ClawHub
Back to skill

Security audit

memory management

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent memory manager, but it includes scheduled persistent memory changes and secret-adjacent OpenClaw configuration backups that need careful review before installation.

Install only if you are comfortable with persistent memory files, broad recall, and scheduled maintenance. Before enabling cron or copying examples, remove the OpenClaw config/API-key backup commands, require explicit confirmation before saving sensitive memories, review what paths the agent may read and write, and avoid unattended deletion until you have a tested backup and retention process.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:383
Finding

Plaintext Duplication of Secret-Bearing OpenClaw Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 383-396
Vulnerability Type: Plaintext sensitive-data duplication and insecure backup handling
Risk Level: Medium

Vulnerable Code

markdown
4. Configuration backups:
   - Backup: `openclaw.json -> openclaw.json.backup-YYYYMMDD`
   - Backup retention: keep at most the last 3 backups
   - Sync/update independent backups for API keys (if you have files like `.api-keys-backup.env`)
bash
cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.backup-$(date +%Y%m%d)
ls -t ~/.openclaw/openclaw.json.backup-* | tail -n +4 | xargs -r rm
cp ~/.openclaw/openclaw.json ~/.openclaw/.api-keys-backup.env

Technical Analysis

The documented maintenance workflow instructs users to copy the complete openclaw.json configuration into dated plaintext backup files and into a hidden file named .api-keys-backup.env.

The source configuration may contain API keys, authentication tokens, service endpoints, or other sensitive settings. The commands duplicate the entire file without encryption, destination-permission enforcement, or verification that the backup directory is protected. The effective permissions therefore depend on the invoking process and its umask.

The .api-keys-backup.env destination is particularly unsafe because:

  • It creates another secret-bearing copy rather than minimizing stored sensitive data.
  • Its .env-style name does not reflect that its contents are a complete JSON configuration.
  • Environment-file discovery, synchronization, backup, or development tooling may process it unexpectedly.
  • The workflow does not require exclusion from source control, shared archives, logs, or cloud synchronization.
  • Scheduled maintenance can repeatedly recreate or refresh the exposed copy.

This is an insecure backup practice rather than demonstrated malicious credential theft. No outbound exfiltration command exists in the audited project.

Attack Path

  1. A user adopts the ...[truncated 1539 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the following command entirely:

    bash
    cp ~/.openclaw/openclaw.json ~/.openclaw/.api-keys-backup.env

  2. Do not copy the complete configuration merely to back up API keys. Store credentials in a dedicated secret manager or encrypted credential store.

  3. If local configuration backups are operationally necessary, place them in a dedicated protected directory and explicitly enforce restrictive permissions:

    bash
    install -d -m 700 ~/.openclaw/backups
umask 077
cp -- ~/.openclaw/openclaw.json \
  ~/.openclaw/backups/openclaw.json.backup-$(date +%Y%m%d)
chmod 600 ~/.openclaw/backups/openclaw.json.backup-*

  4. Encrypt backups at rest using an approved key-management mechanism. Keep decryption keys separate from the backup files.

  5. Exclude configuration backups, .env files, and credential files from version control, cloud synchronization, shared archives, diagnostic bundles, and log collection.

  6. Back up only required non-secret fields where possible. Apply data minimization rather than cloning the complete configuration.

  7. Use an explicit retention implementation scoped to the protected backup directory. Review deletion behavior before enabling it in an unattended scheduled job.

  8. Document credential rotation procedures. If any generated backup may already have been exposed, revoke and replace every credential contained in the copied configuration.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
---
name: Memory Management / Management System
slug: memory-management
version: 1.0.0
homepage: https://clawhub.com/skills/memory-management
description: "A practical memory management system for OpenClaw: importance scoring, time-decay cleanup, write triggers, hybrid retrieval, and daily maintenance workflow."
changelog: "Converted from workspace/memory/MANAGEMENT.md (importance scoring + decay + recall + daily maintenance)."
metadata: {"clawdbot":{"emoji":"🧠","requires":{"bins":[]},"os":["linux","darwin","win32"]}}
---

# Memory Management Skill

This skill provides a unified workflow to write, retrieve, and maintain long-term / topic-based / short-term memories across OpenClaw sessions.

---

## When to Use

Use it when you w

Chaining Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The pipeline ls -t ... | tail -n +4 | xargs -r rm chains file enumeration directly into deletion. This pattern is brittle and dangerous in automation because parsing ls output is error-prone, and a mistake in globbing, filenames, or environment can delete unintended files without interactive safeguards.

