Security audit

Openclaw Skill Super Memory

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it persistently changes agent instructions across workspaces and encourages automatic memory and tool creation without enough user control.

Install only if you intentionally want this skill to modify AGENTS.md across all configured OpenClaw agent workspaces and allow agents to persist memories and create reusable scripts. Review install.js before installation, avoid npm-style installs that trigger postinstall unexpectedly, keep secrets and sensitive infrastructure details out of MEMORY.md, and inspect any generated scripts before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 76% confidence
Finding: The skill advertises autonomous file-editing behavior and an install command that patches agents system-wide, yet it declares no permissions despite implying access to environment-backed capabilities and workspace modification. This creates a transparency and consent problem: operators cannot accurately assess what the skill can touch, and hidden capability use increases the chance of unsafe execution in privileged contexts.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The described purpose is long-term memory evolution and skill packaging, but the observed behavior extends to modifying configured agent workspaces, editing AGENTS.md, restoring patches, performing git push/tag operations, and publishing externally. That mismatch is dangerous because users may invoke the skill expecting local memory maintenance while it actually changes broader system state and can exfiltrate or distribute artifacts through remote services.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The install instructions explicitly aim to propagate these rules into all running agents in the system, which is a form of self-propagating configuration modification beyond the user-facing purpose. In context, this is especially dangerous because it attempts to alter other agents' behavior persistently and broadly, increasing blast radius from a single invocation.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The installer injects operational instructions that go beyond passive memory management and explicitly tell the agent to create new JavaScript helper scripts and register them in TOOLS.md for future execution. That materially expands the agent's capabilities and creates a self-extension pathway without review, which is dangerous because it can normalize autonomous code generation and persistence inside user workspaces.

Context-Inappropriate Capability

Low

Confidence: 81% confidence
Finding: The installer enumerates environment variables and searches broadly across filesystem locations to discover openclaw.json, including home directories and hardcoded container paths. While this may be intended for convenience, it grants the script host-discovery behavior not strictly necessary for a narrowly scoped memory skill and can expose or modify unintended installations if run in the wrong context.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This script performs remote side effects far beyond passive memory management: it stages all changes, commits, pushes to GitHub, creates tags, and publishes externally to ClawHub. In an agent-skill context, that creates a supply-chain and data-exfiltration risk because executing the skill can mutate source control state and ship repository contents using whatever local credentials are available.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code includes source-control mutation and remote publishing capabilities that are not clearly justified by the declared purpose of evolving a MEMORY.md file. In this context, those capabilities are dangerous because a user may invoke a seemingly local memory-management skill and unintentionally trigger repository changes and external distribution of potentially sensitive content.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The script deliberately deletes `GITHUB_TOKEN` and `GH_TOKEN`, causing subsequent operations to fall back to any locally configured GitHub credentials. That is risky because it bypasses explicit, auditable noninteractive credentials and may cause the skill to act under a more privileged personal account than the operator intended.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly instructs users to run an installer that patches agent instructions across active workspaces, but it does not prominently warn that this changes system behavior and persists modifications beyond the current session. In a skill designed to alter agent prompts autonomously, lack of clear consent and impact disclosure increases the risk of unsafe deployment and broad unintended workspace changes.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation encourages users to store long-term preferences and operational details permanently in MEMORY.md, including examples such as internal IP addresses and security rules, without warning against recording secrets or sensitive infrastructure data. This can normalize plaintext retention of sensitive information that may later be exposed through logs, repository sync, or agent output.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README promotes autonomous generation of reusable scripts and future execution from the skills directory without warning that this enables persistent code creation and later execution. In this context, an agent could transform unsafe or user-influenced instructions into durable tooling, increasing the blast radius of prompt injection, bad logic, or malicious task requests.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to automatically edit MEMORY.md and generate helper scripts whenever it detects repeatable workflows, without clear user notification or approval. Autonomous file mutation and code generation can introduce unwanted persistence, accidental secrets capture, or execution of unsafe automation that the user did not request.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script writes AGENTS.md directly across all discovered agent workspaces without prompting, dry-run output, backup, or per-target confirmation. This is risky because it silently changes agent behavior and persists new instructions into multiple workspaces, making accidental or unauthorized policy modification easy.

Natural-Language Policy Violations

High

Confidence: 94% confidence
Finding: The injected content imposes a specific Vietnamese-language behavioral policy and reporting style on the agent without any user opt-in or workspace-level consent. Forced locale and instruction changes can override existing agent governance, confuse downstream users, and serve as a covert channel for inserting broader behavioral controls.

Ssd 3

Medium

Confidence: 95% confidence
Finding: This skill’s core design is to preserve user-provided rules, preferences, and operational details in long-term memory, and the examples include infrastructure information and organizational policies. Because the memory is described as durable and directly writable, the skill context makes sensitive-data accumulation more dangerous than in ordinary documentation: it creates a persistent plaintext knowledge base that may include personal, internal, or security-relevant information.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill tells the agent to persist new rules, debug outcomes, user behavior, and system configuration changes into long-term memory without minimization or sensitivity boundaries. This can retain secrets, personal data, or sensitive operational details across sessions, turning transient context into durable data exposure.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The self-reflection loop explicitly asks the agent to remember user habits and lessons across sessions, creating behavioral profiling and persistent retention of user-provided information. In this context, the danger is amplified because retention is framed as automatic and continuous rather than narrowly scoped to a user-approved memory model.

Ssd 3

High

Confidence: 98% confidence
Finding: The patch directs the agent to automatically persist learned user preferences, habits, and session-derived information into MEMORY.md during normal conversations. In the context of an agent skill, this is especially dangerous because it encourages long-term retention of user-specific data without consent, minimization, or sensitivity filtering, increasing privacy and prompt-persistence risk.

Ssd 4

Medium

Confidence: 95% confidence
Finding: The injected workflow establishes a self-modification loop: collect information from interactions, write it to long-term memory, derive repeatable procedures, create new scripts, then confirm self-updates back to the user. This feedback loop is hazardous because it increases autonomy and persistence over time, allowing the agent to accumulate capabilities and behavioral changes beyond the original skill scope.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish.js:28