T02 · Agent Memory Poisoning
Error
- Location
scripts/memory_sync.py:95- Finding
Persistent Agent Memory Poisoning Through Untrusted Message Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Cross Channel Memory
Security checks for vulnerabilities and agentic risk
Overview
This skill performs the cross-channel memory function it advertises, but it handles linked identities and conversation memory with under-scoped persistence and isolation risks.
Install only in a controlled environment where all linked users have explicitly opted in. Before production use, require per-user memory isolation, validated identifiers, configurable OpenClaw paths, retention/deletion controls, and clear handling of stored user messages as untrusted data.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/memory_sync.py:51- Finding
Cross-User Memory Disclosure Caused by Missing Per-User Isolation
- Content
View full analysis
//memory ``` It is not isolated by both account and user: ```text //memory/ ``` Consequently, all users associated with the same agent account receive the same memory directory. `write_memory_record` also writes every user's messages into the same daily file in that directory. This is a broken authorization boundary. Possession of a valid mapping for an agent effectively grants access to the shared memory collection for every other user of that agent. ### Attack Path 1. A victim communicates with an agent, and the victim's message is written to `//memory/.md`. 2. An attacker is separately mapped to the same agent account. 3. Lookup for the attacker returns the identical `//memory` path. 4. The agent performs a memory search using that shar ...[truncated 719 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/session_hooks.py:31- Finding
Arbitrary File Write Through Path Traversal in Account and Session Identifiers
- Content
View full analysis
Path: """获取 session 状态文件路径""" SESSION_STATE_DIR.mkdir(parents=True, exist_ok=True) return SESSION_STATE_DIR / f"{agent_id}_{channel}_{session_id}.json" ``` The resulting path is written at `scripts/session_hooks.py:48-52`: ```python def save_session_state(agent_id: str, channel: str, session_id: str, state: dict): """保存 session 状态""" state_file = get_session_state_file(agent_id, channel, session_id) state_file.parent.mkdir(parents=True, exist_ok=True) with open(state_file, 'w', encoding='utf-8') as f: json.dump(state, f, indent=2, ensure_ascii=False) ``` A related path-construction issue exists in `scripts/memory_sync.py:51-56` and `scripts/memory_sync.py:89-93`: ```python memory_paths = [{ "accountId": target_account, "memoryPath": str(WORKSPACE_BASE / target_account / "memory") }] ``` ```python for path_info in paths_info["memoryPaths"]: memory_dir = Path(path_info["memoryPath"]) memory_dir.mkdir(parents=True, exist_ok=True) daily_file = memory_dir / f"{today}.md" ``` ### Technical Analysis The values `agent_id`, `channel`, `session_id`, and `account_id` are accepted without an allowlist and incorporated into filesystem paths. Path separators and `..` components are not rejected, and the resolved destination is not checked against the intended base directory. In the session-state path, an attacker can include traversal components in an identifier. The code then creates parent directories and opens the resulting `.json` path in write mode, truncating an existing file if one is reached. For memory writes, an arbitrary account identifier can be inserted into the mapping through the mapping commands. Tha ...[truncated 1768 chars]- Remediation
View remediation
str: if not SAFE_IDENTIFIER.fullmatch(value): raise ValueError(f"Invalid {field}") return value ``` 2. Reject absolute paths, path separators, empty values, `.`, and `..`. 3. Resolve every candidate path and verify that it remains inside the intended base: ```python base = SESSION_STATE_DIR.resolve() candidate = (base / filename).resolve() if not candidate.is_relative_to(base): raise ValueError("Path escapes session-state directory") ``` 4. Perform the same containment check for account memory directories under `WORKSPACE_BASE`. 5. Use trusted internal account IDs rather than caller-supplied account names when selecting workspace paths. 6. Avoid following symbolic links where security-sensitive writes occur. Use safe file-opening primitives and verify parent directory ownership. 7. Write state atomically through a temporary file in the validated destination directory, then replace the final file. 8. Add negative tests covering `../`, absolute paths, repeated separators, encoded separators, long identifiers, and symlink-based escapes. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory_sync.py:14- Finding
Hard-Coded Host-Specific Paths Can Target Another User's OpenClaw Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (28)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README explicitly promotes cross-channel identity linking and unified storage of conversation records, but it provides no safeguards, consent model, retention guidance, or access-control warnings. Because this skill correlates identities across platforms and reuses memories between channels, it creates a meaningful privacy and data-handling risk if deployed without explicit policy and technical controls.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The documented workflow persists user messages and makes them searchable from shared memory paths, which can expose sensitive user data beyond the originating channel or session. In this skill's context, the risk is heightened because memory is intentionally synchronized across channels and agents, increasing the blast radius of any overcollection, unauthorized access, or mistaken identity linkage.
- Content
3. 写入记忆
bash python3 ~/.openclaw/skills/cross-channel-memory/scripts/memory_sync.py write \ --channel qqbot \ --id "用户ID" \ --type user \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The documented workflow persists user messages and makes them searchable from shared memory paths, which can expose sensitive user data beyond the originating channel or session. In this skill's context, the risk is heightened because memory is intentionally synchronized across channels and agents, increasing the blast radius of any overcollection, unauthorized access, or mistaken identity linkage.
