-visible disclosure beyond internal log writes. For a code file, file creation and deletion operations should have some form of visible warning, comment, or documented disclosure when they affect user workspace data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and all user-visible status messages are in Chinese, with no indication that another language can be selected. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The header comments label this as a 'weekly review script', which suggests some substantive review or summarization of memory content. In practice, the code only deletes old daily notes and appends a review timestamp to MEMORY.md, without performing an actual review operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.