Double-Check-It Skill (再想想技能1.0)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:40 AM UTC
• Version: 1.0.0

Overview

The skill provides disclosed memory and review features, but it automatically stores broad conversation history in shared plaintext files without clear consent, scoping, deletion, or sensitive-data protections.

Install only if you deliberately want a broad persistent memory skill. Assume conversation summaries, requirements, corrections, preferences, and possibly sensitive details may be written in plaintext under the OpenClaw workspace and reused later; avoid using it with secrets, credentials, financial, medical, legal, or confidential business data unless you add your own consent, review, deletion, redaction, and per-project storage controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: scripts/memory.sh:73

Finding

Untrusted Conversation Content Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: README.md:22-40, README.md:43-58, scripts/memory.sh:73-80, scripts/memory.sh:116-133
Vulnerability Type: Persistent storage of untrusted agent input without provenance or instruction filtering
Risk Level: High

Vulnerable Code

README.md:22-40 directs the agent to record information after every interaction:

markdown

## Feature 1: Auto-Memory

### Trigger Timing
- After each user interaction
- After completing an action

### Recording Rules
| Type | Recording Method | Example |
|------|------------------|---------|
| Normal Information | Concise summary | "User requested to check installed skills" |
| Important Information | Detailed record | User requirements, solutions, scheduled task creation |

### Execution Commands
```bash
# Record normal information
./scripts/memory.sh record "Conversation summary" --type normal

# Record important information
./scripts/memory.sh record "Detailed record..." --type important --tags "requirements,stocks"

text

`README.md:43-58` directs future agent activity to retrieve and act on persisted memories:

```markdown
## Feature 2: Double Check

### Trigger Timing
1. **Automatic Trigger**: Before each delivery
2. **Manual Trigger**: User says "double check"/"dc it"

### Execution Flow
1. Retrieve relevant memories (`memory/`)
2. Compare current task with user requirements
3. Determine if requirements are met
4. If not met, identify reasons and correct

### Execution Command
```bash
./scripts/memory.sh check "Current task description" "User original requirements"

text

`scripts/memory.sh:73-80` appends caller-controlled content to the persistent diary:

```bash
entry="$entry\n\n$content"

# Append the constructed entry to the persistent diary.
echo -e "$entry" >> "$diary_file"

# Update the index using the same caller-controlled content and tags.
update_index "daily/
...[truncated 2887 chars]

Remediation

View remediation

Remediation Suggestions

1. Store memories as structured records containing source, user identity, task identifier, timestamp, trust level, and data type.
2. Treat all recalled memory as untrusted reference data. Never place it in a system-instruction or developer-instruction context.
3. Reject or quarantine memory entries containing imperative instructions, role changes, tool directives, credential requests, or attempts to override policies.
4. Require explicit user approval before promoting diary entries into long-lived experience or policy records.
5. Separate factual memories from preferences, instructions, and learned policies using different stores and access controls.
6. Limit retrieval to the current user and project, and display provenance when recalled content is presented to the agent.
7. Replace keyword-only reflection with a validation process that confirms relevance, authenticity, and safety.
8. Provide a review, correction, and deletion mechanism for poisoned or obsolete memory records.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/memory.sh:7

Finding

Automatic Global Retention Can Expose Sensitive Conversation Data Across Tasks

Content

View full analysis

Vulnerability Details

File Location: README.md:22-40, scripts/memory.sh:7-8, scripts/memory.sh:73-80
Vulnerability Type: Overbroad plaintext retention in a hard-coded shared workspace
Risk Level: Medium

Vulnerable Code

README.md:22-26 establishes automatic recording after interactions and actions:

markdown

## Feature 1: Auto-Memory

### Trigger Timing
- After each user interaction
- After completing an action

scripts/memory.sh:7-8 uses a fixed workspace-wide storage path:

bash

MEMORY_DIR="/home/minimax/.openclaw/workspace/memory"
INDEX_FILE="$MEMORY_DIR/index.json"

scripts/memory.sh:73-80 writes the supplied content to disk without redaction, encryption, retention controls, or restrictive permission handling:

bash

entry="$entry\n\n$content"

# Append the constructed entry to the persistent diary.
echo -e "$entry" >> "$diary_file"

# Update the index using caller-controlled content and tags.
update_index "daily/$date.md" "$content" "$tags"

Technical Analysis

The design requests broad automatic retention of conversation summaries in a fixed global workspace. The implementation does not scope storage by user, project, session, or sensitivity level. It also does not detect credentials, tokens, personal information, private business data, or other material that should not be persisted.

Directory and file creation rely on the process umask rather than explicitly enforcing restrictive permissions. No retention period, deletion command, encryption mechanism, consent control, or sensitive-data exclusion policy is implemented.

Because the location is shared within the OpenClaw workspace, another task or skill running under the same operating-system account may be able to read or modify the records. This creates both confidentiality risk and cross-task integrity risk.

