Back to skill

Security audit

Memory Boost

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but installs persistent scheduled agent jobs and always-on task logging with too little user control, so it needs review before installation.

Install only if you are comfortable with every task being written to persistent local files under ~/.openclaw/memory/ and with five recurring OpenClaw jobs being added. Review or modify install.sh first, consider avoiding the cron setup unless needed, pin the ClawHub installer instead of using @latest, and remove both the cron jobs and stored memory notes when you no longer want this behavior.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
install.sh:92
Finding

Installer Creates Five Persistent Recurring OpenClaw Jobs

Content
View full analysis
/dev/null; then echo "Using OpenClaw CLI to add cron jobs..." add_job_if_missing() { local name="$1" cron="$2" prompt="$3" if openclaw cron list 2>/dev/null | grep -q "$name"; then echo " Skipped (already exists): $name" else openclaw cron add \ --name "$name" \ --cron "$cron" \ --session isolated \ --message "$prompt" \ --announce 2>/dev/null && echo " Added job: $name" || echo " Warning: failed to add $name via CLI" fi } add_job_if_missing "boost-watchdog" "*/15 * * * *" "$WATCHDOG_PROMPT" add_job_if_missing "boost-replayer" "*/30 * * * *" "$REPLAYER_PROMPT" add_job_if_missing "boost-escalator" "0 * * * *" "$ESCALATOR_PROMPT" add_job_if_missing "boost-validator" "5 * * * *" "$VALIDATOR_PROMPT" add_job_if_missing "boost-smoke-test" "0 */6 * * *" "$SMOKETEST_PROMPT" ``` If the CLI is unavailable, the fallback directly modifies the persistent OpenClaw job configuration and enables every added job: ```python for name, info in prompts.items(): if name in existing_names: skipped.append(name) continue job = { "id": secrets.token_hex(6), "name": name, "prompt": info["prompt"], "skills": [SKILL_NAME], "skill": SKILL_NAME, "model": None, "provider": None, "base_url": None, "schedule": { "kind": "cron", "expression": info["cron"], "display": info["cron"] }, "schedule_display": info["cron"], "repeat": {"times": None, "completed": 0}, "enabled": True, "state": "scheduled", ...[truncated 3606 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
INSTALL.md:8
Finding

Documentation Recommends Execution of an Unpinned Mutable npm Package

Content
View full analysis
Remediation
View remediation
`. 2. Publish a trusted cryptographic digest or npm integrity value and document how users can verify it before execution. 3. Avoid automatic execution of registry-delivered code where a download-and-review workflow is practical. 4. Document the expected package publisher, registry, version, and release provenance. 5. Use release signing or package provenance attestations and require verification in the installation instructions. 6. Update both `INSTALL.md` and `README.md` so they do not continue recommending `@latest`. 7. Consider providing a repository-local installation procedure that does not require executing a mutable third-party installer. ]]>
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 84)May include surrounding context.

Uninstall

bash
rm -rf ~/.openclaw/skills/memory-boost
openclaw cron remove --name "boost-watchdog"
openclaw cron remove --name "boost-replayer"
openclaw cron remove --name "boost-escalator"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 84)May include surrounding context.

Uninstall

bash
rm -rf ~/.openclaw/skills/memory-boost
openclaw cron remove --name "boost-watchdog"
openclaw cron remove --name "boost-replayer"
openclaw cron remove --name "boost-escalator"

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented behavior materially understates what the skill does: it presents itself as simple task memory with no external dependencies, while the analyzed behavior includes autonomous scheduled jobs, cron modification, and reliance on executables like openclaw/python3. Misrepresentation is dangerous because users and agents cannot make an informed trust decision, and autonomous background actions can continue beyond the initiating session.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The install instructions use npx clawhub@latest, which fetches and executes the newest published package version without pinning. That creates a supply-chain risk: a compromised or malicious update could run arbitrary code during installation, especially because the next step also invokes a local install script.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill is explicitly designed to create durable memory and recurring cron-driven keep-alive behavior, which establishes session persistence on the user's system. In context, this is more dangerous than a generic persistence finding because the feature's purpose is to keep an agent active or restart work over time, enabling unattended continued execution if misused or compromised.

Content

Scanner excerpt · INSTALL.md (reported line 14)May include surrounding context.

