memory-indexer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:41 AM UTC
• Version: 2.0.1

Overview

This skill mostly matches a memory-indexing purpose, but it also persistently changes agent behavior and can automatically process or truncate private memory/session files.

Review this skill before installing. It is not just a search helper: the installer can change persistent OpenClaw instruction files, enable recurring processing of memory/session data, and the compaction scripts can overwrite original files without a verified full backup. Avoid running update.sh unless you trust the git origin and current code, keep remote embedding providers disabled unless you are comfortable sending memory text to that service, and remove bundled backup data before redistribution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (9)

T01 · Skill Instruction Hijacking

Error

• Location: install.sh:62

Finding

Persistent Modification of Agent Instructions and Lifecycle Behavior

Content

View full analysis

/dev/null; then echo "⚠️ AGENTS.md 已包含 Memory Indexer 配置" else echo "$MEMORY_INDEXER_RULE" >> "$AGENTS_FILE" echo "✅ 已添加配置到 AGENTS.md" fi fi ``` ```sh MEMORY_RULE=' 2. **保存记忆时** - 必须同时调用 memory-indexer 建立索引 ... 3. **新会话开始时** - 自动调用 memory-indexer 搜索相关记忆 ...' if grep -q "## 强制规则" "$MEMORY_FILE"; then sed -i "/## 强制规则/a\\$MEMORY_RULE" "$MEMORY_FILE" fi ``` ```sh HEARTBEAT_RULE=' ### 会话备份与精简 ... - 脚本：`cd ~/.openclaw/workspace && uv run python skills/memory-indexer/session_backup.py` - 频率：每次心跳时执行（自动增量处理最近 3 个会话） ### Memory 文件精简 ... - 脚本：`cd ~/.openclaw/workspace && uv run python skills/memory-indexer/memory_compact.py` - 频率：每次心跳时执行' ... echo "$HEARTBEAT_RULE" >> "$HEARTBEAT_FILE" ``` ### Technical Analysis The installer directly edits the host Agent's `AGENTS.md`, `MEMORY.md`, and `HEARTBEAT.md`. The inserted text declares mandatory tool precedence, automatic retrieval on new sessions, and heartbeat-driven execution of scripts that read and truncate conversation and memory files. This behavior goes beyond installing a keyword-indexing utility. It persistently changes how the Agent operates in future sessions and causes privileged file-processing actions to occur without a fresh command from the user. The installer does not present the full changes for approval, create rollback copies of the affected instruction files, or provide an uninstall mechanism. Because the inserted rules survive the installation process, this behavior also has characteristics of persistent memory poisoning and lifecycle pe ...[truncated 855 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: update.sh:84

Finding

Unverified Remote Update Followed by Automatic Script Execution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: embedding.py:32

Finding

Memory and Search Content Can Be Transmitted to Remote Embedding Services

Content

View full analysis

Optional[List[float]]: url = f"{OLLAMA_HOST}/api/embeddings" data = { "model": OLLAMA_MODEL, "prompt": text } req = urllib.request.Request( url, data=json.dumps(data).encode("utf-8"), headers={"Content-Type": "application/json"}, method="POST" ) with urllib.request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode("utf-8")) return result.get("embedding") ``` ```python def _get_minimax_embedding(text: str) -> Optional[List[float]]: url = f"{MINIMAX_API_BASE}/text/embeddings" headers = { "Authorization": f"Bearer {MINIMAX_API_KEY}", "Content-Type": "application/json" } data = { "model": "emba-01", "input": text } req = urllib.request.Request( url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST" ) with urllib.request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode("utf-8")) ``` ```python for f in Path(memory_dir).glob("*.md"): files.append(f.name) try: contents.append(f.read_text(encoding="utf-8")[:1000]) except: contents.append("") add_vectors_batch(files, contents) ``` ### Technical Analysis When ...[truncated 1584 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: session_backup.py:175

Finding

Session Files Are Truncated Even When Backup Fails

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: memory_compact.py:90

Finding

Memory Files Are Truncated After Unverified Indexing

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: backup_20260313_113951/index.json:1

Finding

Generated Backup Artifacts Expose Private Session and Messaging Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: memory_snapshot.py:117

Finding

Snapshot Restoration Allows ZIP Path Traversal

Content

View full analysis

.zip` convention. 2. The archive contains a member such as `../../target-file`. 3. The archive is placed in the configured sn ...[truncated 608 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: install.sh:185

Finding

Installer Adds a Persistent Daily Cron Job

Content

View full analysis

> $WORKSPACE/logs/memory-indexer.log 2>&1" (crontab -l 2>/dev/null | grep -v "memory-indexer"; echo "$CRON_CMD") | crontab - echo "✅ Cron 配置完成（每天 6 点自动同步）" fi ``` ### Technical Analysis The cron registration is interactive and related to the declared synchronization feature, so it is not installed silently. Nevertheless, it creates cross-session persistence and grants the linked project recurring access to workspace memory. The command points to code through the workspace Skill path. If that linked code is later changed by the updater or another party with repository write access, the new code runs at the next scheduled time. The installer does not provide an uninstall command, validate the final crontab, or ensure that the log directory exists. The `grep -v "memory-indexer"` operation also removes every existing crontab line containing that string, not only the exact task created by this installer. ### Attack Path 1. The user answers `y` to the cron installation prompt. 2. A daily task is written into the user's crontab. 3. The project code is later changed, including through the unverified updater. 4. At 06:00, cron executes the current version of the linked script. 5. The script receives the user's cron-level filesystem access without a new confirmation. ### Impact Assessment The task persistently reads and indexes memory files under the user's account. If the linked code is compromised, the scheduled task becomes a recurring execution mechanism with the same privileges as that user. Existing unrelated cron entries containing `memory-indexer` can ...[truncated 37 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Dependency Installation Exposes the Environment to Supply-Chain Risk