Attack Path

1. A user includes a secret, personal detail, internal document ...[truncated 1172 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent recording opt-in and clearly disclose what will be retained.
2. Use separate storage namespaces for each user, project, and task instead of a hard-coded global directory.
3. Apply restrictive permissions explicitly, such as directory mode 0700 and file mode 0600.
4. Detect and redact API keys, passwords, tokens, private keys, personal identifiers, and other sensitive values before writing records.
5. Define short retention periods and implement user-accessible listing, correction, export, and secure deletion functions.
6. Do not record authentication, financial, medical, or similarly sensitive interactions by default.
7. Consider encryption at rest with keys isolated from unrelated skills and tasks.
8. Enforce authorization checks whenever memories are read, searched, indexed, reflected, or modified.
9. Avoid echo -e for untrusted data because backslash sequences can alter the serialized record; use printf '%s\n' with structured serialization instead.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly promotes remembering every conversation and using that stored history for future behavior, but provides no notice, consent mechanism, retention limits, or guidance on handling sensitive data. This creates a privacy and data-minimization risk because users may disclose secrets, personal data, or regulated information that then becomes persistently stored without clear boundaries.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Requiring persistent recording of every user conversation and important details is a direct data-retention hazard. In skill context, this is more dangerous because the memory is not narrowly scoped to a single task and is intended to influence future behavior, so accidental capture of secrets, personal data, or confidential business information is likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented file system stores conversation summaries, facts, and derived reflections in persistent files, including examples like stock holdings, which may be sensitive. Persisting such information without warning or access-control guidance increases the chance of unintended retention, local disclosure, or later misuse by the agent or other tools.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatic recording after each interaction and action completion broadens collection to nearly all user inputs and agent activity, regardless of sensitivity. This increases both the volume of retained data and the likelihood that ephemeral or confidential information is written to disk unnecessarily.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reflection feature compounds the original retention risk by reprocessing historical memories and extracting new summaries or lessons, creating additional derivative records from possibly sensitive conversations. That increases persistence, duplication, and the attack surface for disclosure, especially when prior data may no longer be necessary or appropriate to retain.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Chinese section reiterates the same broad requirement to remember every conversation and record mistakes and requirements into persistent experience files. The duplicated instruction confirms this is intended behavior rather than an incidental example, reinforcing the privacy and over-collection risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These auto-memory rules require routine capture after every interaction and preservation of detailed user requirements, which may include secrets, financial information, or other sensitive content. In this skill context, that broad persistence is more dangerous because memory is central to operation and therefore likely to be used frequently and without users realizing the full storage scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly establishes a long-term memory system that records user interactions and task outcomes, but it provides no user-facing notice, consent step, retention limit, or sensitivity filtering. This creates a real privacy and data-governance risk because routine conversations, requirements, and potentially sensitive details may be persisted automatically without the user's awareness.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to persist details from every user interaction, including important needs, plans, and created tasks, into long-term memory. In context, this is more dangerous than ordinary note-taking because it is automatic, broad in scope, and likely to capture sensitive personal or operational data without minimization or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The idle reflection feature performs background processing over historical memories and writes derived summaries back to persistent storage without any warning or approval flow. This is dangerous because it expands stored user data over time, increases inference about user behavior or preferences, and does so when the user is not actively requesting the action.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reflection workflow revisits historical memories, extracts user-related details such as corrections, decisions, and error fixes, and writes new persistent summaries. This compounds privacy risk by creating secondary records and inferred profiles from prior data, increasing both exposure surface and the amount of sensitive information retained.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example index and document structure explicitly encourage storing stock holdings and related financial information in persistent files. Financial portfolio data is sensitive, and embedding such examples normalizes retention of high-value personal information that could be exposed through compromise, overcollection, or accidental sharing.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The reflect command intentionally preserves and republishes user corrections, feedback, and preferences into a new summary file, creating a secondary data store of potentially sensitive natural-language information. This broadens the data retention surface and can expose personal or operational details beyond the original diary context, especially because the extraction is keyword-based and not sensitivity-aware.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The reflect operation automatically extracts diary entries matching correction/preference keywords and writes them into a separate experience summary file without notice, consent, or any review gate. This creates an additional copy of potentially sensitive user-provided content, expanding retention and exposure risk if the memory directory is later accessed, shared, or processed by other tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

A substantial portion of the skill is written as a Chinese-language variant and includes Chinese trigger phrases such as '再想想' alongside English ones, but it does not state whether users may choose their preferred language. This can conflict with language/locale policy expectations when a skill appears to impose a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions prescribe Chinese-named directories and examples for the memory system, which can impose a specific language/locale convention. There is no indication that users may opt into another language or that the Chinese-only structure is required for a justified region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

All user-facing comments, status messages, and help text are presented in Chinese, which effectively forces a specific language for interaction. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.