Proactive Memory Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:52 AM UTC
• Version: 1.0.1

Overview

This is a memory-management skill, but it broadly records and archives conversations and can reset workspace memory files without enough consent, retention, or recovery safeguards.

Install only if you intentionally want persistent workspace memory and are comfortable with conversation details, preferences, IDs, URLs, and error context being stored in plaintext. Avoid using it around secrets or confidential data unless you add redaction, explicit opt-in, retention limits, deletion procedures, and backups before running init.sh or tiering.sh.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:86

Finding

Mandatory Response-Flow Hijacking and Unconditional Message Persistence

Content

View full analysis

60% = automatic logging / 缓冲危险区，>60%自动记录 3. **Strict budgeting** — 10/40/20/20, no exceptions / 严格预算，10/40/20/20无例外 ``` ### Technical Analysis The skill declares that every message must be scanned and that the agent must write selected message content to persistent workspace state before responding. The phrases “WAL is non-negotiable” and “no exceptions” attempt to establish unconditional precedence rather than defining an optional, user-authorized workflow. This changes the agent's normal response sequence as soon as the skill is loaded and can conflict with higher-priority privacy, data-minimization, or task-specific requirements. It also lacks exclusions for credentials, authentication tokens, personal information, confidential business data, or messages for which persistence was not requested. ### Attack Path 1. A user or automated workflow loads the skill. 2. The skill directs the agent to inspect every subsequent message. 3. A message includes a sensitive value, URL, identifier, preference, or attacker-controlled instruction. 4. Before replying, the agent follows the skill and writes that content to `SESSION-STATE.md` ...[truncated 613 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:205

Finding

Conversation-Derived Content Can Be Promoted into Persistent Agent Instruction Files

Content

View full analysis

/dev/null | wc -l || echo 0) if [ "$promote_candidates" -gt 0 ]; then echo " Found $promote_candidates learning(s) ready for promotion" echo " Review and promote manually to:" echo " - Behavioral patterns → SOUL.md" echo " - Workflow improvements → AGENTS.md" echo " - Tool gotchas → TOOLS.md" ``` ```bash echo "Next steps:" echo " 1. Review promotion candidates in .learnings/" echo " 2. Run detect.sh to verify new distribution" echo " 3. Promote valuable patterns to AGENTS.md/SOUL.md" ``` ### Technical Analysis The documented workflow treats recurrence or broad applicability as a basis for moving conversation-derived learning records into `SOUL.md`, `AGENTS.md`, or `TOOLS.md`. These files can influence future agent behavior and tool use. Repetition is not a trust signal: an attacker can repeat the same crafted rule until it appears eligible for promotion. The provided script does not directly modify those instruction files; it identifies candidates and recommends manual promotion. This limits immediate automation but does not remove the poisoning pathway established by the s ...[truncated 1207 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tiering.sh:97

Finding

Unfiltered Conversation Logging Is Archived Without a Retention Limit

Content

View full analysis

60% context). **目的：** 在危险区(>60%上下文)记录每一条消息。 **How:** 1. At **60% context**: Clear old buffer, start fresh 2. Every message after 60%: Append to `memory/working-buffer.md` 3. After compaction: Read buffer FIRST, extract important context 4. Leave buffer as-is until next 60% threshold ``` ```markdown | Tier | Location | Update Frequency | Retention | 中文 | |------|----------|-----------------|-----------|------| | HOT | SESSION-STATE.md | Every message | Current task only | 当前任务 | | WARM | .learnings/ | When learning occurs | Until promoted | 学习记录 | | COLD | MEMORY.md | Weekly archival | Permanent | 长期存档 | ``` ```bash if [ -f "$MEMORY_DIR/working-buffer.md" ]; then # Check if buffer has content and is old buffer_lines=$(wc -l < "$MEMORY_DIR/working-buffer.md" 2>/dev/null || echo 0) if [ "$buffer_lines" -gt 50 ]; then echo " Working buffer has $buffer_lines lines" echo " Archiving to memory/cold/working-buffers/..." mkdir -p "$MEMORY_DIR/cold/working-buffers" timestamp=$(date +"%Y%m%d-%H%M%S") # Archive and reset cp "$MEMORY_DIR/working-buffer.md" "$MEMORY_DIR/cold/working-buffers/buffer-$timestamp.md" # Reset buffer cat > "$MEMORY_DIR/working-buffer.md" << 'EOF' # Working Buffer (Danger Zone Log) **Status:** INACTIVE **Purpose:** Capture exchanges when context > 60% --- EOF ``` ### Technical Analysis The design calls for capturing every exchange after a context threshold and storing it in a plaintext Markdown file. The tiering script copies a sufficiently large buffer into a cold archive before resetting the active buffer. R ...[truncated 1375 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/init.sh:27

