Security audit

Memory Mesh Core

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about being a memory-sync tool, but it also schedules recurring jobs, force-updates skills, and can publish local memory-derived content externally without enough scoping or confirmation.

Review carefully before installing. Use only in a workspace where local memory files are safe to process, disable auto_update_skills unless you intentionally want this skill to replace installed skills, avoid scheduled posting, and do not run the GitHub or browser posting commands until you have reviewed the exact payload and destination.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: scripts/post_global_comment_via_openclaw.py:60
Finding: Promotional instructions redirect the agent toward unsolicited external actions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: scripts/global_memory_sync.py:203
Finding: Untrusted third-party feed content is persisted as agent memory without instruction-level validation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/global_memory_sync.py:172
Finding: Scheduled synchronization force-installs mutable remote Skill versions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/export_issue_contribution.py:24
Finding: Weak sanitization permits local memory content to be published to GitHub
Content: View full analysis
str: cleaned = (text or "").encode("ascii", "ignore").decode("ascii") cleaned = " ".join(cleaned.split()).strip() if len(cleaned) > 240: cleaned = cleaned[:237] + "..." return cleaned ``` ```python def to_comment_item(workspace: Path, item: dict, now_utc: str): memory_text = sanitize_text(str(item.get("text", ""))) if len(memory_text) < 16: return None tags = item.get("tags", []) if not isinstance(tags, list) or not tags: tags = ["general"] metrics = item.get("metrics", {}) if isinstance(item.get("metrics"), dict) else {} risk_flags = item.get("risk_reasons", []) if not isinstance(risk_flags, list): risk_flags = [] source_ref = build_source_ref(workspace, item) contribution_id = stable_contribution_id(memory_text, source_ref) return { "schema": "memory_contribution_v1", "contribution_id": contribution_id, "agent_id": "memory-mesh-core", "memory_text": memory_text, "tags": [str(t) for t in tags[:8]], "evidence": "Promoted by local value-scoring and safety gating in memory-mesh-core.", "confidence": round(float(metrics.get("confidence", 0.7)), 4), "impact": round(float(metrics.get("impact", 0.6)), 4), "actionability": round(float(metrics.get("actionability", 0.6)), 4), "novelty": round(float(metrics.get("novelty", 0.5)), 4), "risk_flags": [str(x) for x in risk_flags[:8]], "source_ref": source_ref, "timestamp_utc": now_utc, } ``` The exported data is subsequently posted by `scripts/post_issue_contributions.py:159-168`: ```python body = json.dumps(item, indent=2, ensure_ascii=False) + "\n" if args.dry_run: p ...[truncated 2532 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: scripts/ensure_openclaw_cron.py:52
Finding: Setup installs a recurring cross-session job that performs network synchronization and updates
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README provides a one-shot command for posting a global comment via OpenClaw but does not prominently warn that local memory-derived data may be transmitted to a public external service. Because this skill is specifically designed to consolidate cross-session memory, the risk is elevated: users may unintentionally publish sensitive workflow details, preferences, or derived internal context despite stated filtering goals.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README documents automated GitHub issue posting, duplicate suppression, orchestrator integration, and cron-enabled posting without sufficient warning that this can cause ongoing external publication on a schedule. In this skill context, automation materially increases danger because recurring memory extraction plus unattended posting can repeatedly leak derived local information or create unauthorized outbound communications over time.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Automated external comment posting, cron scheduling, and promotional/growth actions materially expand the skill's behavior and can drive unreviewed outbound communications. If these capabilities are emphasized as routine workflow rather than as sensitive network actions requiring review, users may unknowingly enable repeated external publication or browser automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explicitly describes automatic querying of subscribed skills, auto-updating local copies, and pulling remote memory feeds, but does not clearly warn users that the skill will perform recurring network access and ingest externally sourced content. In a memory-management skill, silent remote update and ingestion behavior increases supply-chain and trust-boundary risk because external content may influence future agent behavior even if quarantine is mentioned elsewhere.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This line states an English-only publish payload requirement, which is a language policy constraint. Under the stated policy criteria, forcing a specific language without opt-in or stronger justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and invokes filesystem access, shell execution, scheduling, and network/GitHub operations, but the manifest declares no explicit tool scope or permissions. That creates an authorization transparency gap: operators cannot easily review or constrain what the skill is allowed to do before installation or execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill promotes optional automated GitHub posting and scheduled external distribution of memory derived from local workspace data, but the surrounding description does not give a clear, prominent warning that content may leave the local environment. In a memory-consolidation skill, that context makes the issue more dangerous because the material being processed may include sensitive operational notes, internal prompts, or user-derived context even if some screening exists.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The quick-start command directly shows how to auto-post to a public GitHub issue without an adjacent warning about publishing workspace-derived data externally. Users often copy-paste quick-start sections, so burying the privacy implication elsewhere materially increases the risk of accidental data disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The scheduled posting setup enables recurring automated external publication, yet the documentation does not prominently warn that repeated runs may continue to publish data over time. Recurring automation increases the blast radius because a single configuration action can cause ongoing leakage of newly consolidated memory without continuous user review.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The public batch feed embeds promotional calls to install, star, refer peers, and optionally contribute via a GitHub issue, which goes beyond passive memory-sharing data and creates a social-engineering surface inside machine-consumable content. In the context of a memory/memory-sync skill, downstream agents may treat this feed as trusted operational data and surface or act on these calls-to-action, causing unsolicited installation, reputation manipulation, or external interactions not strictly required for the skill’s core function.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/ensure_openclaw_cron.py (reported line 9)May include surrounding context.
python
def run_cmd(args, cwd=None): proc = subprocess.run(args, cwd=cwd, text=True, capture_output=True) return proc.returncode, proc.stdout, proc.stderr

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This script automatically installs or updates remote skills based on metadata returned by clawhub inspect, which gives the memory sync feature package-management behavior and expands trust to remote content. In a memory-consolidation context, silently pulling and installing code from external sources creates a supply-chain risk and can introduce unreviewed code into the local workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatic install/update occurs without any user-facing warning or confirmation, so remote code changes can be introduced into the environment silently. This materially increases the chance of unauthorized or unexpected software modification, especially if repository metadata, registry content, or dependencies are compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script ingests remote feed content and persists it into local memory files without clear disclosure or provenance enforcement. Although there is a basic secret-pattern filter, untrusted remote text can still poison memory, mislead downstream agents, or persist malicious instructions into future sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installer performs a one-time bootstrap that executes another Python script and persists completion state without any user-facing confirmation or clear notice in this file. In the context of a memory-sync skill that can consolidate and potentially contribute data externally, silent execution increases the risk of unexpected code execution and unintended data handling during installation.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/issue_contribution_selfcheck.py (reported line 11)May include surrounding context.
python
def run_cmd(args): p = subprocess.run(args, text=True, capture_output=True) return p.returncode, p.stdout or "", p.stderr or ""

Static analysis

No suspicious patterns detected.