ClawHub
Back to skill

Security audit

Anamnesis Hub

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is mostly aligned with its stated purpose, but it needs Review because it can send conversation history to an external service, install remote code with elevated privileges, persist automatic memories, and alter or delete OpenClaw files.

Only install after reviewing the privacy and setup tradeoffs. Avoid using it on sensitive workspaces unless you are comfortable with conversation-derived data going to MemOS services, verify or skip remote installers, back up OpenClaw workspace files first, keep cleanup disabled unless you have reviewed the exact files, and manually review generated memories before relying on them.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/auto-setup.sh:84
Finding

Unverified Remote Installer and Executable Are Downloaded and Run

Content
View full analysis

Vulnerability Details

File Location: scripts/auto-setup.sh:84-99
Additional Location: references/setup-guide.md:12-21
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
case "$choice" in
    1)
        info "Installing standard Ollama..."
        run sh -c 'curl -fsSL https://ollama.com/install.sh -o /tmp/ollama-install.sh && sh /tmp/ollama-install.sh && rm -f /tmp/ollama-install.sh'
        run sudo systemctl start ollama 2>/dev/null || { warn "Could not start via systemctl (need sudo?). Trying ollama serve..."; run ollama serve & }
        log "Ollama installed"
        ;;
    2)
        info "Installing Intel Ollama..."
        INTEL_DIR="/opt/ollama-intel"
        warn "This requires sudo access to write to /opt and /usr/local/bin."
        run sudo mkdir -p "$INTEL_DIR"
        info "Downloading Intel Ollama from GitHub releases..."
        run sudo curl -L -o "$INTEL_DIR/ollama" "https://github.com/intel/ollama/releases/latest/download/ollama-linux-amd64"
        run sudo chmod +x "$INTEL_DIR/ollama"
        run sudo ln -sf "$INTEL_DIR/ollama" /usr/local/bin/ollama

The manual setup guide also recommends:

bash
curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

The setup process downloads mutable remote content and immediately executes or installs it without verifying a cryptographic checksum or signature. Saving the installer temporarily before running it is functionally equivalent to curl | sh when no integrity verification occurs.

The Intel installation is especially sensitive because it uses a mutable latest release URL and installs the resulting executable into a system command path using sudo. HTTPS authenticates the connection to the selected host but does not guarantee that the host, release account, build pipeline, or mutable asset has not been comp ...[truncated 1093 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace mutable URLs with a specific, pinned release version.
  • Publish the expected SHA-256 digest and verify it before execution.
  • Prefer signed packages from a trusted package manager.
  • Download the installer without running it and show the user its path, source, version, and digest.
  • Require separate, explicit confirmation before executing downloaded content.
  • Do not use latest release URLs for privileged installation.
  • Avoid installing into system paths when a user-scoped installation is sufficient.
  • Remove the curl | sh recommendation from the manual setup guide.

other

Error
Location
scripts/session-extract.py:43
Finding

Historical Private Conversations Are Transmitted to a Fixed Third-Party API

Content
View full analysis

Vulnerability Details

File Location: scripts/session-extract.py:43-116
Related Location: scripts/session-extract.py:298-390
Vulnerability Type: Sensitive conversation data exfiltration
Risk Level: Critical

Vulnerable Code

python
MEMOS_BASE_URL = "https://memos.memtensor.cn/api/openmem/v1"
MEMOS_API_KEY = ""

def call_extractor(messages: list) -> dict:
    if not messages:
        return {"memory_detail_list": [], "preference_detail_list": []}

    payload = json.dumps({"messages": messages}).encode("utf-8")
    req = urllib.request.Request(
        f"{MEMOS_BASE_URL}/extract/memory",
        data=payload,
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Token {MEMOS_API_KEY}",
        },
        method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=60) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            return result.get("data", {}) or {}

Session messages are collected from local history and passed directly to that function:

python
sessions_dir = Path.home() / ".openclaw/agents/main/sessions"
jsonl_path = sessions_dir / f"{session_id}.jsonl"

lines = jsonl_path.read_text(
    encoding="utf-8",
    errors="replace"
).splitlines()

messages.append({
    "role": role,
    "content": text,
})

extracted = call_extractor(messages)

Technical Analysis

The script reads user and assistant messages from historical OpenClaw JSONL session files and serializes the selected messages into an HTTPS request to the fixed memos.memtensor.cn service. Secret redaction and privacy filtering are not performed before transmission. Filtering and reranking operate only after the remote extractor has already received the source conversation.

