Security audit

Layered Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is mostly purpose-related, but it needs review because it can change agent startup behavior, save conversation content persistently, and run unbundled home-directory scripts through unsafe shell commands.

Install only if you want an agent memory system that can influence session startup and persist conversation-derived notes locally. Review the hook before enabling it, avoid unattended auto-save for sensitive chats, do not install the cron/OpenClaw scheduled jobs unless you accept recurring session checks, and verify or bundle the ~/clawd/scripts helper files before running the CLI.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:53
Finding: <![CDATA[Shell Command Injection Through User-Controlled CLI and API Arguments]]>
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: index.js:18
Finding: <![CDATA[Execution of Unbundled and Mutable Code From the User Home Directory]]>
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: hooks/openclaw/handler.js:8
Finding: <![CDATA[Persistent Agent Behavior Modification Through Bootstrap Instruction Injection]]>
Content: View full analysis
1 hour + 5+ messages → Save **When to save manually:** - User says "保存记忆" or "save memory" - Before ending long conversations - After completing important tasks - When context feels full **Quick commands:** \`\`\`bash # Save current conversation node ~/clawd/skills/layered-memory/index.js extract --save # Update MEMORY.md with today's work # (Edit MEMORY.md, then regenerate layers) node ~/clawd/scripts/generate-layers-simple.js ~/clawd/MEMORY.md # Search existing memory (use L1 to save tokens) node ~/clawd/skills/layered-memory/index.js search "keyword" l1 \`\`\` **Memory locations:** - Main: ~/clawd/MEMORY.md - Daily: ~/clawd/memory/daily/YYYY-MM-DD.md - Layers: .*.abstract.md (L0), .*.overview.md (L1) **Token optimization:** - Use L1 for searches (saves 88% tokens) - Use L0 for quick filtering (saves 99% tokens) - Only read L2 when you need full details `.trim(); ``` ```javascript const handler = async (event) => { // Safety checks if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'MEMORY_MANAGEMENT_REMINDER.md', content: MEMORY_REMINDER, virtual: true, }); } } ...[truncated 1968 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: INTEGRATION.md:158
Finding: <![CDATA[Recurring Scheduled Execution and Automatic Conversation Persistence]]>
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (37)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · AUTO-TRIGGER.md (reported line 249)May include surrounding context.
解决：

bash
rm ~/.clawd/.memory-trigger-state.json # 重新开始计数

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a token-optimization memory layer, but analysis says it instead reads configuration and environment data without disclosing that capability. Undeclared environment/config access can expose sensitive values or expand the trust boundary beyond what a user expects from a memory utility.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a token-optimization memory layer, but analysis says it instead reads configuration and environment data without disclosing that capability. Undeclared environment/config access can expose sensitive values or expand the trust boundary beyond what a user expects from a memory utility.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a token-optimization memory layer, but analysis says it instead reads configuration and environment data without disclosing that capability. Undeclared environment/config access can expose sensitive values or expand the trust boundary beyond what a user expects from a memory utility.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a token-optimization memory layer, but analysis says it instead reads configuration and environment data without disclosing that capability. Undeclared environment/config access can expose sensitive values or expand the trust boundary beyond what a user expects from a memory utility.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code builds shell command strings with user-controlled values and executes them via execSync in generate, read, and search. Because inputs such as target, filePath, query, layer, concurrent, and configPath are interpolated into shell commands with incomplete escaping, an attacker can inject shell metacharacters and achieve arbitrary command execution under the user's account.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide documents behavior that goes beyond passive layered-memory management into autonomous session monitoring, token-usage checks, and automatic save orchestration. Expanding a memory skill into continuous observation and automated actions increases the skill's authority and data exposure surface, especially if users expect only file-layering functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation promotes automatic saving of conversation-derived memory and maintenance of state/history files without clearly warning about privacy, retention, or persistence implications. Users may unknowingly store sensitive session content, metadata, and identifiers on disk through background automation, creating confidentiality and compliance risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Inspecting active sessions and injecting bootstrap reminders is not clearly necessary for a layered-memory utility and implies access to live conversational context. That creates privacy and boundary risks because the skill can observe or influence sessions outside the narrow function users would reasonably infer from its name and description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document states that conversation history will be recorded and automatically saved with '无需任何操作，完全自动' but does not warn that potentially sensitive prompts, secrets, or personal data may be written to disk. This creates a real privacy risk because users may reasonably assume chat content is ephemeral, while the skill persistently stores it in the background.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented state file includes full conversation history, timestamps, and token metadata in ~/.clawd/.memory-trigger-state.json, yet the file description omits retention, access-control, and sensitivity warnings. Storing complete histories on disk materially increases exposure of credentials, private conversations, or proprietary data if the host is shared, backed up, or later compromised.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · INTEGRATION.md (reported line 178)May include surrounding context.
bash
# 每天凌晨 1 点自动维护 crontab -e # 添加: 0 1 * * * cd ~/clawd/skills/layered-memory && node index.js maintain

