VM Memory Oracle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:15 AM UTC
• Version: 2.0.0

Overview

This skill is not clearly malicious, but it needs Review because it stores persistent agent memory and sets up system cron jobs outside its declared filesystem scope.

Review this carefully before installing on a shared or production VM. Use a dedicated unprivileged account, restrict /data/memory permissions, verify exactly what cron file is installed and which user runs it, and avoid storing raw session logs or sensitive data unless users explicitly consent and have a deletion path.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:232
• Finding: System-Level Persistence Through Automatically Registered Cron Jobs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:232-247`, `openclaw.plugin.json:48-50`, `examples/vm-cloud-init.yaml:47-54`, `SECURITY.md:38-49` **Vulnerability Type**: Persistent scheduled execution outside the declared filesystem scope **Risk Level**: Critical ### Vulnerable Code `SKILL.md:232-247`: ```text ## Cron Schedule (for VM deployments) Set up these cron jobs for automated lifecycle management: # Daily summarization at 23:00 0 23 * * * openclaw skill run vm-memory-oracle --action summarize # Full consolidation at 00:30 30 0 * * * openclaw skill run vm-memory-oracle --action consolidate # Health check every 6 hours 0 */6 * * * openclaw skill run vm-memory-oracle --action health-check # Quality probe every Sunday at 03:00 0 3 * * 0 openclaw skill run vm-memory-oracle --action quality-probe ``` `openclaw.plugin.json:48-50`: ```json "install-cron": { "description": "Register cron jobs for automated memory lifecycle management" } ``` `examples/vm-cloud-init.yaml:47-54`: ```yaml # Create log directory - mkdir -p /var/log/openclaw # Install the skill (adjust to your installation method) - openclaw skill install vm-memory-oracle # Set up automated cron jobs - openclaw skill run vm-memory-oracle --action install-cron ``` `SECURITY.md:38-49` confirms the affected system paths: ```text ## Filesystem Scope All file operations are confined to: | Path | Operations | Purpose | |---|---|---| | `{data_path}/` | Read, Write, Create | Memory data storage | | `{data_path}/backups/` | Write, Delete | Pre-maintenance backups (7-day retention) | | `/etc/cron.d/openclaw-vm-memory-oracle` | Write | Cron job registration | | `/var/log/openclaw/` | Write | Log output from cron jobs | No other paths are accessed. ``` ### Technical Analysis The Skill defines an `install-cron` action that writes a system cron definition under `/etc/cron.d/openclaw-vm-memory-oracle`. The resulting jobs invoke the Skill repeatedly and survive the original Skill ...[truncated 2450 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic invocation of `install-cron` from cloud-init. Require a separate, explicit administrator deployment step. 2. Prefer a user-scoped systemd timer or user crontab running under a dedicated, unprivileged OpenClaw service account. 3. If system cron is essential, ship the exact cron-generation implementation for review and document the required privilege boundary accurately. 4. Pin the absolute OpenClaw executable path, Skill installation path, and Skill version in scheduled commands. 5. Ensure the cron file is owned by root, is not writable by the service account, and has restrictive permissions such as `0644`. 6. Avoid mutable or user-controlled `PATH`, working directories, environment variables, and executable lookup locations in scheduled jobs. 7. Update the manifest to declare all actual filesystem targets, including `/etc/cron.d/openclaw-vm-memory-oracle` and `/var/log/openclaw`. 8. Document the exact user under which each scheduled job executes and ensure it has access only to the configured memory directory. 9. Provide an uninstall action that safely removes the scheduler entry and related log configuration. 10. Consider requiring an integrity-verified, version-pinned Skill package before every scheduled invocation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/vm-cloud-init.yaml:33
• Finding: Persistent Agent Memory Is Exposed Through Overly Broad Filesystem Permissions<![CDATA[ ## Vulnerability Details **File Location**: `examples/vm-cloud-init.yaml:33-45` **Vulnerability Type**: Excessive local read permissions on persistent session and memory data **Risk Level**: Medium ### Vulnerable Code `examples/vm-cloud-init.yaml:33-45`: ```yaml runcmd: # Create directory structure if this is a fresh disk - mkdir -p /data/memory/knowledge-graph - mkdir -p /data/memory/embeddings - mkdir -p /data/memory/daily - mkdir -p /data/memory/sessions - mkdir -p /data/memory/backups - chmod -R 755 /data/memory # Initialize default files if they don't exist - test -f /data/memory/activation-metadata.json || echo '{}' > /data/memory/activation-metadata.json - test -f /data/memory/MEMORY.md || echo '# Agent Memory' > /data/memory/MEMORY.md - test -f /data/memory/health.json || echo '{"status":"uninitialized"}' > /data/memory/health.json ``` The data stored under this hierarchy is described in `SKILL.md:127-138`: ```text 1. Read all session files from `sessions/` for the current date. 2. Extract key facts, decisions, preferences, and action items. 3. Write a structured summary to `daily/YYYY-MM-DD.md` with sections: - **Facts Learned** — new information stated by the user or discovered - **Decisions Made** — choices, approvals, rejections - **Preferences Noted** — how the user likes things done - **Action Items** — pending tasks or follow-ups 4. For each fact in the summary, ensure it exists in the knowledge graph. ``` ### Technical Analysis The recursive `chmod -R 755 /data/memory` applies world-readable and world-traversable permissions throughout the persistent memory hierarchy. It also applies executable permission bits indiscriminately to regular files already present on the mounted disk. Files subsequently created by root with a typical `022` umask will commonly receive mode `0644`, making them readable by every local account. The affected hierarchy is designed to contain raw session logs, user-stated ...[truncated 1500 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a dedicated OpenClaw service user and group. 2. Set a restrictive creation mask before creating memory files: ```sh umask 077 ``` 3. Create the root directory with explicit ownership and permissions: ```sh install -d -m 0700 -o openclaw -g openclaw /data/memory install -d -m 0700 -o openclaw -g openclaw \ /data/memory/knowledge-graph \ /data/memory/embeddings \ /data/memory/daily \ /data/memory/sessions \ /data/memory/backups ``` 4. Correct existing permissions without adding executable bits to regular files: ```sh chown -R openclaw:openclaw /data/memory find /data/memory -type d -exec chmod 0700 {} + find /data/memory -type f -exec chmod 0600 {} + ``` 5. Run all memory-management jobs under the dedicated unprivileged account. 6. If controlled group sharing is required, use `0750` for directories and `0640` for files with a narrowly scoped group rather than global read access. 7. Apply equivalent restrictive permissions to backups and the mounted disk after every redeployment. 8. Add smoke tests that fail when memory files are readable or writable by unauthorized users. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Credential Access