Cloud-assisted memory is part of the declared functionality, but transmitting broad raw session history is n ...[truncated 1167 chars]

Remediation
View remediation

Remediation Suggestions

  • Default to fully local extraction and reranking.
  • Require explicit, informed opt-in before sending any conversation to an external service.
  • Display the destination, selected sessions, data volume, and a redacted preview before transmission.
  • Apply local secret scanning and redact credentials, tokens, private keys, cookies, personal identifiers, and private network details.
  • Use an allowlist of fields and facts rather than sending complete message text.
  • Permit the user to configure and approve the endpoint instead of hardcoding it.
  • Add clear retention, data-controller, and privacy disclosures.
  • Provide per-session selection and exclusion controls.
  • Ensure scheduled operation cannot enable cloud transmission without prior user consent.

T02 · Agent Memory Poisoning

Error
Location
scripts/auto_memory_extract.py:392
Finding

Untrusted Model Output Is Written into Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: scripts/auto_memory_extract.py:392-433
Related Location: scripts/auto_memory_extract.py:257-294
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Vulnerable Code

python
extractor_result = call_memos_extractor(entries_text)
extractor_memories = extractor_result.get("memory_detail_list", []) or []
extractor_prefs = extractor_result.get("preference_detail_list", []) or []

extractor_adds = []
for m in extractor_memories:
    val = m.get("memory_value", "") or ""
    key = m.get("memory_key", "") or ""
    if val and len(val) > 10:
        extractor_adds.append({
            "category": "technical/configuration",
            "content": f"{key}: {val}",
            "source": "memos-extractor",
        })

merged_adds = list(qwen3_adds)
merged_adds.extend(extractor_extra)

if add_count > 0:
    archive_result = stage_one_archive(merged_adds, today)

    if archive_result["added"] > 0 and archive_result["section_line"]:
        memory_result = stage_two_summarize(
            today,
            archive_result["section_line"],
            archive_result["added"]
        )

The archive stage performs deduplication but no trust validation:

python
h = compute_content_hash(line)
if h in existing_hashes:
    skipped += 1
    continue
existing_hashes.add(h)
new_entries.append(f"<!-- hash:{h} -->\n{line}")

write_with_script(str(ARCHIVE_MD), archive_content)

Technical Analysis

Content derived from conversations, a local language model, and a remote extraction API is accepted based primarily on JSON structure and minimum length. The code does not reject imperative instructions, role-changing text, prompt-injection payloads, embedded control markup, secrets, or unsupported claims.

SHA-256 hashing only detects exact duplicates; it does not establish authenticity, factual correctness, or ...[truncated 1185 chars]

Remediation
View remediation

Remediation Suggestions

  • Place every generated memory in a review queue instead of automatically promoting it.
  • Require human approval before writing to long-term memory.
  • Treat model output as untrusted data, not as instructions.
  • Reject role directives, imperative control language, prompt delimiters, tool commands, and embedded instruction markup.
  • Scan generated memories for secrets before persistence.
  • Retain immutable provenance, including source session, model, timestamp, and confidence.
  • Enforce a strict factual schema with bounded field lengths and allowed categories.
  • Separate factual records from Agent instruction files.
  • Ensure recalled memory is enclosed in a clearly labeled untrusted-data section.
  • Use semantic duplicate detection only as an additional control, not as a trust decision.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/session-extract.py:273
Finding

Session Extraction Renames and Trashes Source Conversation Records

Content
View full analysis

Vulnerability Details

File Location: scripts/session-extract.py:273-295
Related Location: scripts/session-extract.py:665-764
Vulnerability Type: Unsafe destructive file handling
Risk Level: High

Vulnerable Code

python
def rename_session_file(session_file: Path, pass_num: int) -> bool:
    try:
        if pass_num == 1:
            new_name = str(session_file) + ".analyzed1"
        else:
            new_name = str(session_file) + ".analyzed2"
        session_file.rename(new_name)
        return True
    except Exception as e:
        print(f"[WARN] rename failed {session_file.name}: {e}", file=sys.stderr)
        return False

def trash_session_file(session_file: Path) -> bool:
    try:
        subprocess.run(
            ["gio", "trash", str(session_file)],
            check=True,
            capture_output=True
        )
        return True
    except Exception as e:
        print(f"[WARN] deletion failed {session_file.name}: {e}", file=sys.stderr)
        return False

The second pass automatically applies both operations:

python
elif pass_num == 2:
    if rename_session_file(session_file, pass_num):
        new_path = Path(str(session_file) + ".analyzed2")
        if new_path.exists():
            trash_session_file(new_path)
            trash_count += 1

Cleanup also classifies and trashes multiple session-file categories:

python
for cat, files in categories.items():
    for f in files:
        if trash_session_file(f):
            total += 1

Technical Analysis

Memory extraction does not require modifying or deleting the source conversation records. Nevertheless, the script renames source files after processing and can move second-pass and cleanup candidates to the system trash.

