files-memory-system

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:09 PM UTC
• Version: 1.16.1

Overview

This is a disclosed memory-management skill, but it needs Review because it persistently changes agent instructions and weakly scopes writable shared memory, secrets, and filesystem paths.

Install only after reviewing and accepting that this skill will persistently modify agent startup behavior, store chat-derived memory on disk, share global memory across groups, and install or clone content into workspace paths. Do not store API keys, passwords, tokens, or sensitive personal data in its memory files, and require path validation, trusted skill/version pinning, and explicit admin approval before using it in shared workspaces.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/post-install.sh:26

Finding

Persistent Agent Instruction and Memory Poisoning Through AGENTS.md Registration

Content

View full analysis

> "$AGENTS_FILE" << 'EOF' ## Files Memory System (Auto-Registered) This workspace has the **files-memory-system** skill installed. ### Available Memory Locations - **Global**: `memory/global/` - Cross-group shared memory - **Group-specific**: `memory/group__/` - Isolated per group - **Private**: `memory/private/` - 1-on-1 chat only ### Key Files - `MEMORY.md` - Long-term curated memory (private chats only) - `GLOBAL.md` - Quick reference in each memory directory - `YYYY-MM-DD.md` - Daily logs ### Session Start - Memory Loading Rules ⭐ **⚠️ 群聊中必须自动加载：** 1. `memory/group__/GLOBAL.md` - 群组关键信息 2. `memory/group__/YYYY-MM-DD.md` (today) - 今日记录 3. `memory/group__/YYYY-MM-DD.md` (yesterday) - 昨日记录 4. `memory/global/GLOBAL.md` - **跨群组全局共享记忆** **私聊中自动加载：** 1. `memory/private/YYYY-MM-DD.md` (today + yesterday) 2. `memory/global/GLOBAL.md` - **跨群组全局共享记忆** 3. `MEMORY.md` (仅私聊) **🔴 重要：群聊自动加载失效 Workaround (2026-03-26)** 当前 OpenClaw 版本在群聊中**不会自动加载**群记忆文件。 **Agent 必须在会话开始时手动加载：** ``` IF is_group_chat == true: 1. 从 metadata 获取 conversation_label (如: oc_a2b821...) 2. 构建路径: memory/group_feishu_/ 3. 手动读取: - GLOBAL.md - YYYY-MM-DD.md (today) - YYYY-MM-DD.md (yesterday) - memory/global/GLOBAL.md ``` **检查清单** (群聊中执行任何操作前): - [ ] 已读取群组 GLOBAL.md? - [ ] 已读取今日群组日志? - [ ] 已读取全局 GLOBAL.md? ### When to Use - User says "remember this" → Write to appropriate location - User asks "what did we discuss" → Search memory directories - User wants group isolation → Use group-spec ...[truncated 3257 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/auto-clone.sh:26

Finding

Path Traversal Through Unsanitized Group Identifiers and Repository Names

Content

View full analysis

[project_name]" echo "" echo "选项:" echo " --group 克隆到指定群组目录" echo " --private 克隆到私聊目录" echo " --help, -h 显示帮助" echo "" echo "示例:" echo " $0 --group feishu oc_xxx https://github.com/user/repo" echo " $0 --private https://github.com/user/repo my-project" echo " $0 https://github.com/user/repo # 克隆到全局 repos/" exit 0 ;; -*) echo "❌ 未知选项: $1" echo "用法: $0 --help 查看帮助" exit 1 ;; *) # 第一个非选项参数是 repo_url if [ -z "$REPO_URL" ]; then REPO_URL="$1" else # 第二个非选项参数是 project_name PROJECT_NAME="$1" fi shift ;; esac done ``` ```bash # 如果 project_name 没提供，从 URL 提取 if [ -z "$PROJECT_NAME" ]; then PROJECT_NAME=$(basename "$REPO_URL" .git) fi ``` ```bash if [ -n "$GROUP_CHANNEL" ] && [ -n "$GROUP_ID" ]; then # 在群组上下文中 - 先确保目录存在 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" bash "$SCRIPT_DIR/ensure-group-memory.sh" "$GROUP_CHANNEL" "$GROUP_ID" GROUP_DIR="memory/group_${GROUP_CHANN ...[truncated 3990 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:306

Finding

Plaintext Persistence of API Keys and Other Credentials

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:244

Finding

Unpinned and Unverified Third-Party Skill Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (42)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 65)May include surrounding context.

❌ 不要扩大删除范围

bash

# 危险！不要这样改
rm -rf /workspace/  # 会删除所有数据！

应该这样做

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 65)May include surrounding context.

❌ 不要扩大删除范围

bash

# 危险！不要这样改
rm -rf /workspace/  # 会删除所有数据！

应该这样做

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

This variant is more security-relevant because it documents modification of /workspace/AGENTS.md for self-registration and injection of operational instructions into an agent-read control file. Altering a trusted agent instruction source can create persistence and trust-boundary problems, especially if the inserted content changes future agent behavior outside the user's immediate request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This variant is more security-relevant because it documents modification of /workspace/AGENTS.md for self-registration and injection of operational instructions into an agent-read control file. Altering a trusted agent instruction source can create persistence and trust-boundary problems, especially if the inserted content changes future agent behavior outside the user's immediate request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This variant is more security-relevant because it documents modification of /workspace/AGENTS.md for self-registration and injection of operational instructions into an agent-read control file. Altering a trusted agent instruction source can create persistence and trust-boundary problems, especially if the inserted content changes future agent behavior outside the user's immediate request.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 90% confidence