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document recommends a background cron job that periodically inspects session state and may automatically save memory, but it does not clearly warn that this creates persistent storage, may capture sensitive conversation content, and introduces ongoing automated access to session data. In a memory-management skill, this is contextually relevant and likely well-intentioned, but the lack of explicit safety guidance makes accidental data retention or privacy-impacting deployment more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to run generate and maintain commands that create or overwrite layered files, but it does not prominently warn that these operations modify the filesystem. In an agent-skill context, unclear write semantics can cause unintended file creation or replacement in memory directories, especially when run recursively or with --all/--force flags.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description and introductory content present the skill in Chinese only, which can impose a language-specific experience on users without opt-in. The policy specifically calls for flagging language or locale constraints unless the skill offers a language choice or clearly documents a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire upgrade plan is written in Chinese, including headings, implementation notes, and recommendations, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JavaScript file contains user-facing natural-language content in Chinese in the header/commentary and later console output, indicating an assumed language choice rather than a user-selected one. The policy for this category applies to all file types and flags forcing a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The benchmark results are presented with Chinese-only explanatory messages, which imposes a specific language on users. There is no visible mechanism to select language or any justification that this tool is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file's natural-language interface text and command descriptions are presented only in Chinese, and the CLI help and status messages throughout the file likewise assume a fixed language. This can violate language/locale policy when no user opt-in or documented locale constraint is provided.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description focuses on managing layered memory files: generating layers, on-demand loading, and deduplication to reduce token usage. In addition to that, this file implements conversation-to-memory extraction and persistence, which is a broader capability for creating new memories from chat content rather than just managing existing layered memory files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The tool can persist conversation-derived memories to disk through the --save path without any confirmation prompt, preview, or sensitivity check. If conversations contain secrets, personal data, or tokens, this creates an unintended data-retention and privacy risk, especially because the save is followed by automatic layer generation that further propagates the content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Archiving old memories and producing monthly summaries are lifecycle/analytics features beyond the manifest's stated scope of three-layer memory management, token reduction, and deduplication. These behaviors materially extend the skill into retention management and summarization workflows not described in the manifest.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest says the skill will 'Auto-save conversation memory when reaching thresholds' and binds it to the 'agent:bootstrap' event, but it does not define what thresholds are or when autosave will or will not occur. That ambiguity can cause unintended invocation or unexpected behavior because users and integrators cannot tell the precise activation scope from the manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The test suite reaches outside the skill directory and inspects a script under the user's home directory (~/clawd/scripts/generate-layers-simple.js). That creates an unnecessary trust boundary violation: running the skill's tests depends on and reveals information about external local files unrelated to the packaged skill, and can fail or behave differently based on the user's environment. In the context of a layered-memory skill, this capability is not required for core functionality validation, so it increases risk rather than being justified by the skill's purpose.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:60