T03 · Remote Payload Retrieval and Execution
Error
- Location
references/platform-guide.md:53- Finding
Remote Installation Scripts Are Piped Directly into Privileged Shells
- Content
View full analysis
- Remediation
View remediation
Security audit
Project Trident
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is purpose-aligned but needs review because it persistently stores broad conversation history and can automatically route, index, or back up sensitive memory with limited safeguards.
Install only if you are comfortable with an agent retaining long-term memory about conversations, identity, preferences, projects, and decisions. Keep the initial setup local-only, avoid optional cloud/vector indexing until you have an allowlist and secret redaction, replace unattended git add -A backups with reviewed or encrypted backups to a private repository, and do not run the curl-to-shell or unpinned binary setup commands without independent verification.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/deployment-guide.md:84- Finding
Unverified Mutable Native Binaries, Modules, and Container Images Are Executed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/deployment-guide.md:153- Finding
Semantic Indexing Submits All Workspace Markdown Files to OpenAI
- Content
View full analysis
list[float]: resp = openai.embeddings.create(input=text, model=EMBED_MODEL) return resp.data[0].embedding def ensure_collection(): existing = [c.name for c in qdrant.get_collections().collections] if COLLECTION not in existing: qdrant.create_collection( COLLECTION, vectors_config=VectorParams(size=1536, distance=Distance.COSINE) ) def index_memory_file(path: pathlib.Path): text = path.read_text() chunks = [text[i:i+500] for i in range(0, len(text), 400)] for i, chunk in enumerate(chunks): chunk_id = hashlib.sha256(f"{path}:{i}".encode()).hexdigest() point_id = int(chunk_id[:8], 16) qdrant.upsert(COLLECTION, points=[ PointStruct( id=point_id, vector=embed(chunk), payload={"text": chunk, "source": str(path), "chunk": i} ) ]) if __name__ == "__main__": ensure_collection() for md_file in WORKSPACE.rglob("*.md"): if "migration-backup" not in str(md_file): index_memory_file(md_file) print(f"Indexed {len(list(WORKSPACE.rglob('*.md')))} memory files.") ``` ### Technical Analysis `WORKSPACE.rglob("*.md")` recursively selects every Markdown file under the OpenClaw workspace. The only exclusion is a path containing `migration ...[truncated 1389 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/deployment-guide.md:263- Finding
Automated Git Backup Can Publish Persistent Memory Without Review
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
scripts/layer0-agent-prompt-template.md:85- Finding
Recurring Signal Router Can Persist Prompt-Injection Content into Long-Term Memory
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/platform-guide.md:53- Finding
Docker Group Membership Grants Root-Equivalent Host Capabilities
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/template-integrity-check.sh:85- Finding
Local Mutable Checksum Is Misrepresented as Prompt-Injection Prevention
- Content
View full analysis
"$APPROVED_HASH_FILE" success "Approved hash: $CURRENT_HASH" success "Stored at: $APPROVED_HASH_FILE" mkdir -p "$(dirname "$AUDIT_LOG")" echo "## [$TIMESTAMP] HASH APPROVED" >> "$AUDIT_LOG" echo "- Hash: \`$CURRENT_HASH\`" >> "$AUDIT_LOG" echo "- File: $PROMPT_FILE" >> "$AUDIT_LOG" echo "- Action: User explicitly approved this template version" >> "$AUDIT_LOG" echo "" >> "$AUDIT_LOG" exit 0 fi ``` ```bash if [[ -n "$APPROVED_HASH" && "$CURRENT_HASH" == "$APPROVED_HASH" ]]; then STATUS="approved" VERDICT="PASS — Matches user-approved hash" elif [[ -n "$CANONICAL_HASH" && "$CURRENT_HASH" == "$CANONICAL_HASH" ]]; then STATUS="canonical" VERDICT="PASS — Matches canonical template (unmodified)" elif [[ -z "$APPROVED_HASH" && -z "$CANONICAL_HASH" ]]; then STATUS="unverified" VERDICT="WARN — No baseline hash available. Run --approve to register current template." else STATUS="mismatch" VERDICT="FAIL — Hash mismatch detected. Template may have been tampered with." fi ``` The `unverified` status later exits successfully: ```bash exit 0 # Don't block on first run ``` The README states: ```markdown **Security:** SHA256 integrity verification prevents prompt injection ``` ### Technical Analysis The prompt, checker script, canonical template, and approved-hash file reside in the same local trust boundary. An attacker capable of modifying the installed prompt may also be capable of changing the approval hash, canonical template, or checker. `--approve` accepts the current file without authenticating its ...