OpenClaw Agent 自进化记忆系统

• Outcome: Review
• Latest audit: Jun 12, 2026 · 10:26 AM UTC
• Version: 1.0.4

Overview

This memory skill is broadly purpose-aligned, but it grants automatic background access to private notes and agent history with under-scoped mutation and repair authority.

Install only if you are comfortable giving the skill recurring access to your Obsidian vault, OpenClaw session history, local memory stores, Qdrant, and configured model endpoints. Use a test vault first, keep backups, avoid broad cron/background enablement until reviewed, prefer local-only embedding/LLM endpoints, and do not enable auto-fix rules unless you trust and audit the generated antibodies.json commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"  {label}: {n} files, too few, skip")
            continue
        print(f"\n  Distilling: {label} ({n} files)")
        subprocess.run(["python", str(SCRIPTS_DIR/"vault_distill.py"), c["id"]], capture_output=True, timeout=30)
        subprocess.run(["python", str(SCRIPTS_DIR/"vault_distill_llm.py"), c["id"]], capture_output=True, timeout=90)
        distilled += 1
    return distilled

• Confidence: 78% confidence
• Finding: subprocess.run(["python", str(SCRIPTS_DIR/"vault_distill.py"), c["id"]], capture_output=True, timeout=30)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

continue
        print(f"\n  Distilling: {label} ({n} files)")
        subprocess.run(["python", str(SCRIPTS_DIR/"vault_distill.py"), c["id"]], capture_output=True, timeout=30)
        subprocess.run(["python", str(SCRIPTS_DIR/"vault_distill_llm.py"), c["id"]], capture_output=True, timeout=90)
        distilled += 1
    return distilled

• Confidence: 78% confidence
• Finding: subprocess.run(["python", str(SCRIPTS_DIR/"vault_distill_llm.py"), c["id"]], capture_output=True, timeout=90)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return False, "auto_fix needs job_id, skipped"

    try:
        result = subprocess.run(
            ["powershell", "-Command", auto_fix],
            capture_output=True, text=True, timeout=30,
            encoding="utf-8", errors="replace"

• Confidence: 99% confidence
• Finding: result = subprocess.run( ["powershell", "-Command", auto_fix], capture_output=True, text=True, timeout=30, encoding="utf-8", errors="replace" )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        evo_script = Path(WORKSPACE) / "scripts" / "evolution_engine.py"
        if evo_script.exists():
            result = subprocess.run(
                [sys.executable, str(evo_script)],
                capture_output=True, text=True, timeout=30,
                encoding="utf-8", errors="replace"

• Confidence: 87% confidence
• Finding: result = subprocess.run( [sys.executable, str(evo_script)], capture_output=True, text=True, timeout=30, encoding="utf-8", errors="replace"

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

req_file = SKILL_DIR / "requirements.txt"
    if req_file.exists():
        print("  Installing dependencies...")
        r = subprocess.run([sys.executable, "-m", "pip", "install", "-r", str(req_file)],
                          capture_output=True, text=True)
        if r.returncode == 0:
            print("  ✅ Dependencies installed")

• Confidence: 89% confidence
• Finding: r = subprocess.run([sys.executable, "-m", "pip", "install", "-r", str(req_file)], capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not DOCKER_COMPOSE.exists():
        return False
    try:
        r = subprocess.run(["docker", "compose", "-f", str(DOCKER_COMPOSE), "up", "-d"],
                          capture_output=True, text=True, timeout=60)
        if r.returncode == 0:
            print("  ✅ Qdrant started via docker-compose")

