T02 · Agent Memory Poisoning
Warning
- Location
scripts/memory_manager.py:153- Finding
Untrusted Daily Memory Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Long-Term Memory Manager
Security checks for vulnerabilities and agentic risk
Overview
This memory-management skill is coherent and not malicious, but it can persist sensitive conversation and credential-related details into long-term files without review or filtering.
Install only if you are comfortable with this skill reading, rewriting, searching, and archiving your OpenClaw memory files. Do not store passwords, tokens, recovery codes, OAuth URLs, or sensitive account details in daily memory files, and review extracted facts before using consolidation or automation.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory_manager.py:154- Finding
Credential and Account Values May Be Persisted in Plaintext Long-Term Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill clearly describes file-reading and file-writing behavior against MEMORY.md, daily memory files, and archive directories, but it does not declare any explicit tool scope or permissions. That mismatch increases the chance of unintended file access or modification because consumers of the skill are not clearly warned what capabilities it requires.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes the broad term '归档', which can match many unrelated user requests and cause the memory-management skill to activate unexpectedly. In a skill that performs persistent file updates and archival operations, overbroad invocation raises the risk of accidental retention, modification, or movement of user data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section normalizes storing long-term user profile details, conversation-derived facts, and even 'credentials locations' in persistent memory. Even if raw secrets are not stored, recording credential locations and other sensitive profile data creates a durable map of sensitive assets that could aid misuse, unauthorized access, or privacy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The consolidation workflow instructs automatic review, update, and archival of memory files but does not present a clear warning that these operations mutate persistent storage. Users may not realize that invoking consolidation can rewrite MEMORY.md and archive source files, creating integrity and transparency risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The consolidation workflow explicitly tells the system to extract 'key facts from conversations' into long-term memory without requiring sensitivity screening, minimization, or user consent. Because conversations often contain personal, confidential, or security-relevant details, indiscriminate extraction can convert ephemeral disclosures into persistent and searchable records.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The daily memory guidance encourages logging important conversations, decisions, and future-reference context, which can lead to broad retention of user-provided information beyond what is necessary. In a persistent memory system, this increases privacy risk because raw daily logs may contain sensitive material before later consolidation or archival.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The vector-memory integration section instructs syncing extracted memory content into an additional storage system without a privacy warning or consent boundary. Propagating retained user facts into semantic-search infrastructure broadens exposure, complicates deletion, and increases the blast radius of any sensitive data captured earlier.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Archiving plus syncing extracted user facts to vector memory expands retention across multiple storage layers, making sensitive information harder to track, delete, and protect. This propagation materially increases exposure because compromise or misuse of any one storage system can reveal durable user context collected from conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The consolidation flow automatically extracts and persists user facts from daily notes into MEMORY.md, including strings matched as account or credential information, with no consent gate, sensitivity filtering, or warning. In a long-term memory skill, this increases retention and discoverability of sensitive data beyond the original context, which can amplify privacy harm if the memory store is later exposed or searched.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language extraction logic only recognizes specific Chinese and English keywords such as '决策', 'Decision', '偏好', and 'prefer'. This embeds a language/locale constraint in the skill behavior without user opt-in or clear documentation, which can violate language policy expectations for neutral or user-selectable locale handling.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The extractor explicitly matches markers like account/credential and stores the captured content in Important Facts, after which it becomes searchable and durable in MEMORY.md and archives. In a long-term memory system, intentional retention of secrets materially increases the blast radius of any later compromise, accidental sharing, or agent misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code performs a file-moving operation that changes where user memory files are stored, which can affect data handling and user expectations. While archiving is part of the tool's purpose, the implementation lacks any user-facing disclosure at the point of action about which files will be relocated or that this is an irreversible organizational change for the source path.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
generate_summary() accepts an arbitrary output_file and writes to Path(output_file) without restricting the destination to the workspace or prompting for confirmation. In an agent/tooling context, a caller could overwrite user-accessible files outside the intended memory area, causing data loss or unauthorized modification of local files.
- Content
Static analysis
No suspicious patterns detected.