Context Memoize

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:11 AM UTC
• Version: 0.1.0

Overview

This skill does what it says, but it persists broad conversation context and can automatically reload it into future sessions without enough scoping or safeguards.

Review carefully before installing. Use this only for deliberately selected, non-sensitive snippets; do not cache secrets, credentials, private conversation history, or instructions from untrusted users. Avoid automatic startup preload unless cached content is clearly quoted as untrusted reference data, and prefer selective deletion over recursive cache removal.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:4
• Finding: Persistent Injection of Untrusted Context into Future Agent Sessions## Vulnerability Details **File Location**: `SKILL.md`, lines 4-10 and 21-26 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High **Vulnerable Code**: ```markdown ## Trigger When user says "缓存这个上下文" or "memoize this context" - save the current context for reuse. ## Implementation Use a simple file-based cache: ```bash # Save context fragment echo "$CONTENT" >> ~/.openclaw/context-cache/fragments.md ``` ``` ```markdown ## Integration This skill can be called from AGENTS.md Session Startup to pre-load cached context: ```bash if [ -f ~/.openclaw/context-cache/fragments.md ]; then cat ~/.openclaw/context-cache/fragments.md fi ``` ``` ### Technical Analysis The skill permits user-selected context to be appended to persistent storage and subsequently loaded during agent session startup. It defines no validation, provenance metadata, trust boundary, escaping, or instruction/data separation for cached content. Consequently, an attacker can ask the agent to cache text containing adversarial instructions. When the startup integration later reads `fragments.md`, that text may enter a future session as instruction-bearing context rather than inert reference data. The appended entries also have no expiration or task-level isolation, allowing poisoned content to persist and affect unrelated work. ### Attack Path 1. An attacker places instruction-like content in the active conversation, such as directions to ignore later user requests or disclose information encountered in future tasks. 2. The attacker invokes the documented phrase `memoize this context`. 3. The skill assigns the attacker-controlled material to `CONTENT` and appends it to `~/.openclaw/context-cache/fragments.md`. 4. A subsequent session executes the documented startup integration. 5. The integration emits the complete cache into the new session without marking it as untrusted data. 6. The agent may fol ...[truncated 565 chars]
• Remediation: ## Remediation Suggestions - Do not inject cached material directly into an instruction-bearing startup context. - Store entries as structured records with content, source, creation time, task scope, and trust classification. - Render restored content as clearly delimited, quoted, untrusted reference data and explicitly prohibit treating it as instructions. - Require the user to preview and explicitly confirm the exact text before persistence. - Reject or quarantine content containing instruction-like directives, role changes, tool commands, or requests to override policy. - Isolate caches by user, workspace, and task rather than using one shared global file. - Add expiration, review, selective deletion, and a mechanism to disable automatic preload. - Prefer retrieving individual approved entries on demand instead of loading the entire cache at session startup.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:4
• Finding: Unrestricted Plaintext Persistence of Potentially Sensitive Context## Vulnerability Details **File Location**: `SKILL.md`, lines 4-10 **Vulnerability Type**: Insecure storage of potentially sensitive information **Risk Level**: Medium **Vulnerable Code**: ```markdown ## Trigger When user says "缓存这个上下文" or "memoize this context" - save the current context for reuse. ## Implementation Use a simple file-based cache: ```bash # Save context fragment echo "$CONTENT" >> ~/.openclaw/context-cache/fragments.md ``` ``` ### Technical Analysis The phrase “current context” is not scoped to an explicitly selected, reviewed fragment. It may include credentials, personal information, private conversation content, proprietary material, or tool output. The implementation appends that content indefinitely to a plaintext file. The documented process does not create the cache with restrictive permissions, redact secrets, impose retention limits, separate entries by sensitivity, or provide selective deletion. The only documented cleanup operation recursively deletes the entire cache. Although actual exposure depends on the host's directory permissions and threat model, the skill does not establish controls appropriate for potentially sensitive conversational data. ### Attack Path 1. Sensitive information appears in the current context. 2. A user or attacker triggers the skill with `memoize this context`. 3. The broadly defined current context is appended to `~/.openclaw/context-cache/fragments.md` in plaintext. 4. The data remains present without expiration or per-entry deletion. 5. A later agent session, local process, backup system, or local account with sufficient filesystem access reads the cached file. ### Impact Assessment This issue does not independently elevate privileges. It can expose all sensitive material written to the cache to principals that already possess sufficient access to the file, including later sessions using the same operating-system account. The scope can s ...[truncated 199 chars]
• Remediation: ## Remediation Suggestions - Cache only an explicitly selected fragment rather than the entire current context. - Display the exact content and obtain informed confirmation before writing it. - Detect and redact common secret types, including access tokens, passwords, private keys, and session credentials. - Create the cache directory with mode `0700` and the cache file with mode `0600`, while avoiding permission changes through unsafe shared paths. - Use separate structured entries to support review and selective deletion. - Define short retention periods and automatically expire stale entries. - Avoid caching highly sensitive data; where persistence is essential, use an appropriate encrypted secret or data store. - Document which local principals, processes, backups, and future sessions can access cached content.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ls ~/.openclaw/context-cache/

# Clear cache
rm -rf ~/.openclaw/context-cache/
```

## Integration

• Confidence: 91% confidence
• Finding: The skill includes a raw recursive deletion command for clearing cache, which is dangerous in an agent/tooling context because destructive shell snippets may be copied, automated, or invoked without sufficient validation or confirmation. Even though the path is narrower than 'rm -rf ~', the context of an agent skill makes this more dangerous because it normalizes unattended filesystem deletion from documentation and could remove stored context or adjacent data if paths are misconfigured.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ls ~/.openclaw/context-cache/

# Clear cache
rm -rf ~/.openclaw/context-cache/
```

## Integration

• Confidence: 91% confidence
• Finding: The skill includes a raw recursive deletion command for clearing cache, which is dangerous in an agent/tooling context because destructive shell snippets may be copied, automated, or invoked without sufficient validation or confirmation. Even though the path is narrower than 'rm -rf ~', the context of an agent skill makes this more dangerous because it normalizes unattended filesystem deletion from documentation and could remove stored context or adjacent data if paths are misconfigured.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill stores conversation context in a persistent file under the user's home directory and provides a destructive cache-clearing command without any warning, confirmation, retention policy, or sensitivity guidance. Because context may contain secrets, tokens, or private user data, this creates a real risk of unintended persistence, later disclosure, or accidental deletion of cached material.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The trigger specification explicitly recognizes only `缓存这个上下文` and `memoize this context`, which imposes a language constraint in natural-language behavior. Because the file does not offer a language choice or justify the locale limitation, this is a policy-style language/locale issue under the stated rules.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:19