Security audit

Memorist Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent memoir-interview purpose, but it handles sensitive family stories and contact data while enabling persistent auto-reply agents, messaging, config changes, and unpinned local installs with privacy under-disclosure.

Review this before installing if you plan to use auto-reply or voice features. Prefer relay mode for sensitive stories, avoid enabling web_search, confirm every narrator and recipient understands where messages go, check OpenClaw bindings after spawn/despawn, and install speech tools only from trusted, pinned sources.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Runtime Installation of Speech-Transcription Dependencies
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: research/tts-solutions.md:116
Finding: Executable Archive Downloaded Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/media-and-voice.md:105
Finding: Potential Shell Command Injection Through Unquoted Media Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence

Findings (58)

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This share flow transmits personal narrative content over WhatsApp and records recipient details in share history, combining disclosure of sensitive memoir text with retention of sharing metadata. In the context of a family-memory tool handling intimate life stories, this materially raises confidentiality and privacy risks for both narrator and recipients.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/spawn-despawn.md (reported line 60)May include surrounding context.
md
Your only job is to conduct warm, adaptive life story interviews with {narrator name} via WhatsApp, and store every story fragment locally. ## CRITICAL: Output rules {narrator name} is a real person, not a developer. They see EVERYTHING you reply as a WhatsApp message. - NEVER expose your internal thinking, reasoning, tool calls, file operations, or working process - NEVER mention file paths, JSON, fragments, entities, sessions, or any technical/system details

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
platforms: ["darwin", "linux"] allowed-tools: - file_read - file_write - whatsapp_send_message - fetch - web_search

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Granting web_search to a memoir-interview skill that presents itself as local-first and privacy-protected expands the attack surface without a clear functional need. In a skill handling sensitive family stories and personal data, unnecessary network-capable tools create avoidable risk of data exposure, prompt injection via retrieved content, or future misuse.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
| Feature | What to configure | |---------|-------------------| | WhatsApp auto-reply | WhatsApp linked (`openclaw status`), narrator's number in `channels.whatsapp.allowFrom` or `dmPolicy: "open"`, `mkdir -p ~/.openclaw/media` | | Telegram auto-reply | Telegram bot configured, narrator's numeric user ID in `channels.telegram.allowFrom` | | WeCom auto-reply | `@sunnoy/wecom` plugin loaded, `channels.wecom.enabled: true` | | iMessage auto-reply | macOS only. `channels.imessage.enabled: true`, narrator's phone/email in `channels.imessage.allowFrom`, Full Disk Access granted to terminal. Requires `imsg` CLI (`brew install pj4533/homebrew-imsg/imsg`) |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
**Steps:** 1. **First-run bootstrap**: Create the data directory if it doesn't exist: - `mkdir -p ~/.openclaw/memorist_agent/narrators` - If `narrators.json` doesn't exist, create it as `[]`. - If this is the first run, ask: **"What's your name? (This is how narrators will know who set this up.)"** Save to `~/.openclaw/memorist_agent/owner.json` as `{ "name": "{name}" }`. Skip if `owner.json` already exists.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The export section tells the user the file stays on the local machine, but the later share workflow allows transmitting memoir content externally. This inconsistency can cause users to make privacy decisions based on a false understanding of where sensitive memoir data may go.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill claims to be local-first and privacy-protected, yet its share flow includes sending memoir content to external WhatsApp recipients. That creates a real data exfiltration path for highly personal family-history content and may mislead users into believing the data never leaves the device.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Displaying the full memoir text directly in the conversation can expose sensitive personal stories, names, and compiled private details in plain text within the chat interface. Even if intended for convenience, it increases the risk of overexposure through chat logs, screenshots, shared devices, or retention by the hosting platform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow sends sensitive memoir content via WhatsApp without an explicit warning that personal data will be transmitted to an external service and potentially stored or processed outside the local environment. For family memoirs, this can expose intimate biographical details, names, places, and relationships without informed consent from the user or narrator.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction for lang: "both" mandates that questions remain in Chinese as the primary language, with English only as subtitles. This is a natural-language locale policy constraint that does not offer the user a choice or indicate that the behavior is optional or region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow instructs the agent to send memoir-interview questions over WhatsApp using a narrator's phone number and to process replies, but this file provides no explicit consent check, privacy notice, or warning about sending sensitive life-story content through a third-party messaging platform. Because the skill handles personal and family-history data, using an external channel without clear user-facing safeguards increases the risk of unauthorized disclosure, surprise outreach, or noncompliant handling of personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file states that for Chinese narrators, the voice should be set to a specific zh-CN voice. This is a natural-language locale policy constraint presented as mandatory behavior, and it does not mention offering the user a language or voice choice or obtaining opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guidance tells the agent to probe for local binaries with which and execute transcription commands against local media paths. Even if intended for legitimate transcription, this authorizes shell command execution and local file handling that broaden the skill's capabilities and attack surface beyond simple memoir interviewing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs the agent/user to install local STT software via pip or brew and to modify local Openclaw configuration. That expands a memoir-interview skill into host-level software installation and configuration changes, which increases supply-chain and system-integrity risk well beyond ordinary content processing.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/spawn-despawn.md (reported line 5)May include surrounding context.
md
## /memorist_agent spawn **Purpose:** Create a dedicated, isolated Openclaw agent for one narrator. After spawning, all messages from the narrator's WhatsApp, iMessage, or Telegram are routed **directly** to their personal agent via a peer-level binding — the main session is never touched. No cron jobs, no polling, no forwarding. **Usage:** - `/memorist_agent spawn --narrator "Grandma"` — spawn a dedicated agent for {narrator}

