Security audit

Openclaw Skill Super Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly meant to make agents remember and self-modify, but it installs broad persistent instructions across agent workspaces automatically and without enough user control.

Install only if you intentionally want this package to change agent instructions across your OpenClaw workspaces. Review the exact AGENTS.md patch first, avoid storing secrets or private infrastructure details in MEMORY.md, and do not run the release script unless you have audited and isolated its Git and publishing credentials.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: install.js:147
Finding: Persistent Agent Instruction, Memory, and Tool-Registry Hijacking
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: package.json:7
Finding: Automatic Cross-Workspace Modification During Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish.js:17
Finding: Shell Command Injection Through Unvalidated Release Version
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/publish.js:54
Finding: Unpinned Third-Party Package Execution in Release Workflow
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose does not disclose repository commits, pushes, tag creation, package publication, or authentication-affecting behavior such as deleting GitHub token variables. These actions can alter source history, exfiltrate code to remotes, publish unreviewed artifacts, and interfere with credentials, making the hidden behavior especially risky.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose does not disclose repository commits, pushes, tag creation, package publication, or authentication-affecting behavior such as deleting GitHub token variables. These actions can alter source history, exfiltrate code to remotes, publish unreviewed artifacts, and interfere with credentials, making the hidden behavior especially risky.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The injected AGENTS.md block is written in Vietnamese and imposes that instruction set on all affected agents without any user opt-in or localization check. Forcing a language/locale can impair user understanding and review of persistent agent instructions, reducing transparency and increasing the chance that risky behavioral changes go unnoticed.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The patch mandates persistent recording of user-specific preferences, habits, and prior issues into MEMORY.md automatically at the end of sessions. This creates a standing data retention policy for potentially sensitive personal or operational information without consent, minimization, or access controls, increasing privacy and data leakage risk across future sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly promotes real-time writes to persistent memory and autonomous creation of scripts under skills/ without any guardrails, approval flow, or warning about data retention and code-generation risks. In an agent-skill context, encouraging durable storage plus self-modifying automation increases the chance of sensitive data capture, unsafe persistence of instructions, and unreviewed tool creation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer is described as patching all active agent workspaces, but the README does not clearly warn that this is a bulk modification affecting multiple agents and instruction files. In practice, broad prompt patching can propagate unsafe behaviors, overwrite local policy, or make rollback and attribution difficult across the environment.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation encourages permanent storage of user-provided rules, preferences, and operational details in a long-term memory file. This is risky because users may supply secrets, internal procedures, or regulated data that then persist beyond the immediate task and could be reused, exposed, or propagated later.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example prompt tells the agent to permanently remember a backup server IP for future troubleshooting, which normalizes retention of private infrastructure metadata. Even a single internal IP can aid environment mapping, lateral movement planning, or disclosure of otherwise non-public network details if memory is later exposed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example workflow encourages processing member phone numbers and saving derived results into reusable automation artifacts for future runs. In context, this increases privacy and compliance risk because personal data becomes part of durable tooling or outputs, potentially expanding retention, access, and reuse beyond the original purpose.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill directs the agent to edit files, create scripts, update registries, and run an installer, but it declares no explicit tool scope or permissions. That mismatch is dangerous because it obscures the skill’s real capabilities and increases the chance an agent will perform filesystem or environment-sensitive actions without clear operator consent or sandboxing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs automatic writes to long-term memory files whenever new rules, debug outcomes, user behavior, or system changes are observed, without warning that workspace data will be modified. This is dangerous because it enables silent persistence of possibly sensitive or inaccurate information and may alter project state unexpectedly.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions require default persistence of user behavior and other session-derived information into long-term memory. Storing such information by default creates privacy and data-minimization risks, especially when the user has not consented and retention limits are undefined.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs autonomous creation of helper scripts and updates to TOOLS.md without warning about workspace changes. Automatically generating executable automation in a workspace can introduce unsafe code paths, persistence mechanisms, or maintenance burden without human review.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The self-reflection workflow explicitly tells the agent to remember user habits and store them in long-term memory, which normalizes behavioral profiling. In this context, the skill is more dangerous because its purpose is persistence and autonomous evolution, so privacy-invasive storage is framed as routine rather than exceptional.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The install instructions say to apply the rules to all running agents in the system, which goes far beyond the skill’s stated local memory-management purpose. System-wide patching magnifies blast radius: a single invocation could change behavior across multiple agents and workspaces without targeted review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The install instructions omit that running the installer may patch all running agents, so the operational impact is materially understated. Users may execute the command expecting a local setup step, while it actually performs broad behavioral modification across the environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code enumerates every agent workspace from openclaw.json and applies modifications across all of them, rather than targeting a single explicitly selected workspace. This broad environment-wide write capability increases blast radius and can unexpectedly alter unrelated agents, making persistence and policy injection affect more of the system than users may realize.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The installer writes modified AGENTS.md content directly to user workspaces with no interactive confirmation, preview, or approval step. Silent policy injection into agent instruction files is dangerous because it changes future agent behavior persistently and may not be noticed until after subsequent sessions are affected.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The installer injects new standing instructions into AGENTS.md that go beyond passive memory maintenance and explicitly require autonomous creation of JavaScript helper scripts plus updates to TOOLS.md. That materially expands the agent’s future authority and behavior surface without per-task consent, creating a persistence and capability-escalation mechanism that can lead to unauthorized code generation and execution pathways in later sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The injected self-reflection loop tells the agent to report back self-learned updates about the user after modifying memory, reinforcing collection and disclosure of user-related inferences. This encourages synthesis and propagation of personal or behavioral data beyond immediate task needs, which can amplify privacy harm if the memory contents are inaccurate, sensitive, or shared.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The package description explicitly advertises 'autonomous long-term memory updates' and 'self-evolving skill synthesis' without any stated scope limits, approval requirements, or trigger constraints. In an agent skill context, broad self-modifying and persistent-memory behavior increases the risk of uncontrolled state changes, prompt-injection persistence, and hard-to-audit behavior even if the text is only metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill performs autonomous updates to MEMORY.md, which is persistent user or workspace data, but provides no warning, consent model, or disclosure about when that data is modified. In a long-term memory skill, silent persistent writes are dangerous because they can store poisoned instructions, sensitive data, or misleading state that affects future agent behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script deletes GITHUB_TOKEN and GH_TOKEN so Git operations fall back to the locally logged-in account, bypassing explicit credential selection and policy controls. This is dangerous because it can cause privileged actions to run under a developer's personal account unexpectedly, reducing auditability and potentially pushing or tagging with broader permissions than intended.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says the skill's purpose is to evolve MEMORY.md long-term memory and automatically package the skill. This script goes beyond packaging by committing to Git, pushing branches and tags to GitHub, and publishing externally to ClawHub, which are release/distribution operations not described in the manifest.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The script invokes npx clawhub publish without pinning an exact package version, so execution can resolve to whatever clawhub package/version is available at runtime. In a release workflow with publish and push privileges, this creates a supply-chain risk where a compromised or unexpected package version could execute arbitrary code and exfiltrate credentials or tamper with releases.
Content: No source excerpt is available for this finding.