Finding

The combination of broad manifest metadata and hidden AGENTS.md registration markers is consistent with metadata-driven tool/skill poisoning patterns. In this context, the danger comes from influencing agent selection and persisting behavior through trusted metadata and control-file edits rather than from a conventional code exploit.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: files-memory-system
description: Multi-context memory management system for OpenClaw agents with group-isolated storage, global shared memory, workspace organization, and group-specific skills isolation. Use when initializing or managing memory systems for multi-channel deployments, creating group-specific memory directories, setting up MEMORY.md for long-term cross-group memories, organizing workspace directories (projects/repos), cloning repositories to group-isolated locations, managing group-isolated skills, or handling any file operations in group chat contexts.
---

# ⚠️ CRITICAL RULES

## 群聊中克�

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

The paired hidden end marker serves the same persistence/injection mechanism as the installed marker and supports automated editing of AGENTS.md. Hidden delimiters inside agent-facing ecosystems are dangerous because they facilitate silent prompt persistence and make trust in the control file harder to verify.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

To unregister (remove from AGENTS.md):

bash

sed -i '/<!-- files-memory-system: installed -->/,/<!-- files-memory-system: end -->/d' /workspace/AGENTS.md

Overview

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

The paired hidden end marker serves the same persistence/injection mechanism as the installed marker and supports automated editing of AGENTS.md. Hidden delimiters inside agent-facing ecosystems are dangerous because they facilitate silent prompt persistence and make trust in the control file harder to verify.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

To unregister (remove from AGENTS.md):

bash

sed -i '/<!-- files-memory-system: installed -->/,/<!-- files-memory-system: end -->/d' /workspace/AGENTS.md

Overview

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly supports persisting secrets such as API keys into plain-text memory files, including global/shared memory, if the user insists. Even with a warning, embedding a workflow for durable plaintext secret storage in shared agent memory creates a high risk of credential leakage, cross-group exposure, later prompt retrieval, and compromise of external systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that group and private conversation memory are automatically loaded and persisted, but it does not clearly warn users about retention scope, privacy implications, consent expectations, or who can access stored data. In a multi-group memory system, undocumented automatic persistence increases the risk of collecting sensitive chat content without informed user awareness, which can lead to privacy violations or unintended disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation language is extremely broad, covering nearly any file or group-chat-related operation. In agent systems, overbroad matching can cause the skill to activate in contexts where persistent writes, cloning, or control-file modifications are unnecessary, increasing the chance of unsafe side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document contains operational instructions and user-facing confirmations entirely framed in Chinese, including required response phrases and workflow descriptions, without indicating that language selection depends on user preference. This can violate language/locale policy because it effectively imposes a specific language without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The critical rules state that direct git clone is prohibited and that auto-clone.sh --group must be used instead. Later, the usage example presents 'Option 2: Direct git clone' as a valid manual command, which directly conflicts with the earlier hard prohibition and can cause agents to ignore the intended isolation mechanism.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The installation flow copies the skill into a persistent shared workspace location, which gives it session-to-session persistence and broad availability to future agent runs. Persistence is not always unsafe, but here it compounds the self-registration behavior and increases the blast radius of any unsafe instructions embedded in the skill.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

bash

# 1. Copy to standard location
mkdir -p /workspace/skills
cp -r ~/.openclaw/skills/files-memory-system /workspace/skills/

# 2. Run self-registration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions tell the agent to immediately write user-provided content into persistent memory files without first giving a clear warning about retention scope, visibility, and privacy consequences. In a multi-group/shared-memory system, this can lead to accidental storage of sensitive, regulated, or private information in locations visible beyond the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs automatic file creation in a group context and auto-registration in GLOBAL.md without warning users that the content will persist and may be visible to others in that group context. This is dangerous because users may assume they are receiving ephemeral assistance, not creating durable shared artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template headings, labels, and instructional text are entirely in Chinese, which imposes a specific language on users. The file does not mention that Chinese is optional, nor does it document a region-specific reason for this locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document title and operational instructions are written entirely in Chinese, which effectively imposes a specific language on skill behavior and documentation. Under the policy, language constraints should be optional or explicitly justified as region-specific; this file provides neither user choice nor a documented reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document presents all user-facing instructions in Chinese and does not indicate any user language selection, alternative locale, or justification for a Chinese-only experience. This can violate a language/locale policy when users are not explicitly given a choice or informed of the constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a file-based memory and workspace isolation system, but this documentation tells users the AI will automatically read environment variables for API keys. Accessing runtime secrets is a separate capability from managing memory directories and files, and is not clearly justified by the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file title and all instructional content are written exclusively in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script initializes a shared GLOBAL.md template that explicitly invites storing 'important tools and credentials' and other cross-group information in a globally accessible memory area. In a multi-context/group-isolated system, encouraging placement of secrets into shared storage increases the chance of overexposure, accidental cross-group disclosure, and long-term retention of sensitive data without user awareness or access controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script's comments, usage text, and runtime messages are written in Chinese, which imposes a specific language on users. Under the policy criteria, this is a natural-language locale constraint that is not presented as optional or justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest frames this skill around multi-context memory for group chat deployments, including group-isolated storage, shared global memory, and group-specific skills/workspaces. This script is explicitly dedicated to private chat memory initialization ('私聊记忆目录') and creates a private-memory structure that is not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file comments state that this script should be called when a private-chat context is detected and that it ensures private-memory directories exist. That documented intent diverges from the skill's declared purpose, which focuses on group-isolated storage and handling file operations in group chat contexts rather than private chats.

Content

No source excerpt is available for this finding.