Security audit

Memory Auto Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims broadly, but it automatically records all user and assistant text into persistent local and vector memory stores with weak disclosure and no user controls.

Install only if you intentionally want every text conversation saved long-term. Avoid sharing passwords, tokens, private documents, or regulated data while it is enabled, and verify where both the Markdown files and OpenClaw memory records are stored and how they can be deleted.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: index.ts:49
Finding: Unfiltered Persistent Capture of Conversation Content<![CDATA[ ## Vulnerability Details **File Location**: `index.ts:49-87` **Vulnerability Type**: Unprotected persistent storage of potentially sensitive conversation data **Risk Level**: Medium ### Vulnerable Code ```ts async function writeToLanceDB(sender: "爸爸" | "张褐", content: string, timestamp: Date, api: OpenClawPluginApi) { try { await api.memory.store({ text: `${sender}：${content}`, category: "fact", importance: 0.6, metadata: { sender: sender, timestamp: timestamp.getTime(), date: formatDate(timestamp, "date"), }, }); } catch (err) { api.logger.error(`写入向量库失败: ${err instanceof Error ? err.message : String(err)}`); } } export default function registerPlugin(api: OpenClawPluginApi) { // 监听用户发来的消息 api.events.on("inbound-message", async (msg: InboundMessage) => { if (msg.content.type === "text" && msg.content.text?.trim()) { const timestamp = new Date(msg.timestamp); // 双写：同时写入文件和向量库 await Promise.all([ writeToMarkdown("爸爸", msg.content.text, timestamp), writeToLanceDB("爸爸", msg.content.text, timestamp, api) ]); } }); // 监听助理发出的消息，过滤工具调用和系统消息 api.events.on("outbound-message", async (msg: OutboundMessage) => { if (msg.content.type === "text" && msg.content.text?.trim() && msg.content.text !== "NO_REPLY" && !msg.toolCall) { const timestamp = new Date(); await Promise.all([ writeToMarkdown("张褐", msg.content.text, timestamp), writeToLanceDB("张褐", msg.content.text, timestamp, api) ]); } }); api.logger.info("✅ 记忆自动同步插件启动成功，所有对话将自动双写到记忆文件和LanceDB向量库"); } ``` ### Technical Analysis The plugin subscribes globally to inbound and outbound text-message events and sends every qualifying message to both a Markdown writer and the OpenClaw memory store. The filtering only excludes empty text, tool calls, and the special `NO_REPLY` value. It does not detect credentials, authentication tokens, pr ...[truncated 2013 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed opt-in before enabling conversation capture. 2. Allow users to select which conversations, participants, or message categories may be stored. 3. Apply secret and PII detection before either persistence operation; reject or redact passwords, tokens, private keys, payment data, and sensitive identifiers. 4. Provide separate controls for Markdown storage and vector-memory storage. 5. Define retention limits and implement deletion that removes corresponding records from both storage systems. 6. Use encryption at rest and restrictive filesystem permissions for retained conversation data. 7. Avoid automatically categorizing all messages as durable facts; store only content explicitly selected for long-term memory. 8. Clearly document the storage locations, retrieval behavior, access model, retention policy, and residual copies created by indexing or backups. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: index.ts:6
Finding: Hard-Coded User-Specific Storage Path Can Misplace Sensitive Data<![CDATA[ ## Vulnerability Details **File Location**: `index.ts:6` **Vulnerability Type**: Unsafe hard-coded storage configuration **Risk Level**: Low ### Vulnerable Code ```ts // 记忆文件存储目录，固定路径 const MEMORY_DIR = "/home/tao/.openclaw/workspace/memory"; ``` The path is subsequently used to construct and append to daily memory files: ```ts const filePath = path.join(MEMORY_DIR, `${dateStr}.md`); await fs.appendFile(filePath, entry, "utf8"); ``` ### Technical Analysis The storage location is tied to the fixed operating-system account `/home/tao` rather than being obtained from plugin configuration, the active user's home directory, or a workspace path supplied by OpenClaw. In a deployment running under another account, this may cause permission failures or place conversation records in a different account's workspace if the process can write there. It also violates isolation expectations in shared or migrated environments. The directory is created recursively when absent, but the plugin does not explicitly set restrictive permissions. The installation documentation compounds the configuration risk: `SKILL.md` describes pure file writing but does not identify this absolute path or the additional vector-memory copy. Although `package.json` mentions dual storage, users relying on the installation instructions may not have a complete understanding of where their messages are retained. ### Attack Path 1. The plugin is installed on a system where OpenClaw runs as an account other than `tao`, or where `/home/tao` belongs to another local user. 2. The process has sufficient permissions to access or create the configured directory. 3. A qualifying conversation message triggers the event handler. 4. The plugin appends the message to `/home/tao/.openclaw/workspace/memory/<date>.md` rather than the active user's intended workspace. 5. A user or process with access to that location reads the misplaced conversation record. If the process lacks access, the operation ...[truncated 654 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the absolute user-specific path. 2. Obtain the memory directory from a documented OpenClaw workspace API or explicit plugin configuration. 3. If a default is necessary, derive it from the active environment using a safe platform API such as `os.homedir()` and validate the resolved path. 4. Resolve and verify the final path before writing, ensuring it remains inside the intended OpenClaw workspace. 5. Create directories and files with restrictive permissions appropriate for sensitive conversation records. 6. Fail closed with a clear configuration error when the destination is unavailable rather than silently targeting another user's directory. 7. Update `SKILL.md` to disclose the configurable Markdown destination and the separate vector-memory storage operation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

Confidence: 98% confidence
Finding: Inbound and outbound text are automatically persisted with no consent flow, notice, or indication in the code that users are informed their conversations are being stored. Silent collection of full conversation content raises privacy and compliance risk, especially when messages may contain credentials, personal data, or confidential business information.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly states it will automatically listen to and persist all user-assistant conversations, but the description does not present a clear, prominent privacy warning or consent mechanism. This is dangerous because users may unknowingly disclose sensitive personal, credential, or business information that is then stored on disk in plaintext-style Markdown and retained beyond the live session.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill's core function is to automatically record all conversations into persistent Markdown memory files, which creates a direct data retention and leakage risk. In skill context this is more dangerous, not less, because it is broad, continuous collection of natural-language content that may include secrets, personal data, tokens, internal business information, or safety-sensitive prompts without any mention of minimization, filtering, encryption, or retention limits.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The code formats timestamps using Chinese date text and uses fixed Chinese speaker labels in persisted records. This imposes a specific language/locale in user-visible stored content without any evident opt-in or configurable locale selection.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The plugin registers global inbound and outbound message listeners and persistently stores essentially all text conversations to both a local markdown file and the memory store. This creates broad surveillance and retention of potentially sensitive user and assistant content without apparent scope limitation, minimization, or access controls, making accidental disclosure or later misuse more likely.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The plugin is explicitly designed to retain all user and assistant text in persistent stores, including a local file path and vector memory. Persistent retention enlarges the blast radius of any later compromise, enables profiling of users, and preserves sensitive content beyond its operational need.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The entire skill description is presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The package metadata fields shown to users (`description`, `label`, `blurb`, and `tags`) are entirely in Chinese, which can impose a specific language on users without any visible opt-in or justification. This matches the language/locale policy concern for natural-language content because the file provides no indication that the skill is region-specific or offers alternatives.

Static analysis

No suspicious patterns detected.