Double-Check-It Skill (再想想技能1.0)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:40 AM UTC
• Version: 1.0.0

Overview

The skill provides disclosed memory and review features, but it automatically stores broad conversation history in shared plaintext files without clear consent, scoping, deletion, or sensitive-data protections.

Install only if you deliberately want a broad persistent memory skill. Assume conversation summaries, requirements, corrections, preferences, and possibly sensitive details may be written in plaintext under the OpenClaw workspace and reused later; avoid using it with secrets, credentials, financial, medical, legal, or confidential business data unless you add your own consent, review, deletion, redaction, and per-project storage controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: scripts/memory.sh:73
• Finding: Untrusted Conversation Content Can Poison Persistent Agent Memory## Vulnerability Details **File Location**: `README.md:22-40`, `README.md:43-58`, `scripts/memory.sh:73-80`, `scripts/memory.sh:116-133` **Vulnerability Type**: Persistent storage of untrusted agent input without provenance or instruction filtering **Risk Level**: High ### Vulnerable Code `README.md:22-40` directs the agent to record information after every interaction: ```markdown ## Feature 1: Auto-Memory ### Trigger Timing - After each user interaction - After completing an action ### Recording Rules | Type | Recording Method | Example | |------|------------------|---------| | Normal Information | Concise summary | "User requested to check installed skills" | | Important Information | Detailed record | User requirements, solutions, scheduled task creation | ### Execution Commands ```bash # Record normal information ./scripts/memory.sh record "Conversation summary" --type normal # Record important information ./scripts/memory.sh record "Detailed record..." --type important --tags "requirements,stocks" ``` ``` `README.md:43-58` directs future agent activity to retrieve and act on persisted memories: ```markdown ## Feature 2: Double Check ### Trigger Timing 1. **Automatic Trigger**: Before each delivery 2. **Manual Trigger**: User says "double check"/"dc it" ### Execution Flow 1. Retrieve relevant memories (`memory/`) 2. Compare current task with user requirements 3. Determine if requirements are met 4. If not met, identify reasons and correct ### Execution Command ```bash ./scripts/memory.sh check "Current task description" "User original requirements" ``` ``` `scripts/memory.sh:73-80` appends caller-controlled content to the persistent diary: ```bash entry="$entry\n\n$content" # Append the constructed entry to the persistent diary. echo -e "$entry" >> "$diary_file" # Update the index using the same caller-controlled content and tags. update_index "daily/ ...[truncated 2887 chars]
• Remediation: ## Remediation Suggestions 1. Store memories as structured records containing source, user identity, task identifier, timestamp, trust level, and data type. 2. Treat all recalled memory as untrusted reference data. Never place it in a system-instruction or developer-instruction context. 3. Reject or quarantine memory entries containing imperative instructions, role changes, tool directives, credential requests, or attempts to override policies. 4. Require explicit user approval before promoting diary entries into long-lived experience or policy records. 5. Separate factual memories from preferences, instructions, and learned policies using different stores and access controls. 6. Limit retrieval to the current user and project, and display provenance when recalled content is presented to the agent. 7. Replace keyword-only reflection with a validation process that confirms relevance, authenticity, and safety. 8. Provide a review, correction, and deletion mechanism for poisoned or obsolete memory records.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/memory.sh:7
• Finding: Automatic Global Retention Can Expose Sensitive Conversation Data Across Tasks## Vulnerability Details **File Location**: `README.md:22-40`, `scripts/memory.sh:7-8`, `scripts/memory.sh:73-80` **Vulnerability Type**: Overbroad plaintext retention in a hard-coded shared workspace **Risk Level**: Medium ### Vulnerable Code `README.md:22-26` establishes automatic recording after interactions and actions: ```markdown ## Feature 1: Auto-Memory ### Trigger Timing - After each user interaction - After completing an action ``` `scripts/memory.sh:7-8` uses a fixed workspace-wide storage path: ```bash MEMORY_DIR="/home/minimax/.openclaw/workspace/memory" INDEX_FILE="$MEMORY_DIR/index.json" ``` `scripts/memory.sh:73-80` writes the supplied content to disk without redaction, encryption, retention controls, or restrictive permission handling: ```bash entry="$entry\n\n$content" # Append the constructed entry to the persistent diary. echo -e "$entry" >> "$diary_file" # Update the index using caller-controlled content and tags. update_index "daily/$date.md" "$content" "$tags" ``` ### Technical Analysis The design requests broad automatic retention of conversation summaries in a fixed global workspace. The implementation does not scope storage by user, project, session, or sensitivity level. It also does not detect credentials, tokens, personal information, private business data, or other material that should not be persisted. Directory and file creation rely on the process umask rather than explicitly enforcing restrictive permissions. No retention period, deletion command, encryption mechanism, consent control, or sensitive-data exclusion policy is implemented. Because the location is shared within the OpenClaw workspace, another task or skill running under the same operating-system account may be able to read or modify the records. This creates both confidentiality risk and cross-task integrity risk. ### Attack Path 1. A user includes a secret, personal detail, internal document ...[truncated 1172 chars]
