Agent Memory System New

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:19 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its memory-management purpose, but it installs recurring cron jobs by default and has unsafe path handling that can write or delete outside its intended folders.

Install only if you are comfortable with a skill managing your OpenClaw memory files and scheduled jobs. Review the scripts first, avoid enabling cron by default, back up memory data, and do not pass lesson or skill names containing slashes, dots, or path components until the path traversal issue is fixed.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

• Location: install.sh:203
• Finding: Installer Adds Recurring Cron Jobs by Default<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:203-215` **Additional Location**: `scripts/install.sh:43-63` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: Medium ### Vulnerable Code ```bash # 5. 配置 cron 任务 log_step "配置 cron 任务..." GC_SCRIPT="$SCRIPT_DIR/scripts/memory-gc.sh" REFLECTION_SCRIPT="$SCRIPT_DIR/scripts/nightly-reflection.sh" LOG_DIR="$HOME/.openclaw/logs" mkdir -p "$LOG_DIR" # 检查 cron 任务是否已存在 if crontab -l 2>/dev/null | grep -q "agent-memory-system"; then log_info "cron 任务已存在，跳过" else # 添加 cron 任务 ( crontab -l 2>/dev/null || true echo "# agent-memory-system - 每周日凌晨执行 GC" echo "0 0 * * 0 $GC_SCRIPT >> $LOG_DIR/memory-gc.log 2>&1" echo "# agent-memory-system - 每晚反思" echo "45 23 * * * $REFLECTION_SCRIPT >> $LOG_DIR/nightly-reflection.log 2>&1" ) | crontab - log_info "✓ cron 任务已配置" fi ``` The secondary installer presents the configuration as optional, but defaults to enabling it: ```bash # 5. 配置 crontab（可选） echo "⏰ 配置定时任务..." read -p "是否配置自动 GC 和反思任务？(y/n, 默认:y): " CONFIG_CRON CONFIG_CRON="${CONFIG_CRON:-y}" if [[ "$CONFIG_CRON" == "y" || "$CONFIG_CRON" == "Y" ]]; then # 检查 crontab 是否已存在相关配置 if crontab -l 2>/dev/null | grep -q "memory-gc.sh"; then echo "⚠️ 检测到已有 memory-gc.sh 配置，跳过" else # 添加 GC 任务（每周日 00:00） (crontab -l 2>/dev/null | grep -v "memory-gc.sh" || true; echo "0 0 * * 0 $SCRIPT_DIR/memory-gc.sh") | crontab - echo "✅ 已添加每周 GC 任务" fi if crontab -l 2>/dev/null | grep -q "nightly-reflection.sh"; then echo "⚠️ 检测到已有 nightly-reflection.sh 配置，跳过" else # 添加反思任务（每天 23:45） (crontab -l 2>/dev/null | grep -v "nightly-reflection.sh" || true; echo "45 23 * * * $SCRIPT_DIR/nightly-reflection.sh") | crontab - echo "✅ 已添加每日反思任务" fi else echo "⏭️ 跳过 crontab 配置，可以手动添加" fi ``` ### Technical Analysis The primary installer modifies the invoking ...[truncated 2161 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not modify the crontab in the default installation path. 2. Require explicit opt-in and default the prompt to `N`. 3. Display the exact cron entries and their execution frequency before requesting approval. 4. Add a noninteractive flag such as `--enable-cron`; without that flag, skip persistence configuration. 5. Check that `crontab` is available immediately before every use and handle failure without partially completing installation. 6. Install scheduled scripts into a stable, user-owned directory and reject scripts that are writable by other users. 7. Provide dedicated `--status`, `--disable-cron`, and `--uninstall` operations that identify entries precisely rather than relying only on broad substring matching. 8. Document that modifying or replacing the installed scripts changes the code cron will execute. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract-skill.sh:14
• Finding: Unsanitized Skill and Lesson Names Permit Path Traversal and Recursive Deletion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:14-19, 74-75, 96-111, 239-250` **Vulnerability Type**: Path traversal leading to out-of-scope file creation, modification, and deletion **Risk Level**: High ### Vulnerable Code User-controlled command-line arguments are used directly to construct filesystem paths: ```bash LESSON_NAME="$1" SKILL_NAME="${2:-$LESSON_NAME}" WORKSPACE="${WORKSPACE:-$HOME/.openclaw/workspace}" LESSONS_DIR="$WORKSPACE/memory/lessons" SKILLS_DIR="$WORKSPACE/skills" ``` ```bash LESSON_FILE="$LESSONS_DIR/${LESSON_NAME}.md" SKILL_DIR="$SKILLS_DIR/$SKILL_NAME" ``` An escaped skill path can be recursively deleted and recreated: ```bash # 检查技能目录是否已存在 if [ -d "$SKILL_DIR" ]; then log_warn "技能目录已存在：$SKILL_DIR" read -p "是否覆盖？