files-memory-system

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:09 PM UTC
• Version: 1.16.1

Overview

This is a disclosed memory-management skill, but it needs Review because it persistently changes agent instructions and weakly scopes writable shared memory, secrets, and filesystem paths.

Install only after reviewing and accepting that this skill will persistently modify agent startup behavior, store chat-derived memory on disk, share global memory across groups, and install or clone content into workspace paths. Do not store API keys, passwords, tokens, or sensitive personal data in its memory files, and require path validation, trusted skill/version pinning, and explicit admin approval before using it in shared workspaces.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/post-install.sh:26
• Finding: Persistent Agent Instruction and Memory Poisoning Through AGENTS.md Registration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/post-install.sh:26-88`; related mandatory memory-handling rules appear in `SKILL.md:21-39`, `SKILL.md:110-163`, and `SKILL.md:274-284` **Vulnerability Type**: Persistent instruction injection and consumption of attacker-controlled memory **Risk Level**: Critical ### Vulnerable Code ```bash # 添加到 AGENTS.md cat >> "$AGENTS_FILE" << 'EOF' <!-- files-memory-system: installed --> ## Files Memory System (Auto-Registered) This workspace has the **files-memory-system** skill installed. ### Available Memory Locations - **Global**: `memory/global/` - Cross-group shared memory - **Group-specific**: `memory/group_<channel>_<id>/` - Isolated per group - **Private**: `memory/private/` - 1-on-1 chat only ### Key Files - `MEMORY.md` - Long-term curated memory (private chats only) - `GLOBAL.md` - Quick reference in each memory directory - `YYYY-MM-DD.md` - Daily logs ### Session Start - Memory Loading Rules ⭐ **⚠️ 群聊中必须自动加载：** 1. `memory/group_<channel>_<id>/GLOBAL.md` - 群组关键信息 2. `memory/group_<channel>_<id>/YYYY-MM-DD.md` (today) - 今日记录 3. `memory/group_<channel>_<id>/YYYY-MM-DD.md` (yesterday) - 昨日记录 4. `memory/global/GLOBAL.md` - **跨群组全局共享记忆** **私聊中自动加载：** 1. `memory/private/YYYY-MM-DD.md` (today + yesterday) 2. `memory/global/GLOBAL.md` - **跨群组全局共享记忆** 3. `MEMORY.md` (仅私聊) **🔴 重要：群聊自动加载失效 Workaround (2026-03-26)** 当前 OpenClaw 版本在群聊中**不会自动加载**群记忆文件。 **Agent 必须在会话开始时手动加载：** ``` IF is_group_chat == true: 1. 从 metadata 获取 conversation_label (如: oc_a2b821...) 2. 构建路径: memory/group_feishu_<conversation_label>/ 3. 手动读取: - GLOBAL.md - YYYY-MM-DD.md (today) - YYYY-MM-DD.md (yesterday) - memory/global/GLOBAL.md ``` **检查清单** (群聊中执行任何操作前): - [ ] 已读取群组 GLOBAL.md? - [ ] 已读取今日群组日志? - [ ] 已读取全局 GLOBAL.md? ### When to Use - User says "remember this" → Write to appropriate location - User asks "what did we discuss" → Search memory directories - User wants group isolation → Use group-spec ...[truncated 3257 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic modification of `/workspace/AGENTS.md`. Registration should require explicit administrator review and approval. 2. Do not mandate that persistent memory be interpreted as operational instructions. 3. Treat all memory-file content as untrusted data, regardless of which user originally supplied it. 4. Store memory in a structured format with separate fields for facts, source identity, timestamp, scope, and trust level. 5. Reject or quarantine content containing instructions to change system behavior, execute tools, disclose data, bypass policy, or modify security settings. 6. Require explicit confirmation before writing content to global or cross-group memory. 7. Restrict global memory writes to authorized users or administrators. 8. Present loaded memory to the Agent inside a clearly delimited, non-authoritative data section. 9. Add provenance and integrity controls so the Agent can distinguish administrator-approved rules from ordinary user-generated notes. 10. Provide an uninstall routine that safely removes only the exact registered block from `AGENTS.md`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/auto-clone.sh:26
• Finding: Path Traversal Through Unsanitized Group Identifiers and Repository Names<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto-clone.sh:26-65,75-77,94-134`; related path construction occurs in `scripts/ensure-group-memory.sh:7-21` and `scripts/init-group-memory.sh:4-19` **Vulnerability Type**: User-controlled filesystem path traversal **Risk Level**: High ### Vulnerable Code ```bash GROUP_CHANNEL="" GROUP_ID="" IS_PRIVATE="" REPO_URL="" PROJECT_NAME="" while [[ $# -gt 0 ]]; do case $1 in --group) GROUP_CHANNEL="$2" GROUP_ID="$3" shift 3 ;; --private) IS_PRIVATE="1" shift ;; --help|-h) echo "用法: $0 [选项] <repo_url> [project_name]" echo "" echo "选项:" echo " --group <channel> <group_id> 克隆到指定群组目录" echo " --private 克隆到私聊目录" echo " --help, -h 显示帮助" echo "" echo "示例:" echo " $0 --group feishu oc_xxx https://github.com/user/repo" echo " $0 --private https://github.com/user/repo my-project" echo " $0 https://github.com/user/repo # 克隆到全局 repos/" exit 0 ;; -*) echo "❌ 未知选项: $1" echo "用法: $0 --help 查看帮助" exit 1 ;; *) # 第一个非选项参数是 repo_url if [ -z "$REPO_URL" ]; then REPO_URL="$1" else # 第二个非选项参数是 project_name PROJECT_NAME="$1" fi shift ;; esac done ``` ```bash # 如果 project_name 没提供，从 URL 提取 if [ -z "$PROJECT_NAME" ]; then PROJECT_NAME=$(basename "$REPO_URL" .git) fi ``` ```bash if [ -n "$GROUP_CHANNEL" ] && [ -n "$GROUP_ID" ]; then # 在群组上下文中 - 先确保目录存在 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" bash "$SCRIPT_DIR/ensure-group-memory.sh" "$GROUP_CHANNEL" "$GROUP_ID" GROUP_DIR="memory/group_${GROUP_CHANN ...[truncated 3990 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `GROUP_CHANNEL`, `GROUP_ID`, and `PROJECT_NAME` against a strict allowlist such as `^[A-Za-z0-9_-]+$`. 2. Reject empty values, `.` and `..`, path separators, control characters, and leading hyphens. 3. Resolve the intended root and destination to canonical absolute paths before writing. 4. Verify that the canonical destination starts with the canonical approved root followed by a path separator. 5. Use a fixed workspace root rather than paths relative to the caller's current working directory. 6. Do not derive project names from arbitrary URLs without validating the derived basename. 7. Add `--` before path operands where supported to prevent option confusion. 8. Refuse to operate on symbolic-link components beneath the destination root. 9. Apply the same validation and containment checks in `ensure-group-memory.sh` and `init-group-memory.sh`. 10. Add regression tests for traversal inputs, absolute paths, encoded separators, whitespace, control characters, and symbolic-link escapes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:306
