VM Memory Oracle

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 2.0.0

Overview

This is a coherent local memory skill, but it needs review because it installs persistent system cron jobs and weakly scopes sensitive memory storage.

Install only if you want ongoing VM-level memory maintenance. Review or disable the cron setup, restrict /data/memory permissions before storing sensitive session history, confirm retention deletion is acceptable, and keep backups or snapshots before enabling automated consolidation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The security policy acknowledges that the skill writes to `/etc/cron.d/openclaw-vm-memory-oracle`, writes logs under `/var/log/openclaw/`, and deletes backup files, but it presents these as ordinary behavior without clearly flagging that they affect system-wide scheduling, require elevated privileges in many environments, and include destructive retention operations. This is dangerous because reviewers or deployers may underestimate operational risk and grant the skill broader trust than warranted, especially since cron registration can create persistent execution on the host.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs deletion of session files older than 30 days and daily summaries older than 365 days, but it does not clearly warn operators that this is irreversible data deletion. In a persistence-oriented memory skill, silent retention cleanup can cause unexpected loss of forensic history, user context, or operational records if defaults are applied without review.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to install cron jobs that create persistent, recurring system-level behavior by writing under /etc/cron.d, but it does not warn that this modifies host scheduling state beyond the current session. In a VM-hosted agent context, this increases risk because users may unknowingly enable unattended background tasks that continue consuming resources or altering data after the initial invocation.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The example instructs writing a file directly into /data/memory/knowledge-graph/canary-facts.json without warning that it creates or overwrites local data. Although the example is for testing, the lack of notice can lead to accidental modification of a live memory store or confusion about whether existing files will be replaced.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase "summarize sessions" is broad enough to overlap with ordinary user requests and could cause the skill to activate when the user only intends a generic summarization task. Because this skill has filesystem permission and performs maintenance actions, unintended invocation could lead to unexpected reads/writes under the memory data path and accidental modification of persistent state.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrase "summarize sessions" lacks clear scoping to this plugin's memory subsystem and may be invoked by common summarization requests unrelated to memory maintenance. In this context, unintended activation is more concerning because the plugin persists and consolidates local memory, so a false trigger can alter retention artifacts or create misleading summaries without the user's informed intent.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **No binary execution.** This skill does not download or execute binaries.
  The only binary file it manages is the embedding index (`index.bin`), which
  is generated locally from source facts and is never executed.
- **No system modification.** This skill does not modify system configuration
  files, kernel parameters, firewall rules, or user accounts.
- **No container escape.** This skill does not interact with container runtimes,
  Docker sockets, or orchestration APIs.

• Confidence: 72% confidence
• Finding: modify system config

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.