High

• Category: Privilege Escalation

Content

Production-grade memory persistence and lifecycle management for VM-hosted OpenClaw agents.

You are a memory management specialist. Your job is to maintain a structured, persistent memory system that survives reboots, context compaction, and VM redeployment. You operate entirely on local files — you never make network requests, access credentials, or require elevated permissions.

## Memory Architecture

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says this skill is fully local with zero network calls and zero cloud dependencies, but this file documents deploying it across Azure VMs with Terraform, Azure CLI operations, backup vaults, snapshots, and remote run-command execution. That is a material expansion from local-only memory management into cloud infrastructure and remote orchestration behavior.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

|---|---|
| Network access | None. Zero outbound connections. |
| Credentials | Never read, written, or transmitted. |
| Privilege escalation | Never uses sudo or su. |
| Write behavior | Append-only for facts. Archival instead of deletion. |
| Idempotency | All operations safe to retry. |
| Transparency | All files human-readable (JSONL, Markdown, JSON). |

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **No binary execution.** This skill does not download or execute binaries.
  The only binary file it manages is the embedding index (`index.bin`), which
  is generated locally from source facts and is never executed.
- **No system modification.** This skill does not modify system configuration
  files, kernel parameters, firewall rules, or user accounts.
- **No container escape.** This skill does not interact with container runtimes,
  Docker sockets, or orchestration APIs.

• Confidence: 90% confidence
• Finding: The file claims there is 'no system modification,' yet the documented filesystem scope includes writing to /etc/cron.d/openclaw-vm-memory-oracle. Managing files under /etc/cron.d typically requires root-equivalent privileges and establishes scheduled persistence, so the stated privilege and system-modification boundaries are understated.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The security documentation contains a material contradiction: it claims the skill performs 'no system modification' while also declaring that it writes a cron file under /etc/cron.d/openclaw-vm-memory-oracle. Writing to /etc/cron.d is a system-level configuration change that can create persistent code execution on a schedule, so inaccurate documentation may cause reviewers or operators to underestimate the skill's required privileges and persistence behavior.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The directory layout mandates storing raw session logs persistently under sessions/, which can capture entire user interactions rather than narrowly scoped memory artifacts. This broad collection increases exposure of confidential prompts, personal data, and operational details, especially because later summarization and consolidation steps further copy that data into additional long-lived stores.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs persistent retention, summarization, and reuse of user-provided session content in daily summaries, MEMORY.md, and the knowledge graph. Even without network access, this creates a privacy and data-minimization risk because sensitive personal, business, or regulated information may be stored long-term and propagated across multiple files without consent filtering or content classification.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The stated purpose is memory persistence and lifecycle management for VM-hosted agents, but this file adds capabilities for provisioning Azure disks/VMs, defining backup policies, and invoking commands across a fleet. Those are infrastructure automation and fleet administration capabilities, not direct or obvious requirements of a local memory oracle skill as described.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to install cron jobs that create persistent automated system tasks under /etc/cron.d without any warning about the persistence, privilege implications, or how to remove them. In a VM-hosted agent context, silently normalizing scheduled background execution increases the risk of unintended ongoing processing, resource consumption, and persistence that survives the initiating session.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase "memory maintenance" is broad enough to overlap with ordinary operational requests, which can cause the skill to activate when the user did not explicitly intend to invoke lifecycle-management behavior. In a filesystem-capable skill, unintended activation increases the chance of unplanned reads/writes under the configured data path and may result in accidental maintenance actions being run.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase "initialize memory" lacks specificity and could match normal conversational requests about memory setup rather than an intentional request to invoke this particular skill. Because the skill has filesystem permission and an init action that creates directory structures and files, accidental activation could modify persistent state unexpectedly.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase "summarize sessions" is too generic and may collide with routine requests to summarize prior interactions, causing the memory skill to run instead of a harmless summarization flow. In this skill's context, that could lead to persistence of session-derived data or file updates without clear user intent, making the broad trigger more dangerous than in a read-only tool.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

transmits API keys, tokens, passwords, SSH keys, wallet keys, browser cookies,
  session tokens, or any other authentication material.
- **No privilege escalation.** This skill never uses `sudo`, `su`, `pkexec`,
  `doas`, or any other mechanism to elevate privileges.
- **No code obfuscation.** All logic is in plain Markdown instructions and
  shell scripts. No Base64-encoded payloads, hex-encoded commands, string
  concatenation tricks, eval(), or dynamic code generation.

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The example tells users to write canary test data directly into the persistent memory store under /data/memory/knowledge-graph/ without clearly stating that this modifies long-lived skill data. While the inserted data is only test content, it can pollute production memory, affect later retrieval behavior, and mislead operators if they assume the procedure is read-only validation.

Static analysis

No suspicious patterns detected.