Back to skill

Security audit

Rune - Self-Improving AI Memory

Security checks for vulnerabilities and agentic risk

Overview

Rune is a real memory tool, but it installs persistent agent workflow hooks and can send selected documents to cloud AI providers more broadly than users may expect.

Install only if you want a persistent, cross-session memory system that changes OpenClaw workspace behavior. Review the HEARTBEAT.md changes and generated workflow files first, avoid --force, prefer Ollama/local-only use for sensitive files, and verify removal manually because the bundled uninstaller does not fully clean up current Rune artifacts.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
setup-workflow.sh:75
Finding

Persistent mandatory instructions can alter Agent behavior across sessions

Content
View full analysis
~/.openclaw/workspace/MANDATORY-MEMORY-WORKFLOW.md << 'WORKFLOWEOF' # MANDATORY MEMORY WORKFLOW - Rune Integration ## 🚨 CRITICAL: Memory Usage Is Not Optional **Problem**: Many users install Rune but never integrate it into their workflow. **Result**: Sophisticated memory system goes completely unused. ## 📋 MANDATORY SESSION WORKFLOW ### BEFORE Every Response ```bash # 1. ALWAYS recall relevant context first rune recall "current projects recent decisions" # 2. Search for specific topic context rune search "[topic from user message]" | head -5 # 3. Only THEN respond with full context ``` ### DURING Conversations ```bash # Store important decisions immediately rune add decision "[decision]" --tier [working|long-term] # Store project context updates rune add project "[project].[key]" "[update]" --tier working # Store lessons learned rune add lesson "[category].[specific]" "[lesson]" --tier long-term ``` ### SUCCESS INDICATORS ✅ Starting responses with recalled context ✅ Referencing past decisions in new work ✅ Building on previous conversations seamlessly ✅ Never repeating explanations of recent work ### FAILURE INDICATORS ❌ "Cold start" responses without context ❌ Asking for previously provided information ❌ Losing project continuity between sessions ❌ Not building institutional memory --- **If you're not using memory, you're not using Rune properly.** WORKFLOWEOF ``` ### Technical Analysis The workflow setup writes durable instructions into the shared OpenClaw workspace and explicitly directs the Agent to use Rune before every response. These instructions are not limited to a single memory-related task or session. The mandatory recall and storage directives create two related risk ...[truncated 1571 chars]
Remediation
View remediation

T06 · System Persistence

Error
Location
install.sh:216
Finding

Installer persistently modifies Agent heartbeat instructions

Content
View full analysis
"$HEARTBEAT_FILE" << 'EOF' # HEARTBEAT.md ## 🧠 Rune Memory Maintenance (ACTIVE) - `rune expire` — prune expired working memory - `rune inject --output ~/.openclaw/workspace/FACTS.md` — regenerate intelligent context - `rune consolidate --auto-prioritize` — optimize memory (weekly) ## Next Actions Check `rune next-task` for intelligent task recommendations based on memory patterns. EOF echo " ✅ HEARTBEAT.md created with Rune integration" else if ! grep -q "rune" "$HEARTBEAT_FILE"; then echo "" >> "$HEARTBEAT_FILE" echo "## 🧠 Rune Memory Maintenance (ACTIVE)" >> "$HEARTBEAT_FILE" echo '- `rune expire` — prune expired working memory' >> "$HEARTBEAT_FILE" echo '- `rune inject --output ~/.openclaw/workspace/FACTS.md` — regenerate intelligent context' >> "$HEARTBEAT_FILE" echo '- `rune consolidate --auto-prioritize` — optimize memory (weekly)' >> "$HEARTBEAT_FILE" echo "" >> "$HEARTBEAT_FILE" echo "Check \`rune next-task\` for intelligent task recommendations." >> "$HEARTBEAT_FILE" echo " ✅ Rune integration added to existing HEARTBEAT.md" else echo " ℹ️ Rune integration already present" fi fi ``` ### Technical Analysis The standard installer creates or modifies `~/.openclaw/workspace/HEARTBEAT.md`. This is a persistent workspace-level integration rather than a temporary CLI operation. The inserted section encourages recurring memory maintenance, context-file generation, consolidation, and autonomous task selection. If OpenClaw interprets heartbeat content operationally, Rune-generated data can repeatedly enter Agent c ...[truncated 1425 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
') .description('Extract facts and session summary from a markdown file') .option('--dry-run', 'Print extracted facts without writing') .option('--engine <engine>', 'Extraction engine: anthropic, openai, ollama, or auto (default: auto)', 'auto') .option('--model <model>', 'Model name (default depends on engine)') .option('--force', 'Re-extract even if file was already processed') .option('--verbose', 'Show extraction prompt and raw model response') ``` ```js program.command('extract-all <direct ...[truncated 2274 chars]:447
Finding