(y/N): " confirm if [ "$confirm" != "y" ] && [ "$confirm" != "Y" ]; then log_info "已取消" exit 0 fi rm -rf "$SKILL_DIR" fi # 创建技能目录结构 mkdir -p "$SKILL_DIR" mkdir -p "$SKILL_DIR/.clawhub" mkdir -p "$SKILL_DIR/scripts" ``` An escaped lesson path can also be edited in place: ```bash # 更新源课程状态 if [ -f "$LESSON_FILE" ]; then # 检查是否有 frontmatter if head -1 "$LESSON_FILE" | grep -q "^---"; then # 有 frontmatter，添加 status 和 skill-path if grep -q "^status:" "$LESSON_FILE"; then sed -i "s/^status:.*/status: promoted_to_skill/" "$LESSON_FILE" else sed -i "/^---$/a status: promoted_to_skill" "$LESSON_FILE" fi if ! grep -q "^skill-path:" "$LESSON_FILE"; then sed -i "/^status: promoted_to_skill/a skill-path: $SKILL_DIR" "$LESSON_FILE" fi fi log_info "已更新源课程状态" fi ``` ### Technical Analysis Neither `LESSON_NAME` nor `SKILL_NAME` is restricted to a safe filename. Quoting the variables prevents shell word splitting and command substitution, but it does not prevent filesystem traversal. Inputs containing `../` are resolved by the operating system and can escape the inten ...[truncated 2370 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict both names to a conservative basename format before constructing any path: ```bash validate_name() { [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] && [[ "$1" != "." && "$1" != ".." ]] } validate_name "$LESSON_NAME" || { log_error "Invalid lesson name" exit 1 } validate_name "$SKILL_NAME" || { log_error "Invalid skill name" exit 1 } ``` 2. Explicitly reject `/`, backslashes, `..`, control characters, newline characters, and leading hyphens. 3. Canonicalize base and destination paths with `realpath` or `realpath -m`. 4. Before every write, edit, or deletion, verify that the canonical destination remains beneath the expected canonical base directory. 5. Refuse to operate on symbolic links and verify the path again immediately before `rm -rf` to reduce time-of-check/time-of-use risk. 6. Replace broad recursive deletion with removal of only known generated files where possible. 7. Require a typed confirmation containing the full canonical target path before any recursive deletion. 8. Use `--` before path operands where supported, such as `rm -rf -- "$SKILL_DIR"` and `sed -i ... -- "$LESSON_FILE"`, as defense in depth against option-like paths. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The code partially matches the description in that it implements a simple temperature-based archival workflow and reporting for markdown memory files. However, it does not implement '知识提炼' (knowledge extraction/refinement) or any mechanism that turns experience into reusable skills; it only moves old files, counts files by age/category, measures disk usage, and generates a report. Additionally, although filesystem operations may be implicit for such a tool, the declared permissions are empty while the script materially writes to disk by creating directories, moving files, and generating reports. So the description overstates the intelligence/functionality and omits significant file-modification behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The description promises a broader long-term memory system with temperature-based lifecycle management, automatic archival, and knowledge distillation into reusable skills. The supplied code chunk only implements a nightly maintenance/reflection script: it validates files/directories, gathers simple counts, creates a reflection stub, appends basic health stats to INDEX.md, and detects stale logs. While this supports a memory workflow, key advertised capabilities are missing or only hinted at. In particular, there is no temperature model, no automatic archival action, and no substantive knowledge extraction logic. Therefore the description overstates what this code actually does.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The markdown file states that the skill performs weekly garbage collection and nightly validation/statistics, and later instructs users to configure cron jobs for those scripts. It does not warn that these automated tasks may modify, archive, or otherwise affect stored memory data, which is relevant to user data integrity.