Content

Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.

bash
cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.backup-$(date +%Y%m%d)
ls -t ~/.openclaw/openclaw.json.backup-* | tail -n +4 | xargs -r rm
cp ~/.openclaw/openclaw.json ~/.openclaw/.api-keys-backup.env

Chaining Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

This duplicated deletion pipeline repeats the same unsafe chaining behavior in another section of the file. Repetition raises operational risk because users may copy any instance into live automation, spreading a brittle deletion command.

Content

Scanner excerpt · SKILL.md (reported line 711)May include surrounding context.

bash
cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.backup-$(date +%Y%m%d)
ls -t ~/.openclaw/openclaw.json.backup-* | tail -n +4 | xargs -r rm
cp ~/.openclaw/openclaw.json ~/.openclaw/.api-keys-backup.env

Hidden Instructions

High
Category
Prompt Injection
Confidence
90% confidence
Finding

The file contains a large hidden HTML comment block with duplicated skill content, including operational instructions. Hidden instructions are risky because they can evade casual review, create ambiguity about effective guidance, and provide a covert channel for behavior that reviewers may miss.

Content

Scanner excerpt · SKILL.md (reported line 795)May include surrounding context.

md
- If useful: `clawhub star memory-management`
- Stay updated: `clawhub sync`

<!--
---
name: Memory Management / Management System
slug: memory-management

Chaining Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

Again, the skill presents a direct shell pipeline from listing to deletion, which is hazardous in unattended cron contexts. The combination of automation plus file removal creates substantial integrity risk if the command is misapplied or paths change.

Content

Scanner excerpt · SKILL.md (reported line 1028)May include surrounding context.

bash
cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.backup-$(date +%Y%m%d)
ls -t ~/.openclaw/openclaw.json.backup-* | tail -n +4 | xargs -r rm
cp ~/.openclaw/openclaw.json ~/.openclaw/.api-keys-backup.env

Chaining Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The Chinese-language duplicate includes the same unsafe xargs rm chaining, so the risk persists across localized copies. That broadens exposure by making the dangerous command more likely to be adopted by different readers.

Content

Scanner excerpt · SKILL.md (reported line 1332)May include surrounding context.

备份 shell 命令示例（你可以直接复制到 cron payload 内）：

bash
cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.backup-$(date +%Y%m%d)
ls -t ~/.openclaw/openclaw.json.backup-* | tail -n +4 | xargs -r rm
cp ~/.openclaw/openclaw.json ~/.openclaw/.api-keys-backup.env

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to persist conversation content to files based on trigger phrases, but it does not require a user-facing warning or consent notice at the moment of storage. This is dangerous because users may not realize that ordinary chat content is being written to disk, increasing privacy, compliance, and data-retention risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manual trigger phrases are broad, common-language commands that can easily appear in normal conversation without the user intending durable storage. Because the skill immediately evaluates and persists content on these phrases, it creates a real risk of unintended retention of sensitive or private information on disk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The auto-recall condition is described in broad semantic categories like previous work, decisions, dates, people, preferences, and tasks, without precise boundaries. That ambiguity can cause the system to retrieve memory unexpectedly, potentially surfacing stale, irrelevant, or sensitive stored content in contexts where the user did not intend persistent-memory access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The skill is explicitly designed for cross-session persistence, which is risky in context because it instructs the agent to store conversation-derived information durably. Persistence itself is not inherently malicious, but it becomes security-relevant when combined with broad triggers and insufficient safeguards on what may be stored.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
slug: memory-management
version: 1.0.0
homepage: https://clawhub.com/skills/memory-management
description: "A practical memory management system for OpenClaw: importance scoring, time-decay cleanup, write triggers, hybrid retrieval, and daily maintenance workflow."
changelog: "Converted from workspace/memory/MANAGEMENT.md (importance scoring + decay + recall + daily maintenance)."
metadata: {"clawdbot":{"emoji":"🧠","requires":{"bins":[]},"os":["linux","darwin","win32"]}}
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The AGENTS.md snippet repeats vague persistence triggers without strong boundaries, encouraging downstream agents to store information whenever they see common phrases. Because AGENTS.md influences agent behavior broadly, this increases the likelihood of accidental long-term retention of sensitive or maliciously injected content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill describes maintenance that can delete logs and update memory files, but it does not prominently warn users about destructive or modifying behavior. Without explicit disclosure, users may enable automation that silently removes records or overwrites memory content, harming integrity and auditability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Broad trigger phrases like 'remember this', 'save this', and 'don't forget' can occur in ordinary conversation and may cause the agent to persist data without a deliberate, informed storage decision. In a memory skill, that raises privacy and prompt-injection risks because attacker-supplied or sensitive content can be written into durable storage too easily.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented workflow goes beyond memory maintenance into configuration management and secret-adjacent backup behavior. This mismatch violates least privilege and can cause operators to grant the skill more trust than warranted, enabling unintended access to sensitive files under the guise of routine memory maintenance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill’s stated purpose is memory management, but it additionally instructs backing up openclaw.json and creating an .api-keys-backup.env file. That expands access from memory files into broader configuration and secrets handling, increasing the chance that sensitive credentials are copied, retained, or exposed without a clear need tied to the skill’s function.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The scheduled maintenance message automates creation, migration, and deletion of memory artifacts, reinforcing unattended persistence across sessions. In combination with weak boundaries, automation can amplify retention of sensitive content and perform destructive actions without timely human review.