npx clawhub@latest install memory-boost

text

Then run the setup script to create the memory directory and cron jobs:
```bash
cd ~/.openclaw/skills/memory-boost
./install.sh

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instructions tell users to run install.sh, which creates persistent files and five cron jobs, but they do not prominently warn that this establishes background execution and ongoing state on the host. Users may unknowingly grant the skill durable execution, increasing the chance that unexpected behavior persists beyond the initial install.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INSTALL.md (reported line 40)May include surrounding context.

md
| What | Where |
|------|-------|
| Skill | `~/.openclaw/skills/memory-boost/SKILL.md` |
| Template | `~/.openclaw/memory/TEMPLATE.md` |
| Task index | `~/.openclaw/memory/TASK-INDEX.md` |
| Loop state | `~/.openclaw/memory/LOOP-STATE.md` |

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The manual install path also instructs users to create persistent memory directories and five cron jobs. Even though this is documented and likely intended functionality, it still creates durable state and background execution that can outlive the user's immediate session and be abused if the skill logic later behaves unexpectedly.

Content

Scanner excerpt · INSTALL.md (reported line 57)May include surrounding context.

md
## Option 3: Manual install

1. Copy the `SKILL.md` file and `templates/`, `prompts/`, `examples/` directories into `~/.openclaw/skills/memory-boost/`.
2. Create `~/.openclaw/memory/tasks/`.
3. Copy `templates/TEMPLATE.md` and `templates/LOOP-STATE.md` into `~/.openclaw/memory/`.
4. Copy `examples/TASK-INDEX.md` into `~/.openclaw/memory/`.
5. Create the 5 cron jobs using `openclaw cron add` (see table above).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README markets the feature as 'memory that never dies' and says every task gets persistent notes, but it does not prominently warn that all task content will be continuously written to durable storage under ~/.openclaw/memory/. In a security-sensitive agent context, this can silently persist secrets, proprietary prompts, credentials, or regulated data beyond the session lifecycle.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The keep-alive loop is described as something users can 'arm and walk away,' but the README does not clearly foreground that it runs unattended background monitoring and may keep consuming tokens until manually stopped. In agent environments, unattended autonomous retries and restarts can increase cost, prolong unintended activity, and magnify the effect of bad task state or prompt injection.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run npx clawhub@latest install memory-boost, which fetches and executes the latest package version at install time without pinning or integrity verification. This creates a supply-chain risk: if the package is compromised or behavior changes, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill directs persistent file writes under ~/.openclaw/memory/ but does not declare any explicit tool scope or permission boundary. That makes its write capability implicit and harder to audit, increasing the chance that an agent applies the skill and modifies local state without clear user awareness or least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill prominently advertises durable notes for every task but does not warn users that task contents will be stored persistently on disk. Without an upfront retention warning, users may disclose sensitive information assuming normal session ephemerality, creating avoidable privacy and security risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Automatic persistent notes for every task can capture user prompts, file paths, work status, and potentially secrets or sensitive business context without any filtering or retention limits. Persistent local accumulation of such data increases the blast radius of host compromise, accidental sharing, or later misuse by other tools or sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This skill is explicitly designed to preserve session state across restarts by creating task folders with resume and documentation files. While persistence is part of the feature, it is still security-relevant because it creates durable cross-session memory that may retain sensitive context and affect future agent behavior without fresh user review.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Task Memory

When you receive any task, automatically create a task folder:

text
~/.openclaw/memory/tasks/<task-name>/

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction to automatically create persistent task folders for any received task is overly broad and causes the skill to activate on essentially all work. Broad activation increases the odds that sensitive, irrelevant, or one-off tasks are logged without need, violating minimization and surprising users.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The required documentation fields instruct the agent to record broad goals, decisions, key files, gotchas, and discoveries, which can easily include sensitive internal details. Because this content is written immediately and persistently, it creates a structured log of valuable context for an attacker or an unintended future consumer.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The watchdog and escalation notes extend persistence beyond simple memory into autonomous cross-session workflow steering, recording blockers and next actions that can influence later runs. In context, that makes stale or sensitive task state durable and potentially actionable by future automated passes, increasing the risk of unintended continuation or disclosure.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
| Smoke test | `boost-smoke-test` | 0 */6 * * * | Verifies the skill itself is healthy |

### Watchdog rules:
- Write WATCHDOG.md only when you can prove a stall. Do not manufacture problems.
- Include: folder path, blocker, why-stalled tag, one next action.
- Why-stalled tags: `blocked-on-external`, `ambiguous-next-step`, `repeated-promise`, `missing-context`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The usage guidance says task memory should always be used, with no scope limits or sensitivity checks. This encourages indiscriminate persistence and normalizes storage even when the task does not warrant retention, increasing exposure if local files are later accessed or reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script begins performing installation actions immediately after basic directory validation, without a clear warning that it will copy files and configure persistent behavior. Silent state changes reduce informed consent and increase the chance that users install automation they did not fully understand.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The installer silently provisions five autonomous scheduled jobs, which materially expands the skill’s behavior beyond simple persistent notes and a keep-alive loop. Autonomous prompts can continue operating after installation and consume tokens or perform unintended actions without clear operator awareness, making this a real security-relevant transparency and control issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Installing recurring cron jobs without explicit user confirmation is safety-relevant because it enables autonomous execution on a schedule. In an agent ecosystem, scheduled prompts can trigger repeated actions, token usage, or task manipulation beyond the user’s immediate session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Directly rewriting jobs.json changes scheduler state persistently and opaquely, yet the user is not warned that local scheduler configuration will be modified. This is risky because a malformed write or unnoticed scheduled task can alter agent behavior over time and be difficult to attribute later.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · prompts/escalator-prompt.md (reported line 3)May include surrounding context.

md
You are the Memory Boost replayer. Your job is to take one stalled task with a WATCHDOG.md note and move it forward by exactly one concrete step in fresh context.

**Scope**: Only read and write files inside `~/.openclaw/memory/`. Do not access files outside this directory.

## Paths

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · prompts/replayer-prompt.md (reported line 3)May include surrounding context.

md
You are the Memory Boost replayer. Your job is to take one stalled task with a WATCHDOG.md note and move it forward by exactly one concrete step in fresh context.

**Scope**: Only read and write files inside `~/.openclaw/memory/`. Do not access files outside this directory.

## Paths

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
INSTALL.md:84