• Remediation: ## Remediation Suggestions 1. Make persistent recording opt-in and clearly disclose what will be retained. 2. Use separate storage namespaces for each user, project, and task instead of a hard-coded global directory. 3. Apply restrictive permissions explicitly, such as directory mode `0700` and file mode `0600`. 4. Detect and redact API keys, passwords, tokens, private keys, personal identifiers, and other sensitive values before writing records. 5. Define short retention periods and implement user-accessible listing, correction, export, and secure deletion functions. 6. Do not record authentication, financial, medical, or similarly sensitive interactions by default. 7. Consider encryption at rest with keys isolated from unrelated skills and tasks. 8. Enforce authorization checks whenever memories are read, searched, indexed, reflected, or modified. 9. Avoid `echo -e` for untrusted data because backslash sequences can alter the serialized record; use `printf '%s\n'` with structured serialization instead.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly promotes remembering every conversation and using that stored history for future behavior, but provides no notice, consent mechanism, retention limits, or guidance on handling sensitive data. This creates a privacy and data-minimization risk because users may disclose secrets, personal data, or regulated information that then becomes persistently stored without clear boundaries.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Requiring persistent recording of every user conversation and important details is a direct data-retention hazard. In skill context, this is more dangerous because the memory is not narrowly scoped to a single task and is intended to influence future behavior, so accidental capture of secrets, personal data, or confidential business information is likely.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documented file system stores conversation summaries, facts, and derived reflections in persistent files, including examples like stock holdings, which may be sensitive. Persisting such information without warning or access-control guidance increases the chance of unintended retention, local disclosure, or later misuse by the agent or other tools.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Automatic recording after each interaction and action completion broadens collection to nearly all user inputs and agent activity, regardless of sensitivity. This increases both the volume of retained data and the likelihood that ephemeral or confidential information is written to disk unnecessarily.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The reflection feature compounds the original retention risk by reprocessing historical memories and extracting new summaries or lessons, creating additional derivative records from possibly sensitive conversations. That increases persistence, duplication, and the attack surface for disclosure, especially when prior data may no longer be necessary or appropriate to retain.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The Chinese section reiterates the same broad requirement to remember every conversation and record mistakes and requirements into persistent experience files. The duplicated instruction confirms this is intended behavior rather than an incidental example, reinforcing the privacy and over-collection risk.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: These auto-memory rules require routine capture after every interaction and preservation of detailed user requirements, which may include secrets, financial information, or other sensitive content. In this skill context, that broad persistence is more dangerous because memory is central to operation and therefore likely to be used frequently and without users realizing the full storage scope.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly establishes a long-term memory system that records user interactions and task outcomes, but it provides no user-facing notice, consent step, retention limit, or sensitivity filtering. This creates a real privacy and data-governance risk because routine conversations, requirements, and potentially sensitive details may be persisted automatically without the user's awareness.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill instructs the agent to persist details from every user interaction, including important needs, plans, and created tasks, into long-term memory. In context, this is more dangerous than ordinary note-taking because it is automatic, broad in scope, and likely to capture sensitive personal or operational data without minimization or consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The idle reflection feature performs background processing over historical memories and writes derived summaries back to persistent storage without any warning or approval flow. This is dangerous because it expands stored user data over time, increases inference about user behavior or preferences, and does so when the user is not actively requesting the action.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The reflection workflow revisits historical memories, extracts user-related details such as corrections, decisions, and error fixes, and writes new persistent summaries. This compounds privacy risk by creating secondary records and inferred profiles from prior data, increasing both exposure surface and the amount of sensitive information retained.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The example index and document structure explicitly encourage storing stock holdings and related financial information in persistent files. Financial portfolio data is sensitive, and embedding such examples normalizes retention of high-value personal information that could be exposed through compromise, overcollection, or accidental sharing.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The reflect command intentionally preserves and republishes user corrections, feedback, and preferences into a new summary file, creating a secondary data store of potentially sensitive natural-language information. This broadens the data retention surface and can expose personal or operational details beyond the original diary context, especially because the extraction is keyword-based and not sensitivity-aware.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The reflect operation automatically extracts diary entries matching correction/preference keywords and writes them into a separate experience summary file without notice, consent, or any review gate. This creates an additional copy of potentially sensitive user-provided content, expanding retention and exposure risk if the memory directory is later accessed, shared, or processed by other tools.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: A substantial portion of the skill is written as a Chinese-language variant and includes Chinese trigger phrases such as '再想想' alongside English ones, but it does not state whether users may choose their preferred language. This can conflict with language/locale policy expectations when a skill appears to impose a specific language without explicit opt-in.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The natural-language instructions prescribe Chinese-named directories and examples for the memory system, which can impose a specific language/locale convention. There is no indication that users may opt into another language or that the Chinese-only structure is required for a justified region-specific purpose.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: All user-facing comments, status messages, and help text are presented in Chinese, which effectively forces a specific language for interaction. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking context.

Static analysis

No suspicious patterns detected.