Back to skill

Security audit

Agent Memory System New

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its memory-management purpose, but it installs recurring cron jobs by default and has unsafe path handling that can write or delete outside its intended folders.

Install only if you are comfortable with a skill managing your OpenClaw memory files and scheduled jobs. Review the scripts first, avoid enabling cron by default, back up memory data, and do not pass lesson or skill names containing slashes, dots, or path components until the path traversal issue is fixed.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Warning
Location
install.sh:203
Finding

Installer Adds Recurring Cron Jobs by Default

Content
View full analysis
/dev/null | grep -q "agent-memory-system"; then log_info "cron 任务已存在,跳过" else # 添加 cron 任务 ( crontab -l 2>/dev/null || true echo "# agent-memory-system - 每周日凌晨执行 GC" echo "0 0 * * 0 $GC_SCRIPT >> $LOG_DIR/memory-gc.log 2>&1" echo "# agent-memory-system - 每晚反思" echo "45 23 * * * $REFLECTION_SCRIPT >> $LOG_DIR/nightly-reflection.log 2>&1" ) | crontab - log_info "✓ cron 任务已配置" fi ``` The secondary installer presents the configuration as optional, but defaults to enabling it: ```bash # 5. 配置 crontab(可选) echo "⏰ 配置定时任务..." read -p "是否配置自动 GC 和反思任务?(y/n, 默认:y): " CONFIG_CRON CONFIG_CRON="${CONFIG_CRON:-y}" if [[ "$CONFIG_CRON" == "y" || "$CONFIG_CRON" == "Y" ]]; then # 检查 crontab 是否已存在相关配置 if crontab -l 2>/dev/null | grep -q "memory-gc.sh"; then echo "⚠️ 检测到已有 memory-gc.sh 配置,跳过" else # 添加 GC 任务(每周日 00:00) (crontab -l 2>/dev/null | grep -v "memory-gc.sh" || true; echo "0 0 * * 0 $SCRIPT_DIR/memory-gc.sh") | crontab - echo "✅ 已添加每周 GC 任务" fi if crontab -l 2>/dev/null | grep -q "nightly-reflection.sh"; then echo "⚠️ 检测到已有 nightly-reflection.sh 配置,跳过" else # 添加反思任务(每天 23:45) (crontab -l 2>/dev/null | grep -v "nightly-reflection.sh" || true; echo "45 23 * * * $SCRIPT_DIR/nightly-reflection.sh") | crontab - echo "✅ 已添加每日反思任务" fi else echo "⏭️ 跳过 crontab 配置,可以手动添加" fi ``` ### Technical Analysis The primary installer modifies the invoking ...[truncated 2161 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/extract-skill.sh:14
Finding

Unsanitized Skill and Lesson Names Permit Path Traversal and Recursive Deletion

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (32)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The code partially matches the description in that it implements a simple temperature-based archival workflow and reporting for markdown memory files. However, it does not implement '知识提炼' (knowledge extraction/refinement) or any mechanism that turns experience into reusable skills; it only moves old files, counts files by age/category, measures disk usage, and generates a report. Additionally, although filesystem operations may be implicit for such a tool, the declared permissions are empty while the script materially writes to disk by creating directories, moving files, and generating reports. So the description overstates the intelligence/functionality and omits significant file-modification behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The description promises a broader long-term memory system with temperature-based lifecycle management, automatic archival, and knowledge distillation into reusable skills. The supplied code chunk only implements a nightly maintenance/reflection script: it validates files/directories, gathers simple counts, creates a reflection stub, appends basic health stats to INDEX.md, and detects stale logs. While this supports a memory workflow, key advertised capabilities are missing or only hinted at. In particular, there is no temperature model, no automatic archival action, and no substantive knowledge extraction logic. Therefore the description overstates what this code actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The markdown file states that the skill performs weekly garbage collection and nightly validation/statistics, and later instructs users to configure cron jobs for those scripts. It does not warn that these automated tasks may modify, archive, or otherwise affect stored memory data, which is relevant to user data integrity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

md
clawhub install agent-memory-system

# 手动创建目录
mkdir -p ~/.openclaw/workspace/memory/{lessons,decisions,people,reflections,.archive}

# 手动配置 cron
crontab -e

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The README instructs users to create persistent cron jobs that execute skill-managed scripts on a recurring basis. Persistence is security-relevant because it causes unattended execution over time, increasing the blast radius of any unsafe logic later found in those scripts and making data processing occur outside the user's immediate awareness.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md
mkdir -p ~/.openclaw/workspace/memory/{lessons,decisions,people,reflections,.archive}