• Finding: Plaintext Persistence of API Keys and Other Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:306-325` **Vulnerability Type**: Plaintext storage of sensitive credentials in persistent memory **Risk Level**: High ### Vulnerable Code ```markdown **Example 2: Record API Key (⚠️ Not Recommended)** ``` User: "记录到全局记忆里：API密钥 sk-abc123" ⚠️ **SECURITY WARNING**: Storing API keys in plain text in memory files is NOT recommended. **Recommended approach: Use environment variables** export API_KEY="sk-xxx" Alternative (if environment variables not possible): - Use a secrets manager - Use encrypted storage If user insists on storing in memory: 1. Warn: "⚠️ 存储 API 密钥到记忆文件存在安全风险，建议仅用于测试环境" 2. Detect target location based on user command 3. Format as table and append 4. Confirm: "✅ 已记录 (⚠️ 安全风险)" ``` ``` ### Technical Analysis Although the documentation warns against plaintext credential storage, it explicitly directs the Agent to persist an API key when a user insists. A warning does not mitigate the confidentiality risk created by writing the secret into Markdown files. These memory files are designed to persist across sessions and be loaded into future model contexts. Global memory is shared across groups, and even private or group memory may be exposed through backups, filesystem access, logs, indexing, support bundles, or later prompts. The Skill does not enforce secret detection, encryption, restrictive file modes, access-control checks, retention limits, or automatic redaction. ### Attack Path 1. A user supplies an API key, password, token, or other secret in a chat. 2. The user asks that it be recorded in group, private, or global memory. 3. The Agent issues a warning but follows the documented instruction to append the secret. 4. The credential remains in plaintext on disk across sessions. 5. A later Agent session, another group loading global memory, a local process, backup operator, or workspace reader obtains the credential. 6. The exposed credential is used against the external serv ...[truncated 654 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the option to store credentials even when a user insists. 2. Make secret persistence a hard-deny rule for global, group, private, and daily memory. 3. Detect common credential formats and redact them before writing memory. 4. Direct users to an approved secrets manager rather than ordinary environment variables when long-term persistence is required. 5. Store only a non-sensitive secret reference or identifier in memory. 6. Set restrictive permissions on memory directories and files, such as owner-only access where compatible with the deployment. 7. Prevent global memory from accepting any content classified as confidential. 8. Add a secret-scanning step before every memory write. 9. Provide a secure remediation workflow to locate, revoke, rotate, and remove credentials already written to memory or backups. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:244
• Finding: Unpinned and Unverified Third-Party Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:244-260`; the same unsafe pattern is documented in `README.md:81-87` and `references/architecture.md:92` **Vulnerability Type**: Unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### Scenario 3: Install Skill for Specific Group **Context**: User says: "Install inkos skill for this group only" **Automatic Actions**: 1. Install to: `memory/group_xxx/skills/inkos/` 2. Update group's GLOBAL.md 3. Skill is isolated to this group only **Manual Commands**: ```bash # Method 1: Using clawhub with --dir clawhub install inkos --dir memory/group_feishu_xxx/skills # Method 2: Manual copy mkdir -p memory/group_feishu_xxx/skills/inkos cp -r inkos/* memory/group_feishu_xxx/skills/inkos/ ``` ``` ### Technical Analysis The Skill recommends installing a named third-party package directly from a registry without pinning an exact immutable version, verifying a cryptographic digest, validating publisher identity, or requiring a content review. A mutable registry package can change after this Skill has been audited. If the package name is compromised, transferred, spoofed, or updated maliciously, the effective code and instruction payload installed by this command will differ from what was previously reviewed. Placing the dependency in a group-specific directory limits its intended application scope but does not make the package trustworthy. A malicious Skill may still contain scripts or instructions that misuse the Agent's available permissions. ### Attack Path 1. An attacker compromises the registry account or package corresponding to the documented Skill name, or publishes a malicious package selected by a user. 2. The malicious package is uploaded under the expected mutable name or version range. 3. A user asks the Agent to install the Skill for a group. 4. The Agent runs the documented unpinned `clawhub install` command. 5. The current package contents a ...[truncated 855 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every third-party Skill to an exact immutable version. 2. Verify a cryptographic digest or trusted signature before activation. 3. Maintain an allowlist of approved package names, versions, publishers, and hashes. 4. Require explicit user or administrator approval before downloading or activating a Skill. 5. Inspect downloaded manifests, instructions, and scripts before making the package available to the Agent. 6. Use a trusted internal mirror or lockfile where supported. 7. Run third-party Skills with restricted filesystem, network, tool, and secret access. 8. Record dependency provenance and verification results in an audit log. 9. Re-review and reapprove dependencies whenever their version or digest changes. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (42)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