[truncated 1196 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (43)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The advertised purpose focuses on persistent memory, but the skill also introduces integrity enforcement, approval workflows, audit logging, and failure/halting behavior. This mismatch can mislead users about operational side effects and authority, causing them to enable a skill that performs more control and security-sensitive functions than disclosed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill strongly promotes persistent storage of conversations, preferences, identity, and continuity, but does not present a clear up-front warning that sensitive user data may be retained across logs, markdown memory files, backups, and possibly remote repositories. This undermines informed consent and can expose personal, confidential, or regulated data to long-term retention and replication.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
-
Memory corrupted → restore from Git:
bash git log --oneline # Find last good commit git reset --hard <commit> # Restore -
Deployment broken → restore VPS snapshot:
-
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
memory/daily/ SESSION-STATE.md *.migrated .env
text **Daily backup cron (via OpenClaw):**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash cp ~/.openclaw/lcm.db ~/.openclaw/lcm.db.backup-$(date +%Y%m%d) rm ~/.openclaw/lcm.db # Restart OpenClaw gateway (recreates clean database)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The '| sh' pattern is dangerous because it chains retrieval and execution into a single step, preventing meaningful review and making accidental arbitrary-code execution trivial. In documentation consumed by users setting up an agent platform, this pattern increases the chance of blind trust and exploitation through compromised distribution channels.
- Content
Docker (Optional — Semantic Recall Only)
bash # Install Docker curl -fsSL https://get.docker.com | sh sudo usermod -aG docker $USER newgrp docker
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
This command executes a remote install script from ollama.com directly via the shell, creating a direct arbitrary-code-execution path if the script, hosting infrastructure, TLS trust chain, or DNS path is compromised. Because the file is operational guidance for setting up a persistent agent stack, the likelihood of users running it uncritically is elevated.
- Content
Ollama (Optional — Zero-Cost Layer 0.5)
bash curl -fsSL https://ollama.com/install.sh | sh ollama pull qwen2.5:7b
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
This one-liner combines remote content retrieval and execution, making it easy for a network or upstream compromise to translate immediately into code execution on the host. The optional nature of the feature does not reduce the severity of the unsafe execution pattern itself.
- Content
Ollama (Optional — Zero-Cost Layer 0.5)
bash curl -fsSL https://ollama.com/install.sh | sh ollama pull qwen2.5:7b
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Using '| bash' with a GitHub-hosted installer is still a chaining abuse pattern because it eliminates inspection and provenance validation before execution. Even trusted upstreams can be compromised, and shell-piped installers normalize unsafe operator behavior.
- Content
Install Node.js (if needed)
bash # Option A: nvm curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash nvm install 22 nvm use 22
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
On a VPS, a '| sh' installer creates a direct path from remote content delivery failure to server compromise. Because the surrounding section also enables long-lived services, successful exploitation could produce durable host-level impact.