Content

View full analysis

=0.42.1 ``` ```sh echo "" echo "📦 安装依赖..." if python3 -c "import jieba" 2>/dev/null; then echo "✅ jieba 已安装" else uv pip install jieba || pip3 install jieba echo "✅ jieba 安装完成" fi ``` ### Technical Analysis The dependency declaration accepts any current or future version of `jieba` at or above version 0.42.1. The installer does not use a lock file, package hash, trusted artifact checksum, or isolated virtual environment. No evidence was found that the named `jieba` package is itself malicious. The issue is that future upstream compromise, package-index compromise, or an incompatible release could change what code is installed after this audit. The fallback to system `pip3` can also modify the invoking user's general Python environment rather than a Skill-specific environment. ### Attack Path 1. A malicious or compromised package release becomes the version selected by the package resolver. 2. A user runs `install.sh` on a system where `jieba` is not installed. 3. `uv pip install jieba` or `pip3 install jieba` downloads the unverified release. 4. Package installation or later import executes attacker-controlled package code in the user's environment. ### Impact Assessment Impact is limited to the privileges of the user performing installation, but may include arbitrary code execution and compromise of the Python environment. The current audit did not confirm a malicious dependency version, so this is a preventive supply-chain finding rather than evidence of active package compromise. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (90)

Tainted flow: 'req' from os.environ.get (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · embedding.py (reported line 79)May include surrounding context.

python

headers={"Content-Type": "application/json"},
            method="POST"
        )
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read().decode("utf-8"))
            return result.get("embedding")
    except Exception as e:

Tainted flow: 'req' from os.environ.get (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

This code transmits memory text to the external MiniMax API using an environment-provided API key. In the context of a memory indexer, that can expose potentially sensitive user memories to a third-party service without strong in-code consent controls, making this a real confidentiality risk even if the implementation is intentional.

Content

Scanner excerpt · embedding.py (reported line 113)May include surrounding context.

python

headers=headers,
            method="POST"
        )
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read().decode("utf-8"))
            if "data" in result and len(result["data"]) > 0:
                return result["data"][0]["embedding"]

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Pulling code from a remote repository, running install/migration scripts, modifying OpenClaw configuration, and deploying hooks are powerful actions not captured by the benign memory-indexing description. This increases supply-chain and persistence risk because the skill can change host behavior and fetch new code under the guise of a utility feature.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · backup_20260313_113951/index.json (reported line 2982)May include surrounding context.

json

"source": "external"
    }
  ],
  "keyring": [
    {
      "file": "2026-03-11.md",
      "time": "20260311_201407",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · backup_20260313_114003/index.json (reported line 2982)May include surrounding context.

json

"source": "external"
    }
  ],
  "keyring": [
    {
      "file": "2026-03-11.md",
      "time": "20260311_201407",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · backup_20260313_114050/index.json (reported line 2982)May include surrounding context.

json

"source": "external"
    }
  ],
  "keyring": [
    {
      "file": "2026-03-11.md",
      "time": "20260311_201407",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · backup_20260313_114054/index.json (reported line 2982)May include surrounding context.

json

"source": "external"
    }
  ],
  "keyring": [
    {
      "file": "2026-03-11.md",
      "time": "20260311_201407",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script claims to perform backup while also compacting the original session files, but it never writes an actual backup copy into the configured backup directory. This creates a high risk of irreversible data loss because user conversation history may be truncated after only partial extraction into an index, which is not a faithful backup.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script modifies files and links under the user's OpenClaw workspace and hook directories, including creating/updating a skill symlink and copying hooks. For a memory-indexing skill, changing agent configuration and hook execution paths is powerful persistence-like behavior that can alter future agent behavior beyond the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file includes a prescriptive rule in Chinese ("版本号规则") without any indication that language choice is optional or user-selectable. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The changelog documents proactive search triggers such as common phrases indicating historical context, which can cause the skill to activate on ordinary user speech without clear consent. In a memory-indexing skill, unintended activation can expose or retrieve prior conversation data when the user did not explicitly request memory lookup, creating privacy and over-collection risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Chinese trigger phrases listed are highly ambiguous in normal conversation and are likely to match benign requests, causing unintended memory searches. Because this skill indexes and recalls user memory, false activations increase the chance of unnecessary access to retained personal context and leakage into responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises automatic backup and compaction of session and memory files, including trimming stored data, but does not clearly present this as a potentially privacy- and integrity-impacting behavior requiring explicit user awareness. In an agent environment, silent retention and modification of conversational or memory data can expose sensitive information and can irreversibly alter records users may expect to remain unchanged.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly describes backing up user messages into an index and compacting session files, which creates a natural-language data retention risk because sensitive user content may be copied into additional storage locations and preserved beyond user expectations. This broadens the attack surface and may cause unintentional disclosure through later searches, backups, snapshots, or shared workspace access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation instructions enable AGENTS.md, MEMORY.md, and HEARTBEAT.md rules that automate indexing, retrieval, backup, and compaction of user/session data without a prominent disclosure that user messages will be processed and persisted. This creates a meaningful consent and privacy problem because a user may follow setup steps expecting convenience tooling, not broad automatic data retention and policy injection into agent workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.