Claw Memory Lite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:00 PM UTC
• Version: 1.0.1

Overview

This skill is a local memory tool, but it asks users to enable persistent automation and stores broad memory content in plaintext with under-scoped install and safety controls.

Review carefully before installing. Use a pinned release or commit, avoid the mutable curl install path, back up MEMORY.md, and do not enable heartbeat or cron until you are comfortable with daily local writes. Treat insight.db as sensitive because it may contain copied memory records, configuration details, and credential-related notes; restrict file permissions and avoid storing secrets in memory files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: docs/installation.md:68

Finding

Mutable Remote Scripts Are Downloaded and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/nightly_meta_extract.py:27

Finding

Potentially Sensitive Memory Is Copied into a Plaintext Searchable Database

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/trust_scorer.py:89

Finding

Undeclared Persistent Trust Scoring Can Bias External Tool Selection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nightly_meta_extract.py:243

Finding

Extraction Log Update Can Delete Existing MEMORY.md Content

Content

View full analysis

1: table_start = parts[1].find('|') if table_start > 0: lines = parts[1][table_start:].split('\n') insert_pos = 1 # After header while insert_pos < len(lines) and lines[insert_pos].startswith('|'): insert_pos += 1 lines.insert(insert_pos, new_row.strip()) parts[1] = '\n'.join(lines) content = table_marker + parts[1] # Update last updated timestamp content = re.sub( r'\*Last Updated：[^*]+\*', f'*Last updated: {today} | Next auto-extraction: during heartbeat check*', content ) MEMORY_MD.write_text(content) ``` ### Technical Analysis After splitting the file at `table_marker`, the function reconstructs the result as: ```python content = table_marker + parts[1] ``` This omits `parts[0]`, which contains all content before the extraction-log marker. The function then overwrites the original file directly. It does not create a backup, use atomic replacement, or verify that unrelated content was preserved. The use of `content.split(table_marker)` without a m ...[truncated 986 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: docs/api.md:153

Finding

Documented Query Function Constructs LIMIT Clause Through String Interpolation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (20)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/regressions_guardrail.py (reported line 48)May include surrounding context.

python

"summary": lines[0],
                "details": lines
            })
    return rules

def apply_guardrails():
    """Run guardrail check and output active rules."""

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to install the skill via npx skills add timothysong0w0/claw-memory-lite --agent openclaw without pinning a specific version or immutable commit. That creates a supply-chain risk: a later compromised or malicious update to the referenced package/repository could be fetched and executed by users at install time, especially because this is an installation command presented as the recommended path.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The installation command uses npx skills add ... without pinning a specific version of the package or referenced skill artifact. This can cause users to fetch and execute whatever version is current at install time, creating a supply-chain risk if the package, registry entry, or dependency chain is updated maliciously or compromised later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing documentation. The 'Delete Record' section shows a function that permanently removes records, but the surrounding documentation does not warn that the action is destructive or irreversible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation provides a function to export all memory records to an arbitrary JSON file path without any warning about sensitive data exposure or handling requirements. Because the dataset may contain long-term memory content, source files, and timestamps, normal use could lead to accidental exfiltration, insecure storage, or over-broad sharing of potentially sensitive information.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The installation guide instructs users to run npx skills add ... without pinning a specific version or commit of the installer or referenced package. This creates a supply-chain risk because future package changes, account compromise, or a malicious republish could cause different code to execute than what the user reviewed in the repository.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

These instructions say the installer will automatically copy scripts, initialize a database, and update HEARTBEAT.md, but they do not clearly warn that workspace files will be modified. Silent file writes and configuration changes increase the chance of unintended persistence or unexpected environment modification, especially in an agent workspace.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The guide recommends adding a cron job that will execute the extraction script daily, creating ongoing persistence on the host. Even if intended for maintenance, recurring execution expands risk because later script modifications, repository compromise, or unsafe script behavior would be triggered automatically without fresh user review.

Content

Scanner excerpt · docs/installation.md (reported line 102)May include surrounding context.

bash

# Edit crontab
crontab -e

# Add daily extraction at 3 AM UTC
0 3 * * * cd /home/node/.openclaw/workspace && python3 scripts/extract_memory.py

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/integration.md (reported line 29)May include surrounding context.

bash

# Edit crontab
crontab -e

# Daily extraction at 3 AM UTC
0 3 * * * cd /home/node/.openclaw/workspace && python3 scripts/extract_memory.py >> logs/memory_extraction.log 2>&1

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation recommends installing a skill via npx skills add app/skills@weather without pinning a specific version or immutable source. This can lead to non-reproducible installs and supply-chain risk if the upstream package changes or is compromised, though in this README example context it appears instructional rather than intentionally harmful.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The text states that all Python execution must use /root/.local/bin/uv, which imposes a fixed tooling/locale-style operational policy on all users without presenting it as optional or context-specific. This is a natural-language policy constraint that is not justified as environment-specific in the file and does not offer user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This script prints raw database record content directly to stdout, and the database is explicitly described as long-term memory storage, which may contain sensitive operational, project, communication, or security data. In CLI and agent contexts, stdout is often logged, captured, or surfaced to other components, so unrestricted output can cause accidental data exposure even without an external attacker.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level documentation claims the script 'Combines' daily extraction, guardrail regression handling, friction detection, and dynamic trust scoring as core behavior. In practice, L54-L277 implement only markdown parsing, SQLite writes, and MEMORY.md updates; the other pipelines are merely attempted imports and optional function calls at L323-L347, with graceful skipping if absent. This is an active mismatch between documentation and actual implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persists extracted content from workspace memory files into a SQLite database automatically, and those files may contain sensitive notes, credentials, or operational context. In an agent skill context, silent long-term storage increases data retention risk and broadens the blast radius if the database is later accessed by other components or an attacker.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script updates MEMORY.md automatically, modifying a user-visible workspace file without an explicit confirmation step. In this context, silent rewriting can tamper with audit/history records, surprise users, and make it harder to distinguish original notes from tool-generated content, especially when run on a schedule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file instructs users to run scheduled and manual extraction commands and states that the extraction script automatically updates MEMORY.md. While the behavior is described, there is no clear caution that these operations will write to or alter local user data files on an ongoing basis, which is the kind of user-impacting behavior that should be explicitly warned about in markdown guidance.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · docs/integration.md (reported line 238)May include surrounding context.

md

- [API Reference](api.md) - Database schema and functions
- [Examples](../examples/) - Sample usage patterns
- [Contributing](../README.md#contributing) - Extend functionality

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README shows an execution command for extraction immediately after a preview mode, but does not clearly warn that the non-review invocation will modify persistent state. Users may run the command without understanding it writes to the database or changes stored memory data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring states the friction categorization is based on "generic English," which means reports in other languages may not be handled correctly. This creates a natural-language policy concern because the skill implicitly assumes one language without offering a choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.