Protection relies on deriving the current session from sessions.json, skipping the two newest files in one path, and recogni ...[truncated 1074 chars]

Remediation
View remediation

Remediation Suggestions

  • Never modify or delete source sessions during normal extraction.
  • Store processing state exclusively in a separate state database.
  • Move cleanup into a separate, explicitly invoked command.
  • Require an interactive confirmation listing every file that will be affected.
  • Add a default dry-run mode and a substantial minimum-age threshold.
  • Use OpenClaw's authoritative session lifecycle interface instead of filename and ordering heuristics.
  • Obtain file locks before processing and revalidate session activity immediately before cleanup.
  • Create and verify a backup before any destructive operation.
  • Avoid hardcoded channel identifiers; enumerate all active sessions from authoritative metadata.
  • Check whether gio trash succeeded before incrementing deletion statistics.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auto-setup.sh:252
Finding

MemOS API Token Is Echoed During Input and Stored in Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: scripts/auto-setup.sh:252-300
Related Location: references/setup-guide.md:100-107
Vulnerability Type: Plaintext sensitive credential handling
Risk Level: Medium

Vulnerable Code

bash
read -r -p "    Server URL (e.g. https://memos.example.com): " memos_url
read -r -p "    API Token: " memos_token

run env MEMOS_URL="$memos_url" MEMOS_TOKEN="$memos_token" OPENCLAW_JSON="$OPENCLAW_JSON" python3 -c "
import json
import os
path = os.environ['OPENCLAW_JSON']
with open(path) as f:
    cfg = json.load(f)
entries = cfg.setdefault('plugins', {}).setdefault('entries', {})
entries['memos-cloud-openclaw-plugin'] = {
    'enabled': True,
    'config': {
        'url': os.environ['MEMOS_URL'],
        'token': os.environ['MEMOS_TOKEN'],
        'resetOnNew': True,
        'recallEnabled': True,
        'addEnabled': True
    }
}
with open(path, 'w') as f:
    json.dump(cfg, f, indent=2)
"

Technical Analysis

The shell prompt uses ordinary read rather than silent input, so the token is visible while typed. It is then placed in a process environment and serialized directly into ~/.openclaw/openclaw.json. The setup code does not establish restrictive file permissions before or after writing the configuration.

Environment variables may be observable to same-user diagnostic tools, crash handlers, or child processes. Plaintext configuration may also be included in backups, support archives, synchronization processes, or accidental repository commits.

Attack Path

  1. The user enters a MemOS API token during setup.
  2. The token is displayed in the terminal while typed.
  3. The token is copied into the setup process environment.
  4. The setup script writes it as plaintext in openclaw.json.
  5. Another local process, user, backup system, or accidental configuration disclosure obtains the file or process environment.
  6. The ...[truncated 331 chars]
Remediation
View remediation

Remediation Suggestions

  • Read credentials with silent terminal input, such as read -s.
  • Store credentials in an operating-system keyring or dedicated secret manager.
  • Store only a secret reference in openclaw.json.
  • If file-based storage is unavoidable, use a dedicated credentials file with mode 0600.
  • Validate and enforce restrictive permissions on existing configuration files.
  • Avoid passing secrets through environment variables when a protected file descriptor or keyring API is available.
  • Exclude credential files from backups, logs, support bundles, and source control.
  • Document token scope and provide a straightforward rotation procedure.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/upgrade-reset.md:174
Finding

Uninstall Procedure Deletes Shared Agent Identity, Tooling, and Script Files

Content
View full analysis

Vulnerability Details

File Location: references/upgrade-reset.md:174-183
Vulnerability Type: Destructive access beyond Skill ownership
Risk Level: Medium

Vulnerable Code

bash
rm -rf ~/.openclaw/workspace/memory/
rm -f ~/.openclaw/workspace/MEMORY.md
rm -f ~/.openclaw/workspace/ARCHIVE.md
rm -f ~/.openclaw/workspace/AGENTS.md
rm -f ~/.openclaw/workspace/SOUL.md
rm -f ~/.openclaw/workspace/USER.md
rm -f ~/.openclaw/workspace/TOOLS.md

rm -rf ~/.openclaw/workspace/user_workspace/scripts/

Technical Analysis

The documented complete-uninstall procedure deletes files and directories that are not necessarily owned by this Skill. AGENTS.md, SOUL.md, USER.md, and TOOLS.md are shared OpenClaw identity, behavior, user-context, and tool-configuration files. The entire user_workspace/scripts directory may contain unrelated user or third-party scripts.