Automatic engine selection can transmit complete file contents to cloud APIs

Content
View full analysis
controller.abort(), OPENAI_TIMEOUT_MS); let response; try { response = await fetch(OPENAI_API_URL, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}` }, body: JSON.stringify({ model, messages: [ { role: 'system', content: systemPrompt }, { role: 'user', content: userMessage } ], temperature: 0.2, max_tokens: 2048, response_format: { type: 'json_object' } }), signal: controller.signal }); ``` ```js async function generateOnceAnthropic(content, { model, verbose = false }) { const apiKey = process.env.ANTHROPIC_API_KEY; if (!apiKey) { throw new UserError('ANTHROPIC_API_KEY not set. Use --engine ollama or set the env var.'); } const systemPrompt = buildPrompt('').replace(/\nTranscript:\n$/, '').trim(); const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), ANTHROPIC_TIMEOUT_MS); let response; try { response = await fetch(ANTHROPIC_API_URL, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' }, body: JSON.stri ...[truncated 3529 chars]
Remediation
View remediation

T06 · System Persistence

Error
Location
uninstall.sh:23
Finding

Uninstaller fails to remove Rune CLI and persistent workspace artifacts

Content
View full analysis
/dev/null || echo " (CLI not globally installed)" # Remove memory database if [[ -f "$MEMORY_DB" ]]; then echo "🗄️ Removing memory database..." rm "$MEMORY_DB" fi # Remove FACTS.md if it was generated by Rune FACTS_FILE="$HOME/.openclaw/workspace/FACTS.md" if [[ -f "$FACTS_FILE" ]] && grep -q "Generated by brokkr-mem" "$FACTS_FILE" 2>/dev/null; then echo "📋 Removing generated FACTS.md..." rm "$FACTS_FILE" fi # Clean up heartbeat integration HEARTBEAT_FILE="$HOME/.openclaw/workspace/HEARTBEAT.md" if [[ -f "$HEARTBEAT_FILE" ]] && grep -q "brokkr-mem" "$HEARTBEAT_FILE"; then echo "📝 Cleaning HEARTBEAT.md integration..." # Remove Rune section (basic cleanup) sed -i '/## 🧠 Rune Memory Maintenance/,/^$/d' "$HEARTBEAT_FILE" 2>/dev/null || true sed -i '/brokkr-mem/d' "$HEARTBEAT_FILE" 2>/dev/null || true fi ``` The installer instead installs Rune under its current package name: ```bash # 4. Install CLI globally echo "4. Installing rune CLI globally..." if ! npm install -g . --silent; then echo "❌ Failed to install rune CLI globally" exit 1 fi ``` The separate workflow setup also creates artifacts that the uninstaller does not address: ```bash cat > ~/.openclaw/workspace/scripts/session-start.sh << 'SESSIONEOF' ... SESSIONEOF cat > ~/.openclaw/workspace/scripts/context-inject.sh << 'CONTEXTEOF' ... CONTEXTEOF cat > ~/.openclaw/workspace/MANDATORY-MEMORY-WORKFLOW.md << 'WORKFLOWEOF' ... WORKFLOWEOF ``` ### Technical Analysis The package is installed globally as `rune`, but the uninstaller attempts to remove `brokkr-mem`. Heartbeat cleanup is conditional on finding the obsolete `brokkr-mem` marker, while the current installer writes `rune`. Consequent ...[truncated 1269 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
install.sh:179
Finding

Unpinned npm dependency installation exposes users to avoidable supply-chain execution

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (84)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 30)May include surrounding context.

md
#### Security
- **FIXED RCE vulnerability in context-inject.sh** - Added input sanitization to prevent shell injection attacks
- **CVE Impact**: Unsanitized $TOPIC parameter was vulnerable to command injection (e.g., `'; rm -rf / #'`)
- **Resolution**: Applied same sanitization pattern as rune-session-handler.sh to workflow scripts
- **Scope**: Fixed both local scripts and setup-workflow.sh generated scripts

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 115)May include surrounding context.