Finding

Initialization Destructively Overwrites Existing Workspace State

Content

View full analysis

"$WORKSPACE/SESSION-STATE.md" << 'EOF' ``` ```bash # HOT_MEMORY.md (for context budgeting) cat > "$MEMORY_DIR/hot/HOT_MEMORY.md" << 'EOF' ``` ```bash # WARM memory placeholder cat > "$MEMORY_DIR/warm/WARM_MEMORY.md" << 'EOF' ``` ```bash # Working Buffer cat > "$MEMORY_DIR/working-buffer.md" << 'EOF' ``` ```bash # .learnings templates cat > "$LEARNINGS_DIR/ERRORS.md" << 'EOF' ``` ```bash cat > "$LEARNINGS_DIR/LEARNINGS.md" << 'EOF' ``` ```bash cat > "$LEARNINGS_DIR/FEATURE_REQUESTS.md" << 'EOF' ``` ```bash # Create state file cat > "$MEMORY_DIR/.proactive-memory-state.json" << EOF { "initialized": true, "version": "1.0.0", "timestamp": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")", "stats": { "context_checks": 0, "checkpoints": 0, "tiering_operations": 0 }, "config": { "danger_zone_threshold": 60, "checkpoint_threshold": 80, "budget_zones": { "objective": 10, "short_term": 40, "decision_log": 20, "background": 20 } } } EOF ``` ### Technical Analysis Every template is written using shell redirection with `>`, which truncates the destination before writing. The script does not test whether a destination already exists, request confirmation, create backups, or offer a safe default mode. Because the documented quick-start procedure instructs users to run this initialization script, rerunning setup can erase active state and accumulated learning records. The writes are also not performed through temporary files followed by atomic renames. An interruption can consequently leave a partially written file, although the primary confirmed issue is unconditional ...[truncated 877 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tiering.sh:35

Finding

Untrusted Text Can Trigger Archival and Reset of the Entire Active Session State

Content

View full analysis

/dev/null | wc -l || echo 0) if [ "$completed_tasks" -gt 0 ]; then echo " Found $completed_tasks completed tasks in SESSION-STATE" echo " Archiving to memory/warm/archived-tasks/..." mkdir -p "$MEMORY_DIR/warm/archived-tasks" timestamp=$(date +"%Y%m%d-%H%M%S") # Archive current SESSION-STATE (preserving history) cp "$WORKSPACE/SESSION-STATE.md" "$MEMORY_DIR/warm/archived-tasks/session-state-$timestamp.md" # Reset SESSION-STATE for new task cat > "$WORKSPACE/SESSION-STATE.md" << 'EOF' # Session State (HOT Memory) **Last Updated:** [Auto-updated] **Status:** Active ## Current Task [New task - update me] ## Key Decisions - ## User Preferences - ## Next Steps 1. ## Working Notes EOF echo " ✓ Archived old session state" fi fi ``` ### Technical Analysis The script searches the entire `SESSION-STATE.md` file for a checkmark or either of two status phrases. It does not parse a dedicated status field or distinguish trusted metadata from quoted conversation text, examples, working notes, or attacker-controlled content. One match causes the complete active state to be archived and replaced with a blank template. A benign mention such as “do not set Status: done” is sufficient to trigger the same action. The archive reduces permanent data loss, but the active state is still displaced without confirmation, which can disrupt ...[truncated 1068 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This variant includes a meaningful safety issue: the skill claims 'zero information loss' while describing archival/reset behavior that may clear active files after copying without robust integrity verification. That can cause silent data loss and unsafe operator trust in persistence guarantees during compaction or tiering workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This variant includes a meaningful safety issue: the skill claims 'zero information loss' while describing archival/reset behavior that may clear active files after copying without robust integrity verification. That can cause silent data loss and unsafe operator trust in persistence guarantees during compaction or tiering workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

