Ask To Remember

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.5

Overview

This preference-memory skill appears purpose-aligned, but it persistently changes future agent behavior and stores local preference logs without strong user-controlled boundaries.

Install only if you want the agent to proactively ask preference questions and reuse the answers in future sessions. Before installing, be comfortable with changes to AGENTS.md or ~/.openclaw hooks and with local files such as MEMORY.md, atr-state.json, and atr-log.jsonl storing preference history. Avoid answering with sensitive information, and review or remove those files and hook entries if you want to disable or reset the behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill’s manifest presents it as a lightweight, non-blocking follow-up mechanism, but the implementation adds persistent state management, memory writes, logging, and bootstrap prompt injection. This mismatch is security-relevant because it hides materially broader behavior from reviewers and users, increasing the chance that persistent data collection and host modification occur without informed approval.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This section instructs the agent to persistently modify host configuration/prompt files despite the skill being described as only appending a brief question to a response. Persistent prompt injection into AGENTS.md changes future agent behavior across sessions, which is a materially more powerful capability than the declared purpose and can bypass normal review expectations.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documented behavior creates and maintains durable state, memory, and logs for user interactions, which exceeds the narrowly scoped description of asking one low-friction follow-up. Even if intended for product functionality, this expands data retention and attack surface by storing interaction outcomes and inferred preferences across sessions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill includes instructions to install user-level hooks and copy files into a managed hooks directory, creating startup-time persistence unrelated to merely asking a preference question. Hook installation can alter agent behavior on every future run and is especially dangerous because it establishes durable execution paths outside the immediate skill invocation.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The hook documentation describes injecting ask-to-remember logic and Phase B resolution rules into every main-session agent bootstrap, which materially broadens the skill from an opportunistic one-question follow-up into persistent prompt-level behavior. Prompt-wide injection increases the chance the skill runs outside its intended narrow scope, creates hidden behavioral coupling, and can cause unsolicited memory-capture behavior across unrelated interactions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Saying main-session-only behavior is enforced by prompt rather than code means the key safety boundary depends on an instruction layer that can be bypassed, omitted, or conflicted by other prompts or integrations. Because this skill is designed to capture user memory, failure of that boundary could lead to memory solicitation in shared or inappropriate contexts, creating privacy and policy violations.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger criteria are broad enough that the skill may activate in many ordinary conversations whenever there is a plausible reusable gap. In context, that broad scope increases the volume of preference probing and persistent collection, making privacy overreach and unnecessary state accumulation more likely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The hook injects operational instructions that direct the agent to write to MEMORY.md, atr-state.json, and atr-log.jsonl during bootstrap, but there is no accompanying disclosure or user-facing consent mechanism in this code path. Because the skill is specifically about persisting user preferences across conversations, silently adding file-writing behavior increases privacy and transparency risk, especially when memory capture is non-obvious to the user.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill is explicitly designed to persist user preferences and interaction metadata across conversations, including asked questions and outcomes. In context, this is risky because even non-sensitive preference capture can accumulate into a behavioral profile, and the manifest does not foreground the full retention and logging implications.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The injected prompt instructs the agent to extract reusable facts from replies and write them to MEMORY.md while also recording outcomes in logs. Because this logic is inserted into the agent’s standing instructions, it can silently normalize ongoing cross-session collection and make future memory writes happen automatically without fresh scrutiny.

Session Persistence

Medium

• Category: Rogue Agent

Content

将 `hooks/openclaw/` 目录下的文件复制到 managed hooks 目录：

```bash
mkdir -p ~/.openclaw/hooks/ask-to-remember
cp hooks/openclaw/HOOK.md hooks/openclaw/handler.js ~/.openclaw/hooks/ask-to-remember/
```

• Confidence: 96% confidence
• Finding: mkdir -p ~/.openclaw/hooks/ask-to-remember cp hooks/openclaw/HOOK.md hooks/openclaw/handler.js ~/.openclaw

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.