❌ **不要扩大删除范围**
```bash
# 危险！不要这样改
rm -rf /workspace/  # 会删除所有数据！
```

### 应该这样做

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

❌ **不要扩大删除范围**
```bash
# 危险！不要这样改
rm -rf /workspace/  # 会删除所有数据！
```

### 应该这样做

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: This variant is more security-relevant because it documents modification of /workspace/AGENTS.md for self-registration and injection of operational instructions into an agent-read control file. Altering a trusted agent instruction source can create persistence and trust-boundary problems, especially if the inserted content changes future agent behavior outside the user's immediate request.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: This variant is more security-relevant because it documents modification of /workspace/AGENTS.md for self-registration and injection of operational instructions into an agent-read control file. Altering a trusted agent instruction source can create persistence and trust-boundary problems, especially if the inserted content changes future agent behavior outside the user's immediate request.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This variant is more security-relevant because it documents modification of /workspace/AGENTS.md for self-registration and injection of operational instructions into an agent-read control file. Altering a trusted agent instruction source can create persistence and trust-boundary problems, especially if the inserted content changes future agent behavior outside the user's immediate request.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: files-memory-system
description: Multi-context memory management system for OpenClaw agents with group-isolated storage, global shared memory, workspace organization, and group-specific skills isolation. Use when initializing or managing memory systems for multi-channel deployments, creating group-specific memory directories, setting up MEMORY.md for long-term cross-group memories, organizing workspace directories (projects/repos), cloning repositories to group-isolated locations, managing group-isolated skills, or handling any file operations in group chat contexts.
---

# ⚠️ CRITICAL RULES

## 群聊中克�

• Confidence: 90% confidence
• Finding: The combination of broad manifest metadata and hidden AGENTS.md registration markers is consistent with metadata-driven tool/skill poisoning patterns. In this context, the danger comes from influencing agent selection and persisting behavior through trusted metadata and control-file edits rather than from a conventional code exploit.

Hidden Instructions

High

• Category: Prompt Injection

Content

To unregister (remove from AGENTS.md):
```bash
sed -i '/<!-- files-memory-system: installed -->/,/<!-- files-memory-system: end -->/d' /workspace/AGENTS.md
```

## Overview

• Confidence: 92% confidence
• Finding: The paired hidden end marker serves the same persistence/injection mechanism as the installed marker and supports automated editing of AGENTS.md. Hidden delimiters inside agent-facing ecosystems are dangerous because they facilitate silent prompt persistence and make trust in the control file harder to verify.