md
#### Security
- **FIXED RCE vulnerability in context-inject.sh** - Added input sanitization to prevent shell injection attacks
- **CVE Impact**: Unsanitized $TOPIC parameter was vulnerable to command injection (e.g., `'; rm -rf / #'`)
- **Resolution**: Applied same sanitization pattern as rune-session-handler.sh to workflow scripts
- **Scope**: Fixed both local scripts and setup-workflow.sh generated scripts

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · CHANGELOG.md (reported line 30)May include surrounding context.

md
#### Security
- **FIXED RCE vulnerability in context-inject.sh** - Added input sanitization to prevent shell injection attacks
- **CVE Impact**: Unsanitized $TOPIC parameter was vulnerable to command injection (e.g., `'; rm -rf / #'`)
- **Resolution**: Applied same sanitization pattern as rune-session-handler.sh to workflow scripts
- **Scope**: Fixed both local scripts and setup-workflow.sh generated scripts

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · CHANGELOG.md (reported line 115)May include surrounding context.

md
#### Security
- **FIXED RCE vulnerability in context-inject.sh** - Added input sanitization to prevent shell injection attacks
- **CVE Impact**: Unsanitized $TOPIC parameter was vulnerable to command injection (e.g., `'; rm -rf / #'`)
- **Resolution**: Applied same sanitization pattern as rune-session-handler.sh to workflow scripts
- **Scope**: Fixed both local scripts and setup-workflow.sh generated scripts

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · CHANGELOG.md (reported line 30)May include surrounding context.

md
and installation metadata
- **Registry sync** - Resolved metadata inconsistencies caused by previous failed publications

## [1.1.3] - 2026-02-25

### 🚨 CRITICAL SECURITY FIX

#### Security
- **FIXED RCE vulnerability in context-inject.sh** - Added input sanitization to prevent shell injection attacks
- **CVE Impact**: Unsanitized $TOPIC parameter was vulnerable to command injection (e.g., `'; rm -rf / #'`)
- **Resolution**: Applied same sanitization pattern as rune-session-handler.sh to workflow scripts
- **Scope**: Fixed both local scripts and setup-workflow.sh generated scripts

#### Changed
- **setup-workflow.sh** - Now creates secure context-inject.sh with input sanitization
- **Security documentation** - Enhanced warnings about input validation in workflow scripts

#### Lessons
- **Shell injection prevention** - ALL user inputs in shell scripts must be sanitized
- **Security review process** - Third-party security analysis caught vulnerability we missed

## [1.1.2] - 2026-02-2

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SECURITY.md (reported line 46)May include surrounding context.

md
# Skip safety prompts (automated installs)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill openly indicates it may modify and later remove workspace integration files and globally installed packages, which creates integrity and availability risk if users are not given strong upfront warning and uninstall safeguards. In shared or important workspaces, automatic edits to HEARTBEAT.md and generated FACTS.md can disrupt existing workflows or destroy user changes.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

The skill supports selectable external or local model providers for scoring and extraction, including cloud APIs elsewhere in the document, which can send user-derived context or facts outside the local environment. For a memory system, that materially raises privacy and data-exfiltration risk because stored facts, project data, or behavioral metadata may be transmitted to third-party model services.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

bash
# Tune relevance scoring
rune score "your query" --threshold 0.6 --model llama3.1:8b

# Configure forgetting curves  
rune forget --decay-rate 0.03 --grace-days 45

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · install.sh (reported line 34)May include surrounding context.

sh
echo "Options:"
            echo "  --dry-run    Show what would be installed without making changes"
            echo "  --verify     Verify package integrity and dependencies"
            echo "  --force      Skip safety checks and prompts"
            echo "  -h, --help   Show this help message"
            echo ""
            echo "The installer will:"

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The forgetting-curve routine automatically archives and then deletes active facts once confidence falls below a threshold, with no user-facing notice or approval gate. Because this skill is an AI memory system, silent removal of memory entries can materially alter future agent behavior, erase important context, and create integrity and availability issues that may be hard to detect until after decisions are affected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI exposes broad autonomous capabilities far beyond a stated memory/context system, including project-state management, task recommendation, notification routing, and self-review workflows. This kind of scope expansion increases the attack surface and can enable unintended side effects or operator confusion about what the tool is permitted to do, especially when integrated into an agent environment that may call commands automatically.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/extract.js:274

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/test-runner.js:343