OpenClaw Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:46 AM UTC
• Version: 2.3.0

Overview

This memory-management skill is coherent, but it promotes silent durable memory writes and optional broad or external indexing without enough guardrails for sensitive data.

Review this before installing if your OpenClaw workspace may contain private chats, credentials, customer data, or sensitive notes. Enable durable memory only with clear rules for what must never be stored, avoid broad extraPaths unless you intend those files to be indexed, be cautious with cloud or auto-capture plugins, and prefer pinned or sandboxed installs for QMD.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:219

Finding

Unpinned Remote Repository Installed as a Global Executable Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:219
Vulnerability Type: Remote payload retrieval from a mutable source
Risk Level: Medium

Complete Code Snippet:

bash

bun install -g https://github.com/tobi/qmd

Technical Analysis

The Skill recommends installing a third-party package globally and directly from a GitHub repository without pinning a reviewed commit, immutable release, checksum, or cryptographic signature. Because the repository URL resolves to mutable upstream content, the code retrieved when a user runs this command may differ from the code available when the Skill was audited.

Installation may execute package lifecycle logic and install executable components. The use of -g increases exposure by making the resulting tools globally available to the invoking user rather than isolating them within a specific project. The documentation also indicates that the component downloads GGUF models during its first search, adding another runtime artifact whose integrity is not documented.

This behavior is optional and related to the Skill's experimental QMD search functionality, but fetching mutable executable content is not necessary when an immutable, verified release or commit could be used instead.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a transitive dependency used by the package.
2. The attacker modifies the repository's default revision or installation lifecycle code.
3. A user follows the Skill's documented bun install -g command.
4. Bun retrieves the current attacker-controlled content from the mutable repository URL.
5. Installation logic executes with the invoking user's privileges and installs the compromised tooling globally.
6. The malicious component can subsequently run when the user or agent invokes QMD-related functionality.

Impact Assessment

Successful exploitation could execute arbitrary code with the pr ...[truncated 437 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable repository URL with a reviewed, immutable commit hash or signed release tag.
2. Publish and verify cryptographic checksums or signatures for downloaded packages and model artifacts.
3. Prefer a project-local installation over -g to reduce scope and avoid globally exposing executables.
4. Run the component in a sandbox or container with restricted filesystem and network access.
5. Disable or carefully review package lifecycle scripts during installation where supported.
6. Document the expected package version, source revision, dependency lockfile, and GGUF model hashes.
7. Re-audit the pinned source and its transitive dependencies before recommending installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The instruction to immediately write anything the user asks to remember into persistent daily logs creates session persistence by design, but without any guardrails about sensitivity, retention, or consent boundaries. In a memory-management skill, this increases the chance that secrets, personal data, or ephemeral instructions are stored longer than the user expects.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

### Layer 1: Daily Logs — `memory/YYYY-MM-DD.md`
- **Append-only** session notes, running context, events of the day.
- OpenClaw reads **today + yesterday** at session start.
- If someone says "remember this" → write it here immediately.
- These accumulate over time; old logs are searchable via `memory_search`.

### Layer 2: Long-Term Memory — `MEMORY.md`

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

## 3. Compaction & Memory Flush

### The Problem
Long conversations fill the context window. When it hits the threshold, OpenClaw
**compacts** (summarizes/truncates) older messages. Anything only in the conversation
— including instructions typed in chat — can vanish.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly describes a silent background turn that writes durable notes to disk without any corresponding requirement for user notice, consent, or review. Even if intended as a usability feature, silent persistence can capture sensitive conversation content unexpectedly and create privacy and compliance risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The automatic flush mechanism tells the model to write durable notes to disk during a silent turn, which can persist conversation content without user visibility at precisely the moment context is being compacted. That combination makes accidental retention of sensitive or out-of-date instructions more likely and harder for users to detect.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

The Safety Net: Automatic Memory Flush

Before compaction fires, OpenClaw triggers a silent agentic turn that reminds the model to write durable notes to disk.

Default config:

json

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The external plugin section promotes cloud and auto-capture memory systems but does not clearly warn that conversation data may be stored outside the local workspace or transmitted to third-party services. This can mislead users into enabling persistent external storage for sensitive data without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.