Hidden Instructions

High

• Category: Prompt Injection

Content

To unregister (remove from AGENTS.md):
```bash
sed -i '/<!-- files-memory-system: installed -->/,/<!-- files-memory-system: end -->/d' /workspace/AGENTS.md
```

## Overview

• Confidence: 92% confidence
• Finding: The paired hidden end marker serves the same persistence/injection mechanism as the installed marker and supports automated editing of AGENTS.md. Hidden delimiters inside agent-facing ecosystems are dangerous because they facilitate silent prompt persistence and make trust in the control file harder to verify.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly supports persisting secrets such as API keys into plain-text memory files, including global/shared memory, if the user insists. Even with a warning, embedding a workflow for durable plaintext secret storage in shared agent memory creates a high risk of credential leakage, cross-group exposure, later prompt retrieval, and compromise of external systems.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that group and private conversation memory are automatically loaded and persisted, but it does not clearly warn users about retention scope, privacy implications, consent expectations, or who can access stored data. In a multi-group memory system, undocumented automatic persistence increases the risk of collecting sensitive chat content without informed user awareness, which can lead to privacy violations or unintended disclosure.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation language is extremely broad, covering nearly any file or group-chat-related operation. In agent systems, overbroad matching can cause the skill to activate in contexts where persistent writes, cloning, or control-file modifications are unnecessary, increasing the chance of unsafe side effects.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document contains operational instructions and user-facing confirmations entirely framed in Chinese, including required response phrases and workflow descriptions, without indicating that language selection depends on user preference. This can violate language/locale policy because it effectively imposes a specific language without opt-in or documented regional justification.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The critical rules state that direct `git clone` is prohibited and that `auto-clone.sh --group` must be used instead. Later, the usage example presents 'Option 2: Direct git clone' as a valid manual command, which directly conflicts with the earlier hard prohibition and can cause agents to ignore the intended isolation mechanism.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 1. Copy to standard location
mkdir -p /workspace/skills
cp -r ~/.openclaw/skills/files-memory-system /workspace/skills/

# 2. Run self-registration

• Confidence: 88% confidence
• Finding: The installation flow copies the skill into a persistent shared workspace location, which gives it session-to-session persistence and broad availability to future agent runs. Persistence is not always unsafe, but here it compounds the self-registration behavior and increases the blast radius of any unsafe instructions embedded in the skill.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions tell the agent to immediately write user-provided content into persistent memory files without first giving a clear warning about retention scope, visibility, and privacy consequences. In a multi-group/shared-memory system, this can lead to accidental storage of sensitive, regulated, or private information in locations visible beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs automatic file creation in a group context and auto-registration in GLOBAL.md without warning users that the content will persist and may be visible to others in that group context. This is dangerous because users may assume they are receiving ephemeral assistance, not creating durable shared artifacts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template headings, labels, and instructional text are entirely in Chinese, which imposes a specific language on users. The file does not mention that Chinese is optional, nor does it document a region-specific reason for this locale restriction.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The document title and operational instructions are written entirely in Chinese, which effectively imposes a specific language on skill behavior and documentation. Under the policy, language constraints should be optional or explicitly justified as region-specific; this file provides neither user choice nor a documented reason.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The document presents all user-facing instructions in Chinese and does not indicate any user language selection, alternative locale, or justification for a Chinese-only experience. This can violate a language/locale policy when users are not explicitly given a choice or informed of the constraint.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The manifest describes a file-based memory and workspace isolation system, but this documentation tells users the AI will automatically read environment variables for API keys. Accessing runtime secrets is a separate capability from managing memory directories and files, and is not clearly justified by the skill’s stated purpose.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The file title and all instructional content are written exclusively in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script initializes a shared GLOBAL.md template that explicitly invites storing 'important tools and credentials' and other cross-group information in a globally accessible memory area. In a multi-context/group-isolated system, encouraging placement of secrets into shared storage increases the chance of overexposure, accidental cross-group disclosure, and long-term retention of sensitive data without user awareness or access controls.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The script's comments, usage text, and runtime messages are written in Chinese, which imposes a specific language on users. Under the policy criteria, this is a natural-language locale constraint that is not presented as optional or justified as a region-specific tool.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest frames this skill around multi-context memory for group chat deployments, including group-isolated storage, shared global memory, and group-specific skills/workspaces. This script is explicitly dedicated to private chat memory initialization ('私聊记忆目录') and creates a private-memory structure that is not mentioned in the manifest description.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file comments state that this script should be called when a private-chat context is detected and that it ensures private-memory directories exist. That documented intent diverges from the skill's declared purpose, which focuses on group-isolated storage and handling file operations in group chat contexts rather than private chats.

Static analysis

No suspicious patterns detected.