- Content
Docker on VPS
bash curl -fsSL https://get.docker.com | sh usermod -aG docker $USER systemctl enable docker systemctl start docker
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes capturing every message and preserving long-term memory, but it does not pair that behavior with a clear privacy notice, retention policy, or guidance on handling secrets and personal data. In an agent skill context, users may unknowingly persist sensitive conversations, credentials, or regulated data into local files and backups.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Encouraging comprehensive capture of all messages and durable storage in human-readable memory artifacts materially increases the chance that sensitive natural-language data is retained and later exposed. Even if intended as a feature, broad persistence expands the blast radius of any local compromise, accidental commit, or later sharing of the memory directory.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The architecture instructs the agent to write critical facts before responding and continuously route raw logs into persistent buckets, which operationalizes ongoing collection of conversational data. In practice, this can capture secrets, private user details, or internal system outputs without contextual consent or minimization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README describes automated Git backups and optional cloud-hosted components without clearly warning that conversation-derived memory may leave the local machine. This can cause unintentional exfiltration of sensitive data to third-party services or remote repositories if users enable backups or semantic recall services.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README recommends storing identity, beliefs, projects, lessons, and daily logs in readable files and then backing them up with Git, which can aggregate highly sensitive conversation-derived data into easily inspectable artifacts. This is especially risky because such files are simple to copy, accidentally commit, or expose through repository misconfiguration.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes shell-capable setup, cron, chmod, git, and restore operations but does not declare an explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity where an agent may invoke shell actions beyond what a user expects, especially in a persistence-oriented skill that touches logs, backups, and filesystem state.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The architecture encourages broad retention of user-provided content across SQLite logs, curated memory files, heartbeat tracking, and backups. Because the skill is specifically designed for continuity and identity persistence, the context makes this more dangerous: it normalizes long-lived storage and cross-layer replication of sensitive conversation data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Daily Git backup guidance would replicate accumulated memory content to external hosting, extending the exposure surface from local storage to remote repositories and provider infrastructure. In a skill that stores identity, preferences, decisions, and daily logs, remote replication materially increases the risk of privacy breaches, accidental publication, and unauthorized access.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The Security section states 'Network isolation: Layer 0.5 cron has no external network requirements,' but elsewhere the skill describes Layer 0.5 using Claude Haiku on a recurring basis and Layer 2 pushing backups to GitHub/GitLab. That creates an intent-level contradiction in the documentation because the file presents network-free operation as a security property while also describing network-dependent deployments and integrations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The WAL protocol explicitly instructs the agent to write important user facts before responding, including preferences, names, dates, URLs, and decisions. This creates a systematic capture pipeline for potentially sensitive content before the user can assess or opt out, increasing privacy risk and making accidental retention highly likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The WAL triggers are broad enough to capture ordinary conversation content such as names, preferences, dates, URLs, and decisions with little contextual limitation. In a memory skill, that ambiguity increases the risk of over-collection, silent retention of sensitive data, and persistence of information users did not realize would be logged.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 72% confidence
- Finding
The cloud-service instructions direct users to create hosted semantic-memory infrastructure and use an API key, but they do not warn that user messages and long-term memory content may be transmitted to third-party services and persist outside the local environment. In a memory skill, this materially increases privacy risk because the stored content is likely to include sensitive personal, behavioral, or project data across sessions.
- Content
md ### Option C: Cloud Services (Zero Local Infrastructure) **Qdrant Cloud:** 1. Create free account at https://qdrant.tech (1GB cluster free) 2. Create cluster → get API key + cluster URL 3. Use in embedding script: `client = QdrantClient(url="...", api_key="...")`
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The guide promotes persistent storage and Git-based backup of agent memory, identity, and session-related artifacts, which creates long-lived retention of potentially sensitive conversational data. In the context of a persistent-memory skill, this is more dangerous than ordinary documentation because the entire purpose is to preserve user and agent state across sessions, increasing the chance of over-retention and unintended disclosure.
- Content
git remote add origin git@github.com:yourusername/yourrepo-memory.git
text **Create `.gitignore`** (protect private files): ```gitignore SOUL.md USER.md
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide instructs users to automate
git add -A && git commit && git pushover the entire workspace, which can exfiltrate sensitive memory, prompts, tokens, or private notes if.gitignoreis incomplete, misapplied, or later changed. Because this runs unattended on a schedule, a single mistake can repeatedly publish newly created sensitive files to a remote repository without the user noticing.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file provides commands that create files and directories, modify prompt templates, install Docker via a remote script, and alter user group membership, but it does not include a user-facing warning about system changes or the risks of running those commands. Under the markdown-file criteria for SQP-2, documentation should warn when behaviors may affect user data, privacy, or system integrity.
- Content
Static analysis
No suspicious patterns detected.