# 手动配置 cron
crontab -e
# 添加:
# 0 0 * * 0 ~/.openclaw/workspace/skills/agent-memory-system/scripts/memory-gc.sh
# 45 23 * * * ~/.openclaw/workspace/skills/agent-memory-system/scripts/nightly-reflection.sh

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown instructs users to run automated archival and reflection scripts that move files, generate reports, and modify memory data, but it does not warn about data-loss, overwrite, or unintended filesystem side effects. In an agent skill context, normalizing unattended file operations increases risk because users may enable automation without understanding what data will be touched or how to recover from mistakes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

2. 初始化目录

bash
mkdir -p ~/.openclaw/workspace/memory/{lessons,decisions,people,reflections,.archive}
touch ~/.openclaw/workspace/memory/INDEX.md
touch ~/.openclaw/workspace/MEMORY.md

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill explicitly instructs the user to install cron jobs that execute local scripts on a recurring schedule, which establishes persistence on the host. In a skill ecosystem, scheduled execution is security-relevant because any later modification of those referenced scripts, their paths, or their dependencies can convert a benign maintenance task into repeated unauthorized actions.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 添加以下内容
0 0 * * 0 ~/.openclaw/workspace/skills/agent-memory-system/scripts/memory-gc.sh >> ~/.openclaw/logs/memory-gc.log 2>&1

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

假设有一个教训文件: memory/lessons/deploy-without-test.md

./scripts/extract-skill.sh deploy-without-test

会生成: skills/deploy-without-test/SKILL.md

然后手动完善 SKILL.md 内容

text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script modifies the user's crontab, which changes persistent execution behavior at the user-account level. Even though this occurs in uninstall here, the same capability is central to the installer and is security-relevant because cron-based persistence can be abused if the installed scripts or their directories are later tampered with.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Reading the current crontab is part of managing persistent scheduled execution and indicates this skill interacts with user-session persistence mechanisms. In context this is not covert, but it remains security-significant because any cron management logic can be leveraged to maintain recurring execution.

Content

Scanner excerpt · install.sh (reported line 52)May include surrounding context.

sh
# 移除 cron 任务
    log_info "移除 cron 任务..."
    (
        crontab -l 2>/dev/null | grep -v "agent-memory-system" || true
    ) | crontab - 2>/dev/null || log_warn "无法修改 crontab"
    
    # 询问是否删除数据

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Writing to crontab establishes or changes persistent scheduled execution for the user. This is dangerous from a security perspective because it creates an automated execution path that may survive the initial install and can later run altered scripts without additional prompts.

Content

Scanner excerpt · install.sh (reported line 53)May include surrounding context.

sh
log_info "移除 cron 任务..."
    (
        crontab -l 2>/dev/null | grep -v "agent-memory-system" || true
    ) | crontab - 2>/dev/null || log_warn "无法修改 crontab"
    
    # 询问是否删除数据
    if [ -d "$MEMORY_DIR" ]; then

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 98)May include surrounding context.

sh
fi
    
    # cron
    if command -v crontab &> /dev/null; then
        log_info "✓ crontab: 可用"
    else
        log_warn "✗ crontab 未安装(cron 任务将跳过)"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer creates persistent cron jobs that continue executing after installation, which is a form of persistence beyond one-time setup. Although periodic GC and nightly reflection are consistent with the memory-system purpose, scheduled execution increases attack surface because the referenced scripts will run automatically in the future and may process changing data or be modified later.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

Inspecting the existing crontab is part of adding recurring tasks and therefore contributes to persistence behavior. While normal for an installer, it is still security-relevant because it precedes automatic registration of future code execution.

