Agent Retro

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed agent-retrospective workflow, but it can read broad session history and permanently rewrite core memory and behavior files without a clear approval step.

Install only if you intentionally want an agent to inspect full daily session history and rewrite long-term memory and behavior files. Before using it, require a dry-run diff, explicit approval for each file change, and redaction rules for secrets, credentials, personal data, and unrelated tool outputs.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:33

Finding

Persistent Agent Behavior Poisoning Through Unvalidated Retrospective Conclusions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-44
Vulnerability Type: Persistent memory and behavioral-rule poisoning
Risk Level: High

Vulnerable Code Snippet

The following is a faithful English translation of the relevant skill instructions:

markdown

## Step 4: Record Daily Memory
1. Write the complete summary from Step 3 to `memory/YYYY-MM-DD.md`.
2. Create the file if it does not exist, or append to it if it does.

## Step 5: Update Core Configuration
1. Compare and update `MEMORY.md`: extract key conclusions from Step 3,
   add missing conclusions, modify outdated conclusions, and append a
   record of these changes to `memory/YYYY-MM-DD.md`.
2. Update `USER.md` using the user profile extracted in Step 3.
3. Update `SOUL.md` using the agent profile extracted in Step 3.
4. Update `AGENTS.md` using the improvement points from Step 3, modifying
   tool constraints or tactical rules so that the lessons become permanent.

Warning: Core configuration updates must physically modify the files.
Verbal promises to make changes are prohibited.

Technical Analysis

The skill requires conclusions derived from historical conversations to be written into long-term memory and several behavior-defining configuration files. In particular, it can modify MEMORY.md, USER.md, SOUL.md, and AGENTS.md.

Historical session content is an untrusted input boundary. A user, external content processed during a session, or a malicious tool result can introduce assertions or instructions designed to appear to be user preferences, agent lessons, or required tactical rules. The skill does not require provenance validation, instruction filtering, schema validation, security-rule protection, or user approval before converting those conclusions into persistent state.

The mandatory physical-write requirement increases the risk because the generated conclusions are not merely presented for review. ...[truncated 1599 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate a proposed diff instead of directly modifying core configuration files.
2. Require explicit user approval for every change to MEMORY.md, USER.md, SOUL.md, and AGENTS.md.
3. Treat session messages and tool results strictly as untrusted evidence, not executable instructions.
4. Remove or neutralize imperative instructions embedded in historical content before summarization.
5. Track provenance for every proposed conclusion, including the source session, role, timestamp, and supporting evidence.
6. Permit only schema-constrained profile facts and prohibit arbitrary instructions in profile or memory fields.
7. Prevent the retrospective skill from weakening security controls, tool permissions, system instructions, or approval requirements.
8. Use an allowlist of sections that the skill may update rather than granting whole-file modification authority.
9. Validate proposed changes with a separate policy check before writing them.
10. Provide atomic rollback and integrity verification for every approved update.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:19

Finding

Overbroad Access to Complete Session and Tool-Result History

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-22
Vulnerability Type: Excessive access to private session records
Risk Level: Medium

Vulnerable Code Snippet

The following is a faithful English translation of the relevant skill instructions:

markdown

## Step 2: Collect Historical Data
1. Enter the `~/.openclaw/agents/${agentId}/sessions` directory.
2. Read all `.jsonl` files or session records carrying the target date's timestamp.
3. Extract all user instructions, assistant responses, tool calls, and tool results
   from that day.

Technical Analysis

The skill instructs the agent to read all session records associated with a target date and extract every user instruction, assistant response, tool call, and tool result. This is broader than the minimum data normally required to produce a behavioral retrospective.

Tool results may contain credentials, authentication tokens, private file contents, personal information, internal system details, or data unrelated to the retrospective request. The skill defines no content filtering, secret redaction, per-session authorization, retention limitation, or restriction against copying sensitive information into persistent memory.

The ${agentId} parameter also determines which agent's session directory is inspected. Although the documented default is main, the instructions do not define an authorization check that confirms the requester is entitled to inspect the selected agent's records.

The issue is compounded by the later requirements to write summaries into memory and create timestamped backups before modifying core files. Sensitive information derived from session records can therefore be replicated into multiple durable locations.

Attack Path

1. A target-day session contains sensitive information in a user message, assistant response, tool invocation, or tool result.
2. A retrospective is requested for that date and agent i ...[truncated 1175 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit authorization for the exact agent identifier, target date, and sessions to be analyzed.
2. Restrict access to sessions owned by the requesting user and prevent arbitrary agent-directory selection.
3. Read only the minimum message fields needed for the retrospective.
4. Exclude raw tool results by default and include them only after explicit approval.
5. Apply secret detection and redaction before content enters the summarization process.
6. Never persist passwords, tokens, private keys, authentication headers, or unrelated file contents.
7. Replace the requirement to collect “all” records with relevance-based and purpose-limited selection.
8. Display the selected session set and data categories to the user before processing.
9. Define retention and deletion policies for daily memory files and timestamped backups.
10. Apply restrictive filesystem permissions to session records, generated memory, lock files, and backups.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requires modifying multiple persistent files and even mandates completing physical writes before reporting to the user, but it does not require a clear user-facing consent gate at execution time. This creates a high risk of unauthorized or surprising workspace mutation, especially when triggered by ordinary summary requests.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This section mandates writing full summaries, user profile conclusions, agent behavior assessments, and memory updates into several persistent files, multiplying the number of places sensitive or embarrassing information may reside. The propagation across MEMORY.md, USER.md, SOUL.md, AGENTS.md, and daily memory significantly increases retention, discoverability, and accidental disclosure risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is broad enough to activate on common requests like '总结' or '复盘', which can cause the skill to run in situations where the user only wanted a conversational summary. Because this skill performs persistent writes and profile updates, over-triggering materially increases the chance of unintended state changes and silent retention of user data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's stated purpose includes extracting user profile information and persisting it into memory/configuration files, which introduces a retention and secondary-use risk for sensitive personal data. Even if intended for personalization, storing derived profiles without minimization or consent can expose private preferences, patterns, or sensitive inferences across future sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow instructs the agent to read all session records for a date, including user messages, assistant content, tool calls, and tool results. That broad collection scope can sweep up secrets, personal data, credentials, or other sensitive outputs and then re-summarize them into new locations, expanding exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.