Session Persistence 会话上下文持久化

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with local session-memory persistence, but it automatically stores and reuses conversation summaries and references an unprovided AGENTS.md patch that would change agent behavior.

Install only if you are comfortable with OpenClaw automatically saving and reusing conversation summaries in local memory files. Before use, inspect or create the missing AGENTS.md rules yourself, keep sensitive data out of persisted summaries, and periodically review or delete the ./memory files.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI06: Memory and Context Poisoning
Medium
What this means

Sensitive or incorrect information from one session could be saved locally and influence later sessions without the user noticing each write.

Why it was flagged

This instructs the agent to automatically store and reuse session summaries across conversations. The artifacts do not define sensitivity filters, user approval, retention limits, deletion controls, or how to handle poisoned/incorrect memory.

Skill content
每次新会话启动时自动读取上一个会话的摘要;每次回复时自动追加有价值的信息到会话摘要,无需手动操作
Recommendation

Require explicit user approval or clear rules for what can be saved, document retention/deletion, and review the memory files before allowing them to guide future sessions.

#
ASI04: Agentic Supply Chain Vulnerabilities
Medium
What this means

Users may be asked to apply agent-behavior rules that are not present in the reviewed artifacts, making the automatic persistence behavior hard to verify.

Why it was flagged

The skill says an AGENTS.md patch is required and included, but the provided file manifest contains only SKILL.md and session-manager.sh. Because AGENTS.md changes can alter agent startup behavior and persistence, the missing patch leaves important behavior unreviewed.

Skill content
`AGENTS.md.patch`:需要添加到你的AGENTS.md中的规则补丁
Recommendation

Do not apply any AGENTS.md changes unless the exact patch is supplied and reviewed; the package should include the referenced patch or remove that instruction.