Forget Something

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:59 AM UTC
• Version: 0.1.0

Overview

This skill is coherent documentation for AI memory forgetting, but its examples include automatic and potentially destructive memory deletion without enforcing the safeguards it advertises.

Review this carefully before installing or using it as implementation guidance. The skill is not trying to hide unrelated behavior, but its sample forgetting mechanism can schedule broad memory deletion and even clear all memories without enforced confirmation, backup, dry-run, or authorization checks. Treat the code as a rough sketch only, and add real deletion APIs, scoped approvals, audit logs, tested backups, and rollback behavior before using it with production or sensitive memory stores.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:141

Finding

Declared Dry-Run and Backup Controls Are Not Enforced Before Destructive Forgetting Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 141–216; destructive strategy implementations at lines 239–265
Vulnerability Type: Missing enforcement of destructive-operation safeguards
Risk Level: Medium

The skill declares dryRun and backupBeforeForgetting configuration options:

javascript

const forgettingConfig = {
  strategies: [
    {
      type: "time-based",
      days: 30,
      enabled: true
    },
    {
      type: "relevance-based",
      threshold: 0.3,
      enabled: true
    },
    {
      type: "frequency-based",
      minAccessCount: 2,
      enabled: true
    }
  ],
  runInterval: "daily",
  dryRun: false,
  backupBeforeForgetting: true
};

However, the scheduled execution path applies every enabled strategy without checking either safeguard:

javascript

setupScheduler() {
  const interval = this.config.runInterval || "daily";
  const cronExpression = this.getCronExpression(interval);

  this.agent.scheduler.addJob({
    name: "forgetting-mechanism",
    cron: cronExpression,
    task: () => this.runForgetting()
  });
},

async runForgetting() {
  this.agent.logger.info("Running forgetting mechanism...");

  const originalCount = this.memoryStore.size;

  this.config.strategies?.forEach(strategy => {
    if (strategy.enabled) {
      this.applyStrategy(strategy);
    }
  });

  const finalCount = this.memoryStore.size;
  const removedCount = originalCount - finalCount;

  this.agent.logger.info(`Forgetting mechanism completed: Removed ${removedCount} memories`);

  return {
    originalCount,
    finalCount,
    removedCount
  };
},

The invoked strategy methods directly request filtering or clearing of the memory store:

javascript

forgetTimeBased(days = 30) {
  const cutoffTime = Date.now() - (days * 24 * 60 * 60 * 1000);
  this.memoryStore.filter(memory => memory.timestamp >
...[truncated 3191 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce dry-run behavior centrally in runForgetting(). Compute an immutable deletion plan and return the candidate record identifiers and counts without modifying the memory store.
2. When backupBeforeForgetting is enabled, create a complete backup before applying any strategy. Verify that the backup is readable, complete, and durably stored before proceeding.
3. Abort the operation if backup creation or verification fails. Do not silently continue with deletion.
4. Execute deletion transactionally where the storage backend permits it. Roll back all changes if any strategy fails.
5. Require explicit authorization and interactive confirmation for forgetAll() and other broad deletion operations. Scheduled jobs should not be permitted to invoke unrestricted clearing by default.
6. Validate strategy parameters, including finite non-negative retention periods, bounded relevance thresholds, valid access counts, and non-null context structures.
7. Record an audit event containing the initiating identity, configuration, dry-run status, backup identifier, affected-record count, and final outcome. Avoid logging sensitive memory content.
8. Add tests proving that dry-run mode performs no mutation, backups are created before deletion, backup failures prevent deletion, scheduled execution honors all safeguards, and forgetAll() cannot run without the required authorization.
9. Ensure the documentation describes only implemented controls and clearly states the storage adapter semantics expected from memoryStore.filter().

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The advertised OpenClaw forgetting mechanism reports counts and schedules deletion runs, but its strategy methods only invoke filter() and discard the result, so no forgetting occurs. This creates a high-risk privacy and compliance failure: users may rely on automated deletion for sensitive data retention, right-to-be-forgotten requests, or storage control, while the data is silently kept.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README provides broad activation prompts for implementing and triggering memory deletion without clear scope limits, authorization requirements, or exclusion examples. In a skill that can remove stored memories, vague prompts can lead an agent or user to apply destructive forgetting actions too broadly, increasing the risk of unintended data loss or privacy-impacting deletions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill repeatedly discusses removing memories and exposing forgetting via schedulers, APIs, and user interfaces, but it lacks a prominent warning that these operations may be irreversible and can cause destructive data loss. In this context, users may underestimate the operational risk and deploy deletion behavior into production without adequate safeguards, backups, or approval flows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill when working with long-term AI systems, memory management, or privacy-preserving AI, which are broad themes rather than specific invocation conditions. It does not define explicit trigger phrases, scope limits, or negative examples, so the skill could be invoked in many ordinary contexts involving AI or privacy discussions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples claim to delete or forget memories, but they only call Array.filter() without assigning the result back to the store or otherwise mutating it. In a privacy-preserving forgetting skill, this mismatch is dangerous because operators may believe sensitive or outdated data was removed when it remains retained and potentially accessible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill introduces destructive forgetting capabilities without a prominent user-facing warning, confirmation model, or clear statement that data deletion may be irreversible. In the context of memory management and privacy, ambiguous deletion UX can cause accidental loss of important records or unsafe invocation of bulk-delete behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.