Memory Enhancer Pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:28 AM UTC
• Version: 0.1.5

Overview

This skill stays local and does not show data upload, but it overstates its memory features, reads extra agent-profile/control files that are not clearly disclosed, and includes memory deletion and scheduled-task behavior that users should review carefully.

Install only if you are comfortable with a local memory utility that can read OpenClaw memory plus USER.md, SOUL.md, and AGENTS.md metadata, write token stats/logs, and delete old date-named memory files when explicitly executed. Review scripts before enabling scheduled tasks, keep backups of ~/.openclaw/, avoid negative or untrusted --days values, and treat the advertised Pro semantic/compression claims as overstated.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Note

• Location: README.md:47

Finding

Unnecessary Third-Party Package Installation Recommendations

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scripts/token-optimizer.py:54

Finding

Optimizer Reads Undisclosed Agent Profile and Control Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup.py:73

Finding

Unvalidated Retention Period Can Trigger Broad Memory Deletion

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad, advanced 'pro' memory tool with multiple capabilities: semantic search, auto-refinement, smart classification, token optimization, scheduled tasks, and automatic compression. The supplied code only implements a very limited classification utility. It checks whether MEMORY.md exists, reads it, and counts occurrences of a few hardcoded keywords to print mention counts by category. The script itself explicitly states that full classification would require semantic analysis and recommends external NLP libraries, confirming that semantic or intelligent classification is not implemented. There is no search, no summarization, no token optimization, no scheduling, and no compression of old memory. The primary purpose is therefore materially narrower than declared, making this a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a feature-rich professional memory system with search, summarization, classification, token optimization, and scheduled-task capabilities. The supplied code chunk does not implement those behaviors. Instead, it operates as a maintenance utility for local markdown files in ~/.openclaw/workspace/memory: it creates today's daily memory file if missing, scans date-named .md files, and deletes ones older than a retention threshold. While this loosely relates to 'automatic compression/cleanup of old memory' in spirit, the code does not compress, optimize tokens in any substantive way, search semantically, classify content, or perform RAG. The primary purpose is materially narrower and different from the declared product description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied code chunk partially matches the description only in the areas of token optimization, automatic compression scheduling, and scheduled-task support. However, the declared purpose presents a broader 'Memory Enhancer Pro' with semantic search, automatic refining, intelligent classification, and AI memory retention features. None of those capabilities are implemented in this code. The code’s primary purpose is a scheduler/controller for a separate token-optimizer script, not a full memory enhancement system. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a broad 'Memory Enhancer Pro' system with advanced memory-management features, especially semantic search, summarization, classification, token optimization, and scheduled automation. The supplied code chunk only implements a straightforward command-line text search across a few local markdown files. Its primary purpose is much narrower than declared. There is no evidence of semantic retrieval, RAG, compression, optimization, or task scheduling in this code. The accessed resources are consistent with a memory-search utility, so the issue is mainly substantial overstatement of capabilities and materially different scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a broad, advanced memory-management system with semantic search, automatic refinement, classification, token optimization, compression of old memories, and scheduled tasks. The supplied code does not implement those capabilities. Instead, it is a narrow utility that checks for a single markdown file, reads it, and prints selected lines as a basic session summary. It even explicitly states that full summarization would require additional functionality not present. This is a material description-to-behavior mismatch because the primary purpose and feature scope of the code are far more limited than advertised.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a broad 'Memory Enhancer Pro' skill with semantic search, automatic refinement, intelligent categorization, token optimization, scheduled jobs, and superior memory functionality. The supplied code chunk only implements a token-usage analyzer/optimizer script for specific local workspace files. It estimates tokens, reports file statistics, writes a JSON stats file, produces optimization suggestions, and contains a simple summary helper. Its 'compress_memory' function does not actually merge or rewrite memory content despite the docstring claim; it only identifies older dated markdown files and reports potential savings. There is no semantic search, no classification, no scheduler, and no substantial retrieval or memory-management pipeline. Therefore the declared description materially overstates and misrepresents the actual behavior.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

