Lobster Memory System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 1.0.0

Overview

This memory skill is broadly coherent, but it asks users to run unverifiable PowerShell setup scripts with policy bypass and to create persistent automated backups of sensitive memory data.

Review this carefully before installing. Do not run the PowerShell commands unless you have inspected the actual scripts from a trusted source. Treat backups as sensitive because they may copy memory, configuration, preferences, project data, and agent behavior files. Prefer manual setup or narrowly scoped permissions, and avoid the recursive icacls full-control command unless you understand the effect.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

PowerShell Execution Policy Bypass for Unverifiable Scripts

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:39
• SKILL.md:49
• INSTALL.md:16
• INSTALL.md:25
• INSTALL.md:44

Vulnerability Type: Security control bypass during script execution
Risk Level: Medium

Vulnerable Code

powershell

powershell -ExecutionPolicy Bypass -File ~/.openclaw/skills/lobster-memory-system/scripts/init.ps1

powershell

powershell -ExecutionPolicy Bypass -File scripts/init.ps1

powershell

powershell -ExecutionPolicy Bypass -File setup-auto-backup.ps1

Technical Analysis

The installation documentation repeatedly instructs users to launch PowerShell with -ExecutionPolicy Bypass. This causes the invoked PowerShell process to ignore the configured execution policy, allowing unsigned or otherwise restricted scripts to run.

The audited package does not contain the referenced scripts directory or any of the named PowerShell files. Consequently, the contents and security properties of init.ps1 and setup-auto-backup.ps1 cannot be verified from this artifact. Although no malicious executable payload was found in the package, the documented command creates an unsafe execution path if a script is obtained separately, introduced in a future release, or replaced after installation.

Execution policy is not a complete security boundary, but bypassing it unnecessarily removes a defense-in-depth control and makes script substitution easier to exploit.

Attack Path

1. An attacker places or replaces scripts/init.ps1 or setup-auto-backup.ps1 in the expected installation directory.
2. This can occur through a compromised distribution, writable installation directory, malicious update, or local file replacement.
3. The user follows the documented command with -ExecutionPolicy Bypass.
4. PowerShell executes the substituted script without applying the configured execution-policy restrictions.
5. The script receives the privileges of the us ...[truncated 666 chars]

Remediation

View remediation

Remediation Suggestions

• Remove -ExecutionPolicy Bypass from every documented command.
• Include all referenced scripts in the reviewed package so their behavior can be audited before execution.
• Digitally sign distributed PowerShell scripts and document signature verification.
• Publish cryptographic hashes for released scripts and require verification before execution.
• Use a restrictive process-scoped policy only when operationally necessary rather than unconditionally disabling policy checks.
• Restrict write access to the installed scripts directory to prevent post-installation substitution.
• Display and review script contents before execution, particularly before running from an elevated shell.
• Ensure installation fails safely when a referenced script is absent rather than directing users to obtain it from an unspecified source.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: INSTALL.md:190

Finding

Recursive Full-Control ACL Grant Over Persistent Memory Data

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md:190
Vulnerability Type: Excessive filesystem permissions
Risk Level: Medium

Vulnerable Code

powershell

icacls memory-system /grant "$env:USERNAME:(OI)(CI)F" /T

Technical Analysis

The troubleshooting guidance recursively grants the current user full control (F) over the entire memory-system directory. The (OI)(CI) inheritance flags propagate that permission to descendant files and directories, while /T applies the operation recursively to the existing directory tree.

The documented directory is intended to contain identity definitions, behavioral constraints, permissions, configuration, long-term memory, short-term memory, and backup data. Applying a blanket full-control grant does not distinguish mutable memory data from security-sensitive identity, constraint, configuration, or executable content.

Full control includes reading, writing, deleting, and changing permissions. This exceeds the narrower read or data-write permissions that would ordinarily be required to repair access to mutable memory files.

Attack Path

1. The user encounters an access problem and follows the troubleshooting command.
2. Full-control permissions are recursively applied to the entire memory-system tree.
3. A process executing in the user's context modifies identity, constraint, permission, configuration, or memory files.
4. The modified persistent files are loaded by later agent sessions according to the documented workflow.
5. Poisoned state may consequently influence future behavior, or stored memory and backups may be deleted or corrupted.

Impact Assessment

The command weakens integrity protections across the complete application data tree. An attacker already executing as the affected user could alter or delete persistent memory, identity settings, constraints, configuration, and backups.

The scope is limited to the memory-system direc ...[truncated 259 chars]

Remediation

View remediation

Remediation Suggestions

• Do not recursively grant full control over the complete application tree.
• Separate mutable memory and backup data from immutable scripts, identity constraints, and security configuration.
• Grant only the permissions required for each directory, such as read and narrowly scoped write access.
• Preserve stricter ACLs on CORE, CONFIG, scripts, constraints, and permission definitions.
• Remove /T unless recursive modification is explicitly required and the affected files have been reviewed.
• Add an ACL inspection step before making changes and modify only the entries responsible for the access failure.
• Provide a restoration procedure that returns ACLs to a known secure baseline.
• Validate the integrity of persistent state before loading it in later sessions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation instructions tell users to run PowerShell scripts with ExecutionPolicy Bypass, which suppresses a key safety control designed to reduce accidental execution of untrusted scripts. In a skill package context, this is especially risky because users are encouraged to execute packaged code directly during installation without any warning, signature verification, or script review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The installation guide instructs users to set up a Windows Scheduled Task for daily automated backups, which creates persistent system-level behavior outside simple in-app memory management. While backup scheduling can be legitimate for this skill’s purpose, adding OS-level persistence and later suggesting broad filesystem permission changes increases attack surface and could normalize privileged actions users may not fully review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documented heartbeat workflow goes beyond memory storage and retrieval by directing ongoing self-improvement analysis, logging, and weekly report generation. Expanding a memory-management skill into autonomous behavioral shaping can cause the agent to persist and act on self-modification goals that were not clearly within the stated scope, making prompt and policy drift more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide includes a command that deletes files older than 30 days without an explicit data-loss warning, confirmation step, or recovery guidance. Even if intended for backup hygiene, destructive maintenance commands in installation docs can lead users to remove important data unintentionally, especially if paths or retention assumptions are wrong.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description and examples present the skill in Chinese and the configuration example sets timezone to Asia/Shanghai, but the document does not indicate that this is optional or region-specific. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to run PowerShell scripts with ExecutionPolicy Bypass, which disables an important safety control intended to reduce accidental execution of untrusted scripts. In a skill package context, this materially increases risk because users are encouraged to execute local scripts directly from the downloaded skill without any integrity verification or safety warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation describes automatic backups of CORE, MEMORY, CONFIG, and SKILLS into archive files, which can easily include sensitive user data, configuration secrets, and behavioral metadata. Although the skill mentions optional encryption and sensitive-data protection at a high level, it does not clearly warn users that backups may replicate confidential data into less protected locations or retention sets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown recommends using Remove-Item on session-tracker.json to reset first-session detection. While limited in scope, this is a destructive operation and the document does not warn users that it deletes tracking state and may affect subsequent memory-loading behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description is written entirely in Chinese, which can amount to a language/locale policy issue when the skill metadata does not offer any user language choice or explain that the skill is intended for a Chinese-speaking or region-specific audience. In a manifest, this user-facing description may constrain discoverability or usability for users expecting a default or selectable language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description is written entirely in Chinese, which presents a language-specific constraint in the manifest without indicating that users can choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This is a natural-language policy concern because it may impose a locale/language expectation on users without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.