Removing these shared resources exceeds the minimum privilege necessary to uninstall the memory system. The preceding backup command shown in the same guide does not include all of the shared identity and tooling files later deleted.

Attack Path

  1. A user decides to uninstall the Skill.
  2. The user follows the documented complete-uninstall commands.
  3. Broad recursive and forced deletion commands run without ownership validation.
  4. Shared Agent files and unrelated scripts are deleted.
  5. Other OpenClaw functionality, identity configuration, and user automation are lost or disrupted.

Impact Assessment

The commands can destroy Agent behavior rules, identity data, user profile information, tool configuration, unrelated automation scripts, and all local memory files. The impact is limited to files writable by the invoking user but extends substantially beyond artifacts demonstrably created by this Skill.

Remediation
View remediation

Remediation Suggestions

  • Maintain an installation manifest containing only files and configuration keys created by this Skill.
  • Remove only manifest-owned files during uninstall.
  • Delete only this Skill's scripts rather than the shared user_workspace/scripts directory.
  • Never delete shared AGENTS.md, SOUL.md, USER.md, or TOOLS.md files.
  • If the Skill added sections to shared files, remove only clearly delimited, Skill-owned sections.
  • Back up every file that may be modified or removed.
  • Add existence, ownership, and expected-content checks before deletion.
  • Present an exact deletion plan and require explicit confirmation.
  • Replace broad rm -rf operations with narrowly scoped commands.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (110)

Tainted flow: 'req' from os.environ.get (line 115, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

The script transmits collected memory entries to an external MemOS API together with an API token loaded from the environment or .env. Even if the token itself is only used in an authorization header, the dangerous part is that sensitive local memory content is exfiltrated off-host to a remote service, which is broader than the script's advertised local post-processing role.

Content

Scanner excerpt · scripts/auto_memory_extract.py (reported line 126)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            return result.get("data", {}) or {}
    except Exception as e:

Tainted flow: 'req' from os.environ.get (line 115, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_memory_extract.py (reported line 155)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=300) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            return result.get("response", "").strip()
    except Exception as e:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README describes optional MemOS Cloud cross-device synchronization without clearly warning that memory contents may be transmitted to an external service. Because the synced data can include conversation-derived memories and structured knowledge, users may unintentionally exfiltrate sensitive information off-device.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

If the actual implementation is primarily file writing while the skill claims a broad memory architecture, the discrepancy still creates a trust and review problem. Misrepresentation is dangerous in security-sensitive agent ecosystems because reviewers and users cannot accurately judge what the skill will do, which can conceal risky behavior or lead to unsafe assumptions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the actual implementation is primarily file writing while the skill claims a broad memory architecture, the discrepancy still creates a trust and review problem. Misrepresentation is dangerous in security-sensitive agent ecosystems because reviewers and users cannot accurately judge what the skill will do, which can conceal risky behavior or lead to unsafe assumptions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

If the actual implementation is primarily file writing while the skill claims a broad memory architecture, the discrepancy still creates a trust and review problem. Misrepresentation is dangerous in security-sensitive agent ecosystems because reviewers and users cannot accurately judge what the skill will do, which can conceal risky behavior or lead to unsafe assumptions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

If the actual implementation is primarily file writing while the skill claims a broad memory architecture, the discrepancy still creates a trust and review problem. Misrepresentation is dangerous in security-sensitive agent ecosystems because reviewers and users cannot accurately judge what the skill will do, which can conceal risky behavior or lead to unsafe assumptions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
| `auto-setup.sh` | One-command Ollama + memory-core + MemOS Cloud setup |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
| `auto-setup.sh` | One-command Ollama + memory-core + MemOS Cloud setup |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
| `auto-setup.sh` | One-command Ollama + memory-core + MemOS Cloud setup |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
| `auto-setup.sh` | One-command Ollama + memory-core + MemOS Cloud setup |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
| `auto-setup.sh` | One-command Ollama + memory-core + MemOS Cloud setup |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
| `auto-setup.sh` | One-command Ollama + memory-core + MemOS Cloud setup |