Session Persistence

Medium

• Category: Rogue Agent

Content

clawhub install agent-memory-system

# 手动创建目录
mkdir -p ~/.openclaw/workspace/memory/{lessons,decisions,people,reflections,.archive}

# 手动配置 cron
crontab -e

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p ~/.openclaw/workspace/memory/{lessons,decisions,people,reflections,.archive}

# 手动配置 cron
crontab -e
# 添加:
# 0 0 * * 0 ~/.openclaw/workspace/skills/agent-memory-system/scripts/memory-gc.sh
# 45 23 * * * ~/.openclaw/workspace/skills/agent-memory-system/scripts/nightly-reflection.sh

• Confidence: 91% confidence
• Finding: The README instructs users to create persistent cron jobs that execute skill-managed scripts on a recurring basis. Persistence is security-relevant because it causes unattended execution over time, increasing the blast radius of any unsafe logic later found in those scripts and making data processing occur outside the user's immediate awareness.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown instructs users to run automated archival and reflection scripts that move files, generate reports, and modify memory data, but it does not warn about data-loss, overwrite, or unintended filesystem side effects. In an agent skill context, normalizing unattended file operations increases risk because users may enable automation without understanding what data will be touched or how to recover from mistakes.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. 初始化目录

```bash
mkdir -p ~/.openclaw/workspace/memory/{lessons,decisions,people,reflections,.archive}
touch ~/.openclaw/workspace/memory/INDEX.md
touch ~/.openclaw/workspace/MEMORY.md
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 编辑 crontab
crontab -e

# 添加以下内容
0 0 * * 0 ~/.openclaw/workspace/skills/agent-memory-system/scripts/memory-gc.sh >> ~/.openclaw/logs/memory-gc.log 2>&1

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the user to install cron jobs that execute local scripts on a recurring schedule, which establishes persistence on the host. In a skill ecosystem, scheduled execution is security-relevant because any later modification of those referenced scripts, their paths, or their dependencies can convert a benign maintenance task into repeated unauthorized actions.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# 假设有一个教训文件: memory/lessons/deploy-without-test.md
./scripts/extract-skill.sh deploy-without-test

# 会生成: skills/deploy-without-test/SKILL.md
# 然后手动完善 SKILL.md 内容
```

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script modifies the user's crontab, which changes persistent execution behavior at the user-account level. Even though this occurs in uninstall here, the same capability is central to the installer and is security-relevant because cron-based persistence can be abused if the installed scripts or their directories are later tampered with.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 移除 cron 任务
    log_info "移除 cron 任务..."
    (
        crontab -l 2>/dev/null | grep -v "agent-memory-system" || true
    ) | crontab - 2>/dev/null || log_warn "无法修改 crontab"
    
    # 询问是否删除数据

• Confidence: 85% confidence
• Finding: Reading the current crontab is part of managing persistent scheduled execution and indicates this skill interacts with user-session persistence mechanisms. In context this is not covert, but it remains security-significant because any cron management logic can be leveraged to maintain recurring execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

log_info "移除 cron 任务..."
    (
        crontab -l 2>/dev/null | grep -v "agent-memory-system" || true
    ) | crontab - 2>/dev/null || log_warn "无法修改 crontab"
    
    # 询问是否删除数据
    if [ -d "$MEMORY_DIR" ]; then

• Confidence: 90% confidence
• Finding: Writing to crontab establishes or changes persistent scheduled execution for the user. This is dangerous from a security perspective because it creates an automated execution path that may survive the initial install and can later run altered scripts without additional prompts.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi
    
    # cron
    if command -v crontab &> /dev/null; then
        log_info "✓ crontab: 可用"
    else
        log_warn "✗ crontab 未安装（cron 任务将跳过）"

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The installer creates persistent cron jobs that continue executing after installation, which is a form of persistence beyond one-time setup. Although periodic GC and nightly reflection are consistent with the memory-system purpose, scheduled execution increases attack surface because the referenced scripts will run automatically in the future and may process changing data or be modified later.