• Confidence: 83% confidence
• Finding: r = subprocess.run(["docker", "compose", "-f", str(DOCKER_COMPOSE), "up", "-d"], capture_output=True, text=True, timeout=60)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script pulls recent session summaries from a separate local SQLite memory database and persists them into vault snapshot files, expanding the data flow beyond simple vault-state preservation. This creates an unintended data aggregation and duplication channel that can expose conversation content more broadly and retain it longer than users may expect.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The module description says the script performs health inspection and auto-repair, but it also runs an evolution engine not disclosed in the docstring. This mismatch can mislead operators about the script's execution scope and hide an additional code-execution behavior that increases risk.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module documentation presents the script as local queue registration, but the code also includes a processing path that forwards queued data into a downstream indexing pipeline. That mismatch is security-relevant because operators may believe they are only writing local telemetry when the component can also trigger further handling of sensitive prompts and tool I/O.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: A script described as an observation registrar also contains a queue-processing/indexing capability, broadening its privilege and data-handling role beyond what a reader would expect. Hidden or weakly justified secondary behavior increases the chance of unintended data movement and misuse in agent environments where prompt/tool contents may be sensitive.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script’s stated purpose is syncing skills.json into data/skills.memory.md, but it also accesses and mutates a separate per-user file under USERPROFILE/self-improving/memory.md. That creates an undocumented side effect on user-scoped memory, enabling unintended deletion or alteration of user content if this script runs automatically after classify/promote or on heartbeat.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The advertised dry-run behavior is unsafe because run(dry_run=True) still unconditionally calls auto_archive() and auto_index() before the dry-run logging branch. That means a user expecting a non-destructive preview can still trigger file moves and MOC modifications, creating integrity loss and surprising destructive side effects in a maintenance script that operates over an entire vault.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes automatic syncing of an Obsidian vault, capture of agent observations, and recurring scheduled processing, but it does not clearly warn users that private notes, session content, and possibly sensitive operational data may be persisted and processed continuously. In this context, omission of a privacy notice increases the risk of unintentional collection, retention, and onward transmission of sensitive data, especially because the skill also references external model endpoints elsewhere in the configuration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The configuration examples instruct users to place API keys and external service endpoints into config without any warning about credential handling or the implications of sending vault/session content to third-party providers. This is dangerous because users may store live secrets insecurely and may unknowingly transmit sensitive notes or conversation-derived memory data to external services.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly advertises unattended background maintenance, syncing, cleanup, and self-healing that will continuously modify a user's memory store and knowledge base, but it does not clearly warn about the scope of those changes or require explicit consent. In a memory-management skill, this is dangerous because users may connect sensitive vaults or rely on stored notes for integrity, while automated compression, cleanup, or repair routines could alter, delete, or propagate data without the user understanding the consequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installation steps instruct users to start services and run setup against an arbitrary vault path, but they do not warn that the selected vault may contain highly sensitive notes that will be indexed, processed, embedded, and synchronized into additional storage systems such as Qdrant. This creates risk of unintended data exposure, persistence, and broader access surface, especially when paired with background automation and optional external embedding or LLM-compatible services.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script modifies markdown files across the configured vault during normal execution without requiring confirmation, backup, or a safe default. In an automation or agent context, this can cause unintended bulk content modification and integrity loss if run against the wrong vault or with overly broad matching rules.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The broken-link repair path rewrites files by commenting out matched wiki-links without clear safety warnings, backups, or confirmation. In this skill context, the operation affects user knowledge-base content at scale, so false positives in broken-link detection can silently corrupt notes and remove functional links.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script sends prompts built from session-log-derived examples to an external LLM API using a bearer token, without consent, redaction, or clear disclosure. Session logs can contain secrets, personal data, internal commands, stack traces, and operational context, so this creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Reading conversation and execution history from the user's home workspace is sensitive because it collects potentially private material for later processing and export. In this script's context, that local collection becomes more dangerous because the extracted content is subsequently used in external LLM requests.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Recent session text is read from the local memory database and written into vault snapshots without any user-facing consent or warning. Even though the source is local, this silently duplicates conversation data into another persistent location, increasing privacy risk and the chance of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script reads recent lesson and preference markdown files and embeds excerpts into snapshot files, duplicating potentially sensitive user preference data without explicit warning. This broadens access to that information and may preserve personal data in multiple places, complicating deletion and confidentiality expectations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script batches vault file contents and sends up to 3000 characters from each candidate file to an LLM gateway without explicit runtime consent, redaction, or content classification. Even though the gateway is configured for localhost, this still creates a data-exposure path because the gateway may proxy to external models or persist prompts/logs, and the files may contain sensitive notes, credentials, or private project data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The --force path reads the target vault file and sends its content to the LLM distillation function with no warning or confirmation at execution time. Because force mode is user-directed and bypasses normal candidate filtering, it can more easily transmit especially sensitive files the user may not realize are being uploaded to the gateway.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function sends user-supplied text to a remote embedding endpoint, which can expose sensitive prompts, documents, or secrets to another service. In an agent skill context, embedding inputs often contain retrieved notes, user content, or internal context, so silent network transmission increases privacy and data-handling risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.