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The configuration explicitly enables unrestricted conversation access and automatic memory capture, which is a direct privacy and confidentiality risk. Because it is presented as required/recommended configuration, users may deploy an over-privileged setup that persistently records conversations by default.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Dreaming pipeline scans session logs, extracts structured facts, and promotes them into long-term memory automatically. This creates a durable amplification of sensitive content: transient chat data can become persistent profile knowledge without validation, increasing both privacy impact and the chance of incorrect or harmful memory retention.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The session-extract pipeline processes session JSONL files into permanent learnings and memory artifacts, extending retention and distribution of raw conversation content. If those sessions contain secrets, personal identifiers, or privileged data, the pipeline can institutionalize that data in durable stores and derivative summaries.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl ... | sh downloads a remote script and executes it immediately without inspection, pinning, or signature verification. If the remote host, CDN path, TLS trust chain, or install script is compromised, users would run attacker-controlled code on their system with the privileges of the shell session.

Content

Scanner excerpt · references/setup-guide.md (reported line 15)May include surrounding context.

Option A: Standard

bash
curl -fsSL https://ollama.com/install.sh | sh

Option B: Intel Edition (OpenVINO backend)

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | sh construct is the dangerous execution step that turns an external network fetch into immediate code execution. In setup documentation for an agent memory system, users are likely to copy-paste commands verbatim, so this pattern materially increases the chance of supply-chain compromise or malicious script execution.

Content

Scanner excerpt · references/setup-guide.md (reported line 15)May include surrounding context.

Option A: Standard

bash
curl -fsSL https://ollama.com/install.sh | sh

Option B: Intel Edition (OpenVINO backend)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/upgrade-reset.md (reported line 73)May include surrounding context.

无专用 reset 参数，但可以通过删除状态文件实现：

bash
# 清除缓存，重新从云端拉取
rm user_workspace/memos-cloud-cache/memos-cloud-*.md
# 下次 sync-pull 会重新拉取全部历史

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/upgrade-reset.md (reported line 88)May include surrounding context.

md
cp ~/.openclaw/memory/facts.sqlite ~/.openclaw/memory/facts.sqlite.bak.$(date +%Y%m%d)

# 2. 删除现有 facts.db
rm ~/.openclaw/memory/facts.sqlite

# 3. 从 ARCHIVE.md 重新 seed
python3 scripts/seed-facts-db.py

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/upgrade-reset.md (reported line 174)May include surrounding context.

md
~/.openclaw/memory/main.sqlite

# 删除
rm -rf ~/.openclaw/workspace/memory/
rm -f ~/.openclaw/workspace/MEMORY.md
rm -f ~/.openclaw/workspace/ARCHIVE.md
rm -f ~/.openclaw/workspace/AGENTS.md

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/upgrade-reset.md (reported line 183)May include surrounding context.

md
~/.openclaw/memory/main.sqlite

# 删除
rm -rf ~/.openclaw/workspace/memory/
rm -f ~/.openclaw/workspace/MEMORY.md
rm -f ~/.openclaw/workspace/ARCHIVE.md
rm -f ~/.openclaw/workspace/AGENTS.md

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/upgrade-reset.md (reported line 174)May include surrounding context.

md
~/.openclaw/memory/main.sqlite

# 删除
rm -rf ~/.openclaw/workspace/memory/
rm -f ~/.openclaw/workspace/MEMORY.md
rm -f ~/.openclaw/workspace/ARCHIVE.md
rm -f ~/.openclaw/workspace/AGENTS.md

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/upgrade-reset.md (reported line 175)May include surrounding context.

md
# 删除
rm -rf ~/.openclaw/workspace/memory/
rm -f ~/.openclaw/workspace/MEMORY.md
rm -f ~/.openclaw/workspace/ARCHIVE.md
rm -f ~/.openclaw/workspace/AGENTS.md
rm -f ~/.openclaw/workspace/SOUL.md

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/upgrade-reset.md (reported line 176)May include surrounding context.

md
# 删除
rm -rf ~/.openclaw/workspace/memory/
rm -f ~/.openclaw/workspace/MEMORY.md
rm -f ~/.openclaw/workspace/ARCHIVE.md
rm -f ~/.openclaw/workspace/AGENTS.md
rm -f ~/.openclaw/workspace/SOUL.md
rm -f ~/.openclaw/workspace/USER.md

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
references/upgrade-reset.md:174