This variant includes a meaningful safety issue: the skill claims 'zero information loss' while describing archival/reset behavior that may clear active files after copying without robust integrity verification. That can cause silent data loss and unsafe operator trust in persistence guarantees during compaction or tiering workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 71% confidence

Finding

The skill advertises and references operational scripts, including behavior that static analysis associates with network-capable code, but the manifest declares no tool scope or permissions. Missing capability declarations weaken reviewability and can cause an agent to invoke functionality the operator did not explicitly authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The WAL protocol directs persistent recording of corrections, proper nouns, preferences, decisions, and specific values such as IDs, dates, and URLs. Persisting these categories without warning, consent, or minimization can capture personal or confidential data and expose it to later unintended access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions broadly require retaining user dialogue and detailed session information across files, which increases the chance that secrets, personal data, or proprietary information will be copied into long-lived storage. In a memory-management skill, that context makes the issue more dangerous because comprehensive capture is presented as a core feature rather than a narrow exception.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to log every exchange once a threshold is reached, but it provides no clear user-facing notice or consent mechanism for retention. This creates a privacy risk because sensitive conversation contents may be persistently stored without the user's awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill explicitly promotes creation of checkpoints and long-lived memory artifacts under the workspace, enabling session persistence beyond the immediate interaction. Persistence is not inherently malicious, but without clear controls it can preserve sensitive context and increase downstream exposure if those files are later read, searched, synced, or reused.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

执行记忆分层归档 / Run memory tiering

~/.openclaw/workspace/skills/proactive-memory-agent/scripts/tiering.sh

创建预压缩检查点 / Create pre-compaction checkpoint

~/.openclaw/workspace/skills/proactive-memory-agent/scripts/checkpoint.sh

text

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script initializes a persistent 'working buffer' whose stated purpose is to log every exchange once context exceeds a threshold. In an agent memory skill, this creates a durable capture point for potentially sensitive prompts, user data, secrets, and tool outputs without any minimization, consent, retention controls, or redaction, increasing privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/init.sh (reported line 219)May include surrounding context.

sh

echo "   2. Review: SESSION-STATE.md template"
echo "   3. Add to HEARTBEAT.md for automatic monitoring"
echo ""
echo "📚 Documentation: skills/proactive-memory-agent/SKILL.md"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script searches memory and workspace files and prints matching lines directly to terminal output, which can expose secrets, personal data, tokens, or other sensitive context stored in HOT/WARM/COLD memory. In this skill, the risk is elevated because the entire purpose is to aggregate and search long-term agent memory, making sensitive disclosure a normal byproduct of use rather than an edge case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script automatically archives the existing SESSION-STATE.md and then overwrites it with a template whenever it detects completed tasks, without prompting the user or requiring an explicit flag. Even though it preserves a copy, this is still a destructive state transition that can disrupt active workflows, cause confusion, and lead to accidental loss of unsaved or in-progress context if users do not realize the file was reset.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script unconditionally copies working-buffer.md to an archive and then replaces the active file with a minimal template once it exceeds 50 lines, with no confirmation or review step. In a memory-management skill, this behavior is especially risky because the working buffer likely contains transient but important reasoning context, so silent reset can erase operational continuity and make recovery dependent on users finding the archived copy.

Content

No source excerpt is available for this finding.