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes adaptive interviews via WhatsApp, WeChat, or direct conversation, but this file claims spawned narrator agents can be bound to WhatsApp, iMessage, or Telegram. Adding iMessage and Telegram routing is a semantic expansion of the skill's external communication behavior beyond the declared description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The spawned narrator agent is instructed that it may invoke operational shell-style commands such as ffmpeg conversion and gateway restart, which are outside the core memoir-interview function. Giving a user-facing conversational agent authority to perform service-management or media-processing actions increases the risk of command misuse, prompt-induced operations, and accidental disruption of the messaging gateway.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The despawn flow explicitly causes a narrator's future messages to fall through to the default agent, but it does not require prominent warning, consent, or a safe fallback such as reject/quarantine behavior. This creates a real privacy risk because sensitive memoir conversations may be routed into a broader-context agent that was never intended to receive that narrator's personal data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This workflow is designed to elicit deeply personal, emotional, and potentially sensitive life-history information, yet it provides no explicit privacy notice, retention guidance, consent language for storage/sharing, or handling rules for highly sensitive disclosures. In a memoir-interview context, that omission increases the risk of oversharing, unsafe data capture, and user misunderstanding about how intimate family stories, health details, or traumatic experiences will be used.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Multiple recommendation and workflow lines specify Chinese dialogue, Chinese typography, and CJK font rendering as the default output behavior. That constitutes a language/locale constraint presented as mandatory rather than optional, with no indication that users can choose another language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document recommends an end-to-end workflow that sends highly sensitive memoir interview content and derived family images to third-party image/LLM providers and then to WhatsApp, but it does not require explicit consent, data-minimization, retention review, or a user-facing disclosure. In the context of elderly family narratives and privacy-sensitive biographical material, this creates a real privacy and compliance risk because users may assume the system is local-first while their personal stories are being transmitted externally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow authorizes automated follow-up messaging and explicit notification of a third party ('Jimmy') about a narrator's responsiveness, which exceeds the memoir-interview interaction implied by the skill description. In a family-history context, silence patterns and engagement status are sensitive behavioral data, and sharing them onward without clearly documented consent creates a privacy and scope-expansion risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow relies on automated re-engagement and reuse of specific prior-session details, but the visible skill description does not clearly warn users that their stories and interaction history will be used to generate future outreach. In this context, resurfacing personal memories proactively can feel intrusive and may expose private details through notifications or shared devices.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document proposes repeatedly sending highly sensitive memoir interview content, family relationships, and life-history context to third-party LLM APIs while emphasizing cost and caching efficiency, but it does not require explicit consent, data-minimization safeguards, or clear user-facing disclosure of external processing. In this skill context, the data is especially sensitive because it concerns private family narratives and potentially identifiable biographical details, so silent transmission to external providers materially increases privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/spawn-despawn.md:52