ClawHub
Back to skill

Security audit

memory-tuner

Security checks for vulnerabilities and agentic risk

Overview

This is a local memory-maintenance skill whose ability to mark, archive, or clean persistent memory is disclosed and purpose-aligned, though users should understand those side effects before enabling automation.

Install this only if you want an agent to maintain OpenClaw long-term memory files. Run the default report mode first, inspect suggested changes, and avoid enabling weekly automation or --mark/apply-style workflows unless you are comfortable with persistent MEMORY.md edits, archive moves, tracking logs, and backup-to-trash cleanup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill describes and relies on file reads, file writes, and environment-variable-controlled workspace selection, yet it does not declare corresponding permissions. This creates a transparency and governance gap: users or the host may approve the skill under a lower-trust assumption while it can still modify MEMORY.md, archive files, tracking logs, and even move content toward ~/.Trash.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The document labels scripts/memory-tuner.py as '只读分析，不改文件' but also advertises a --mark mode that adds markers to MEMORY.md. That contradiction is dangerous because operators may run the script expecting a safe dry-run while it actually mutates long-term memory content, which can alter prompts, persistence behavior, or trigger unintended archival/deletion workflows.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The manual trigger phrase '优化记忆' is broad enough to overlap with ordinary user conversation, increasing the chance the agent performs maintenance actions when the user meant something else. In this skill, those actions can lead to file modification, archiving, or deletion of memory content, so accidental activation has real integrity impact.

Static analysis

No suspicious patterns detected.