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$LOG_DIR"
    
    # 检查 cron 任务是否已存在
    if crontab -l 2>/dev/null | grep -q "agent-memory-system"; then
        log_info "cron 任务已存在，跳过"
    else
        # 添加 cron 任务

• Confidence: 86% confidence
• Finding: Inspecting the existing crontab is part of adding recurring tasks and therefore contributes to persistence behavior. While normal for an installer, it is still security-relevant because it precedes automatic registration of future code execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

else
        # 添加 cron 任务
        (
            crontab -l 2>/dev/null || true
            echo "# agent-memory-system - 每周日凌晨执行 GC"
            echo "0 0 * * 0 $GC_SCRIPT >> $LOG_DIR/memory-gc.log 2>&1"
            echo "# agent-memory-system - 每晚反思"

• Confidence: 94% confidence
• Finding: This line reads the existing crontab during the block that appends scheduled jobs, directly participating in persistence setup. The main risk is not immediate exploitation by this line alone, but that it enables unattended future execution of local scripts controlled by filesystem state.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi
    
    # 检查 cron
    if crontab -l 2>/dev/null | grep -q "agent-memory-system"; then
        log_info "✓ cron 任务已配置"
        ((CHECKS_PASSED++))
    fi

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The usage text presents the script as a simple extraction tool, but the implementation can recursively delete an existing skill directory and later modify the source lesson file. This mismatch is dangerous because users may invoke it expecting read-mostly behavior, leading to unintended destructive changes and making social-engineering or operator error more likely.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This shell script includes natural-language comments, usage text, prompts, and status messages only in Chinese, which forces a specific language for users interacting with the skill. The policy allows locale constraints only when they are optional or clearly documented and justified, which is not present here.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script is advertised as extracting a reusable skill from a lesson, but it also mutates the source lesson by rewriting frontmatter fields such as status and skill-path. This side effect can unexpectedly alter user data, break workflows that rely on lesson immutability, and create integrity issues if the script is run in automation or against untrusted workspace paths.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The script's user-facing comments, prompts, and status output are written in Chinese, including the installation prompt at L18. This imposes a specific language on all users without opt-in or any indication that the skill is intentionally limited to Chinese-speaking environments.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The installer modifies the user's persistent crontab, which creates ongoing scheduled execution outside the immediate scope of a one-time setup script. Although the script asks for consent, persistence mechanisms are security-relevant because they can continue running code automatically and may be unexpected or hard to audit later.

Session Persistence

Medium

• Category: Rogue Agent

Content

if [[ "$CONFIG_CRON" == "y" || "$CONFIG_CRON" == "Y" ]]; then
    # 检查 crontab 是否已存在相关配置
    if crontab -l 2>/dev/null | grep -q "memory-gc.sh"; then
        echo "⚠️  检测到已有 memory-gc.sh 配置，跳过"
    else
        # 添加 GC 任务（每周日 00:00）

• Confidence: 96% confidence
• Finding: Reading and managing crontab here is part of establishing persistent scheduled execution for the skill. In an agent-memory context, automatic recurring jobs increase risk because they can continue accessing or modifying workspace data after installation, and cron persistence is a common mechanism abused for stealthy long-term execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "⚠️  检测到已有 memory-gc.sh 配置，跳过"
    else
        # 添加 GC 任务（每周日 00:00）
        (crontab -l 2>/dev/null | grep -v "memory-gc.sh" || true; echo "0 0 * * 0 $SCRIPT_DIR/memory-gc.sh") | crontab -
        echo "✅ 已添加每周 GC 任务"
    fi

• Confidence: 98% confidence
• Finding: This line writes a new cron entry that will run memory-gc.sh every week, creating persistent unattended execution. Even if the current script is non-malicious, this expands the trust boundary because any later change to that script or its path will execute automatically under the user's account.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "✅ 已添加每周 GC 任务"
    fi
    
    if crontab -l 2>/dev/null | grep -q "nightly-reflection.sh"; then
        echo "⚠️  检测到已有 nightly-reflection.sh 配置，跳过"
    else
        # 添加反思任务（每天 23:45）

• Confidence: 96% confidence
• Finding: This crontab check is part of a persistence workflow for a second recurring task. In this skill context, nightly automated reflection jobs likely process memory data regularly, so unattended execution could repeatedly touch sensitive workspace contents without ongoing user awareness.

Static analysis

No suspicious patterns detected.