- Content
3. 写入记忆
bash python3 ~/.openclaw/skills/cross-channel-memory/scripts/memory_sync.py write \ --channel qqbot \ --id "用户ID" \ --type user \
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents use of shell commands plus file read/write against shared paths under ~/.openclaw, but it declares no explicit tool scope or permissions boundary. That makes the skill over-privileged by default and increases the chance an agent can access or modify files beyond the minimum required for cross-channel memory syncing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly enables identity linking and memory sharing across QQ, 飞书, and other channels, but it provides no user-facing notice or consent flow. Cross-channel correlation changes the privacy expectations of users and can expose prior conversations from one platform while they are interacting on another.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The initialization procedure instructs operators to collect and persist channel-specific identifiers in a shared JSON mapping file without any handling guidance. These identifiers are sensitive account-linkage data; if exposed or misused, they enable user tracking, cross-platform deanonymization, and incorrect identity association.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This duplicate finding points to the same write-and-retrieve behavior that creates durable session persistence. In this skill, persistence is especially sensitive because linked identities let stored content follow the user across platforms and agents, raising the chance of unintended disclosure.
- Content
将对话记录写入指定 agent 的记忆：
bash python3 ~/.openclaw/skills/cross-channel-memory/scripts/memory_sync.py write \ --channel qqbot \ --id "QQ_USER_ID" \ --account coder \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This duplicate finding points to the same write-and-retrieve behavior that creates durable session persistence. In this skill, persistence is especially sensitive because linked identities let stored content follow the user across platforms and agents, raising the chance of unintended disclosure.
- Content
将对话记录写入指定 agent 的记忆:
bash python3 ~/.openclaw/skills/cross-channel-memory/scripts/memory_sync.py write \ --channel qqbot \ --id "QQ_USER_ID" \ --account coder \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module title and all user-facing CLI descriptions are written only in Chinese, which imposes a language choice on users without any opt-in or alternative locale. The policy for natural-language content requires offering a language/locale choice or clearly documenting a justified locale constraint.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is presented as a lookup tool for cross-channel identity and memory discovery, but it also includes write capability that persists new identity mappings to a shared database. In a cross-channel memory context, this is security-sensitive because unauthorized or accidental writes can change identity resolution and cause one user's conversations or memory paths to be associated with another user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code creates the parent directory and writes updated mapping data to a persistent JSON file, which modifies user-related data on disk. While the CLI has an --add flag, there is no confirmation prompt, cautionary message, or explicit user-facing warning near the write path describing that the operation persists and changes shared mapping state.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI supports arbitrary addition of channel user IDs to unified identities via --add without any visible authorization, validation, or proof-of-identity checks. In this skill's context, that can let an operator or compromised agent bind an external account to the wrong unified user and then gain access to shared memory paths across channels, creating a direct cross-user data exposure risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file presents its tool name and user-facing descriptions entirely in Chinese, including the module docstring and later CLI help text, without offering a language choice or documenting that the skill is intentionally region-specific. This creates a language/locale policy issue because the skill implicitly enforces one language for users regardless of preference.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This tool writes cross-channel user messages and identifiers to persistent disk storage without any visible consent, notice, retention control, or minimization. In the context of a cross-channel memory sync skill, this is more dangerous because it aggregates identity and conversation data across platforms, increasing privacy risk and the blast radius of unauthorized access or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code persistently stores cross-channel identity mapping data to disk, including unified user IDs and per-channel identifiers, without any consent flow, disclosure, retention control, or access restriction visible in this file. In the context of a cross-channel memory skill, this creates a real privacy/security risk because it links identities across platforms and can enable profiling or unintended disclosure if the host is shared or the files are later accessed by other components.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The session state file automatically records user linkage metadata such as unified user ID, channel, agent ID, and update history, again without any user-facing warning or consent. This is sensitive correlation data in a cross-channel identity feature, and persistent storage increases the blast radius of accidental exposure, local compromise, or misuse by adjacent tools reading the same data directory.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python test file contains its module docstring, comments, and user-facing print messages entirely in Chinese, including the main test status output. Because there is no indication of user language selection or justification for a Chinese-only locale, this creates a natural-language locale policy concern under the language/locale rule.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python import subprocess # 添加用户 result = subprocess.run([ sys.executable, "init_mapping.py", "add-user",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"错误：{result.stderr}") # 绑定 QQ 渠道 result = subprocess.run([ sys.executable, "init_mapping.py", "link",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"绑定 QQ 渠道结果：{result.stdout}") # 列出用户 result = subprocess.run([ sys.executable, "init_mapping.py", "list"
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python import subprocess # 查找用户 result = subprocess.run([ sys.executable, "lookup_user.py", "--channel", "qqbot",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python import subprocess # lookup 命令 result = subprocess.run([ sys.executable, "memory_sync.py", "lookup",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"查找记忆路径结果：{result.stdout}") # write 命令 result = subprocess.run([ sys.executable, "memory_sync.py", "write",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python import subprocess # hook 命令 result = subprocess.run([ sys.executable, "session_hooks.py", "hook",
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
All visible user-facing documentation in this file is Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking environment. This can violate language/locale policy when a skill forces a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.