Content

Scanner excerpt · install.sh (reported line 205)May include surrounding context.

sh
mkdir -p "$LOG_DIR"
    
    # 检查 cron 任务是否已存在
    if crontab -l 2>/dev/null | grep -q "agent-memory-system"; then
        log_info "cron 任务已存在,跳过"
    else
        # 添加 cron 任务

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

This line reads the existing crontab during the block that appends scheduled jobs, directly participating in persistence setup. The main risk is not immediate exploitation by this line alone, but that it enables unattended future execution of local scripts controlled by filesystem state.

Content

Scanner excerpt · install.sh (reported line 210)May include surrounding context.

sh
else
        # 添加 cron 任务
        (
            crontab -l 2>/dev/null || true
            echo "# agent-memory-system - 每周日凌晨执行 GC"
            echo "0 0 * * 0 $GC_SCRIPT >> $LOG_DIR/memory-gc.log 2>&1"
            echo "# agent-memory-system - 每晚反思"

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 257)May include surrounding context.

sh
fi
    
    # 检查 cron
    if crontab -l 2>/dev/null | grep -q "agent-memory-system"; then
        log_info "✓ cron 任务已配置"
        ((CHECKS_PASSED++))
    fi

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The usage text presents the script as a simple extraction tool, but the implementation can recursively delete an existing skill directory and later modify the source lesson file. This mismatch is dangerous because users may invoke it expecting read-mostly behavior, leading to unintended destructive changes and making social-engineering or operator error more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This shell script includes natural-language comments, usage text, prompts, and status messages only in Chinese, which forces a specific language for users interacting with the skill. The policy allows locale constraints only when they are optional or clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script is advertised as extracting a reusable skill from a lesson, but it also mutates the source lesson by rewriting frontmatter fields such as status and skill-path. This side effect can unexpectedly alter user data, break workflows that rely on lesson immutability, and create integrity issues if the script is run in automation or against untrusted workspace paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script's user-facing comments, prompts, and status output are written in Chinese, including the installation prompt at L18. This imposes a specific language on all users without opt-in or any indication that the skill is intentionally limited to Chinese-speaking environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer modifies the user's persistent crontab, which creates ongoing scheduled execution outside the immediate scope of a one-time setup script. Although the script asks for consent, persistence mechanisms are security-relevant because they can continue running code automatically and may be unexpected or hard to audit later.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

Reading and managing crontab here is part of establishing persistent scheduled execution for the skill. In an agent-memory context, automatic recurring jobs increase risk because they can continue accessing or modifying workspace data after installation, and cron persistence is a common mechanism abused for stealthy long-term execution.

Content

Scanner excerpt · scripts/install.sh (reported line 50)May include surrounding context.

sh
if [[ "$CONFIG_CRON" == "y" || "$CONFIG_CRON" == "Y" ]]; then
    # 检查 crontab 是否已存在相关配置
    if crontab -l 2>/dev/null | grep -q "memory-gc.sh"; then
        echo "⚠️  检测到已有 memory-gc.sh 配置,跳过"
    else
        # 添加 GC 任务(每周日 00:00)

Session Persistence

Medium
Category
Rogue Agent
Confidence
98% confidence
Finding

This line writes a new cron entry that will run memory-gc.sh every week, creating persistent unattended execution. Even if the current script is non-malicious, this expands the trust boundary because any later change to that script or its path will execute automatically under the user's account.

Content

Scanner excerpt · scripts/install.sh (reported line 54)May include surrounding context.

sh
echo "⚠️  检测到已有 memory-gc.sh 配置,跳过"
    else
        # 添加 GC 任务(每周日 00:00)
        (crontab -l 2>/dev/null | grep -v "memory-gc.sh" || true; echo "0 0 * * 0 $SCRIPT_DIR/memory-gc.sh") | crontab -
        echo "✅ 已添加每周 GC 任务"
    fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

This crontab check is part of a persistence workflow for a second recurring task. In this skill context, nightly automated reflection jobs likely process memory data regularly, so unattended execution could repeatedly touch sensitive workspace contents without ongoing user awareness.

Content

Scanner excerpt · scripts/install.sh (reported line 58)May include surrounding context.

sh
echo "✅ 已添加每周 GC 任务"
    fi
    
    if crontab -l 2>/dev/null | grep -q "nightly-reflection.sh"; then
        echo "⚠️  检测到已有 nightly-reflection.sh 配置,跳过"
    else
        # 添加反思任务(每天 23:45)