��技能创建，本技能可能清理）

**只读操作：**
- 读取 `~/.openclaw/workspace/MEMORY.md`
- 读取 `~/.openclaw/workspace/SESSION-STATE.md`
- 读取会话历史（不修改）

### 网络访问
- **不联网：** 所有操作在本地执行
- **无外部依赖：** 不克隆外部仓库

### 定时任务 ⚠️
**如启用定时任务：**
- 需要手动添加 cron 条目到系统 crontab
- 或使用 OpenClaw 内置 cron（推荐）
- 定时任务会定期执行写入操作

**建议：**
1. 先手动运行测试（`--analyze`）
2. 确认输出符合预期
3. 再启用定时任务

### 数据安全
- **本地存储：** 所有数据保存在本地
- **不上传：** 不发送数据到外部服务器
- **建议备份：** 启用定时任务前备份 `~/.openclaw/`

---

**作者：** @williamwg2025  
**版本：** 1.0.1  
**许可证：** MIT-0

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The README recommends executing npx clawhub install ... without pinning a specific version, which can fetch whatever package version is current at install time. This creates a supply-chain risk: a compromised upstream package, typo-squatted dependency, or malicious future release could be executed by users during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This line instructs users to run npx clawhub install ... without a pinned clawhub version, allowing arbitrary newer code to be retrieved and run at install time. In a skill-distribution context, that increases exposure to upstream package compromise or unexpected behavior changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The unpinned npx clawhub invocation introduces a reproducibility and trust problem because users will execute the latest resolved package code rather than a reviewed version. If the package or one of its dependencies is malicious or compromised, this can lead to arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and documents capabilities that invoke shell commands and perform file reads/writes, but it declares no explicit tool scope or permissions. This increases the chance that an agent or user will run it with broader-than-necessary privileges, enabling unintended file modification or shell execution beyond the minimal required behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The main description and most user-facing instructions are presented in Chinese, and the title itself includes Chinese-only wording alongside the English product name. There is no indication that users may choose another language or that the locale restriction is intentional and justified, which creates a language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file’s natural-language strings and descriptions indicate the tool is presented in Chinese (for example, the title, docstrings, and user-facing messages) without any visible option to choose another language. This can violate a language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a professional memory enhancement tool with semantic search, intelligent classification, token optimization, and automatic compression. In this file, the implemented behavior is limited to reading one local markdown file and counting keyword occurrences, and it even states that full classification would require a separate NLP library.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language descriptions and runtime messages in Chinese, including the module docstring and operational prompts, without indicating that the user can choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file documentation states '可选：先压缩再删除' as part of the script's functionality, implying a compression capability. In actual code, expired files are either logged in dry-run mode or directly removed with unlink() at L105, with no compression logic anywhere in the module.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language descriptions and CLI output almost entirely in Chinese, including usage instructions and status messaging. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the tool is clearly documented as region-specific, which is not stated here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scheduled-optimizer.py (reported line 83)May include surrounding context.

python

return {'success': False}
    
    try:
        result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=300)
        return {
            'success': result.returncode == 0,
            'stdout': result.stdout,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/scheduled-optimizer.py (reported line 181)May include surrounding context.

python

print(f"\n{Colors.YELLOW}⚠️  注意：{Colors.NC}")
    print("需要在 OpenClaw 中配置定时任务，或使用系统 crontab：")
    print(f"\n添加到 crontab (crontab -e):")
    print(f"# Token Optimizer 定时任务")
    print(f"0 8 * * * cd ~/.openclaw/workspace && python3 skills/memory-enhancer/scripts/scheduled-optimizer.py analyze")
    print(f"0 3 * * 0 cd ~/.openclaw/workspace && python3 skills/memory-enhancer/scripts/scheduled-optimizer.py compress")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script contains multiple user-facing strings in Chinese, including the docstring comment and CLI usage/output messages, with no option for the user to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s natural-language description and user-facing strings indicate the skill operates in Chinese (for example, the title and messages at L04, L17-L18, and L41-L42) without any opt-in or language selection mechanism. This can violate language/locale policy when users are not given a choice of language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill manifest describes a professional memory tool with semantic search, automatic extraction, intelligent classification, token optimization, and old-memory compression. In contrast, this file merely reads SESSION-STATE.md and echoes up to 20 non-heading lines, which is far narrower than the claimed behavior and not a real implementation of the advertised capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-facing help/output strings are written in Chinese, which imposes a specific language on users. The file does not provide an English alternative, locale selection, or any explanation that this is a region-specific tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and module docstring advertise automatic compression of old memories, and the CLI exposes a '--compress' mode, but compress_memory() never merges, archives, rewrites, or deletes any memory files. It only reads dated files, counts their characters, and returns statistics, so the implemented behavior is analysis/reporting rather than actual memory compression.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The compress_memory() docstring explicitly states that old memory files will be merged into an archive section of MEMORY.md. In reality, the function only reads matching files, logs them as 'compressed', and increments counters without writing to MEMORY.md or changing the source files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.