Content

Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.

md
"schedule": { "kind": "cron", "expr": "30 8 * * *", "tz": "Asia/Shanghai" },
  "payload": {
    "kind": "agentTurn",
    "message": "Run the daily memory maintenance workflow (7 steps): 1) Create memory/YYYY-MM-DD.md (if missing) 2) Review yesterday's memory and extract content worth long-termizing into MEMORY.md or topic files 3) Delete logs older than 30 days (migrate important content before deleting) 4) Optionally back up openclaw.json (keep last 3) 5) Generate a concise structured report with findings and recommendations.\\nRequirement: output must be structured and concise, focusing on maintenance results.",
    "model": "YOUR_DEFAULT_MODEL",
    "timeoutSeconds": 600
  }

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

This repeated cron payload again encodes unattended cross-session persistence and cleanup behavior. Repetition across the file increases the chance that an operator copies the risky automation without noticing the retention and deletion implications.

Content

Scanner excerpt · SKILL.md (reported line 728)May include surrounding context.

md
"schedule": { "kind": "cron", "expr": "30 8 * * *", "tz": "Asia/Shanghai" },
  "payload": {
    "kind": "agentTurn",
    "message": "Run the daily memory maintenance workflow (7 steps): 1) Create memory/YYYY-MM-DD.md (if missing) 2) Review yesterday's memory and extract content worth long-termizing into MEMORY.md or topic files 3) Delete logs older than 30 days (migrate important content before deleting) 4) Optionally back up openclaw.json (keep last 3) 5) Generate a concise structured report with findings and recommendations.\\nRequirement: output must be structured and concise, focusing on maintenance results.",
    "model": "YOUR_DEFAULT_MODEL",
    "timeoutSeconds": 600
  }

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

This additional repeated scheduled workflow compounds the same persistence risk by normalizing automated retention and deletion. The main danger comes from repeated propagation of unsafe defaults rather than a distinct new exploit path.

Content

Scanner excerpt · SKILL.md (reported line 1045)May include surrounding context.

md
"schedule": { "kind": "cron", "expr": "30 8 * * *", "tz": "Asia/Shanghai" },
  "payload": {
    "kind": "agentTurn",
    "message": "Run the daily memory maintenance workflow (7 steps): 1) Create memory/YYYY-MM-DD.md (if missing) 2) Review yesterday's memory and extract content worth long-termizing into MEMORY.md or topic files 3) Delete logs older than 30 days (migrate important content before deleting) 4) Optionally back up openclaw.json (keep last 3) 5) Generate a concise structured report with findings and recommendations.\\nRequirement: output must be structured and concise, focusing on maintenance results.",
    "model": "YOUR_DEFAULT_MODEL",
    "timeoutSeconds": 600
  }

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The cron template specifies "tz": "Asia/Shanghai", which imposes a locale-specific default in a general-purpose skill. Although the text says to adjust for your timezone elsewhere, the concrete example still bakes in a specific locale rather than using a neutral placeholder or explicit user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The text claims the cron job should perform 'only maintenance tasks' while including unrelated config and API-key backup actions. This inconsistency can mislead users and reviewers about what the scheduled automation actually does, making risky file operations more likely to be approved unnoticed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.