ClawHub
Back to skill

Security audit

OpenClaw Agent 自进化记忆系统

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is broadly aligned with its stated purpose, but it grants ongoing access to notes, sessions, external model endpoints, and automatic repair commands with insufficient safeguards.

Install only if you are comfortable giving this skill ongoing access to your OpenClaw sessions and Obsidian vault. Use a test copy of the vault first, keep embedding and LLM endpoints local unless you explicitly accept remote processing, disable automatic self-healing or any antibody auto_fix commands, review generated memories/rules before indexing them, and pin dependencies/container images before routine use.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/extract_memories.py:183
Finding

Automatic Transmission of Session and Vault Content to Configurable External Services

Content
View full analysis
str: import requests prompt = f"从以下对话中提取有价值的记忆（用户偏好、决策、重要发现）。\n输出格式：preference|knowledge|event一句话总结详细内容\n\n内容：\n{content[:1000]}" try: resp = requests.post(f"{LLM_BASE_URL}/chat/completions", headers={"Authorization":f"Bearer {LLM_API_KEY}"}, json={"model":LLM_MODEL,"messages":[{"role":"user","content":prompt}],"temperature":0.1,"max_tokens":500},timeout=30) return resp.json()["choices"][0]["message"]["content"] if resp.status_code==200 else "" except Exception as e: print(f" LLM extract failed: {e}") return "" ``` The embedding client similarly transmits raw text: ```python def _lm_studio_embed(text: str) -> ...[truncated 3066 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
scripts/extract_memories.py:199
Finding

Untrusted Model Output Is Persisted as Long-Term Memory and Behavioral Rules

Content
View full analysis
str: import requests prompt = f"从以下对话中提取有价值的记忆（用户偏好、决策、重要发现）。\n输出格式：preference|knowledge|event一句话总结详细内容\n\n内容：\n{content[:1000]}" try: resp = requests.post(f"{LLM_BASE_URL}/chat/completions", headers={"Authorization":f"Bearer {LLM_API_KEY}"}, json={"model":LLM_MODEL,"messages":[{"role":"user","content":prompt}],"temperature":0.1,"max_tokens":500},timeout=30) return resp.json()["choices"][0]["message"]["content"] if resp.status_code==200 else "" except Exception as e: print(f" LLM extract failed: {e}") return "" ``` ```python def save_to_vault(text, memory_type="knowledge"): today = datetime.now().strftime("%Y-%m-%d") ts = datetime.now().strftime("%H%M%S") type_match = re.search(r"(\w+)", text) if type_match: memory_type = type_match.group(1) text = re.sub(r"","",text) text = re.sub(r"\w*","",text) text = re.sub(r".*?","",text) text = re.sub(r"","",text) text = text.strip() dir_map = {"preference":VAULT_DIR/"04-教训","knowledge":VAULT_DIR/"02-知识","event":VAULT_DIR/"01-日记"} target_dir = dir_map.get(memory_type, VAULT_DIR/"02-知识") target_dir.mkdir(parents=True, exist_ok=True) if _is_duplicate(target_dir, today, memory_type, text): print(f" [dedup] Skipping similar content: {text[:50] ...[truncated 3840 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/health_check_v2.py:175
Finding

Unrestricted PowerShell Execution from Writable Antibody Definitions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Dependencies and Unverified Runtime Model Download

Content
View full analysis
=2.28.0 numpy>=1.24.0 # Optional: for Mem0 integration (PRISM search, auto-inject) # mem0ai>=0.1.0 ``` Setup can install whichever matching versions are newest at installation time: ```python def install_deps(): req_file = SKILL_DIR / "requirements.txt" if req_file.exists(): print(" Installing dependencies...") r = subprocess.run([sys.executable, "-m", "pip", "install", "-r", str(req_file)], capture_output=True, text=True) if r.returncode == 0: print(" ✅ Dependencies installed") else: print(f" ⚠️ pip install failed: {r.stderr[:200]}") return False return True ``` The embedding fallback downloads and loads a model without integrity verification: ```python def _local_onnx_embed(text: str) -> np.ndarray | None: """Level 2: 本地 ONNX 模型（自动下载，一次性的）""" try: import onnxruntime as ort if not ONNX_MODEL_PATH.exists(): # 首次运行，下载模型 print(f"[embedder] 下载本地 ONNX 模型到 {ONNX_MODEL_PATH}...") import urllib.request ONNX_MODEL_PATH.parent.mkdir(parents=True, exist_ok=True) urllib.request.urlretrieve(ONNX_MODEL_URL, ONNX_MODEL_PATH) print("[embedder] 下载完成") session = ort.InferenceSession(str(ONNX_MODEL_PATH)) ``` ### Technical Analysis Minimum-only dependency constraints do not provide reproducible builds. A future package release satisfying the constraint is accepted automatically, even if it contains a regression or supply-chain compromise. The ONNX fallback downloads an external binary artifact at runtime and loads it through `onnxruntime.InferenceSession`. The code does ...[truncated 1765 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (158)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The configuration examples instruct users to provide external LLM and embedding endpoints, including a public API URL, but do not clearly state that note contents, session observations, or extracted memories may be sent to those services. Because the skill’s purpose is to ingest and process user knowledge and conversations, this omission can lead to unintentional disclosure of sensitive data to third parties.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md
---
name: agent-openclaw-memory
description: "OpenClaw Agent 自进化记忆系统。零 token 成本运行、Obsidian vault 实时同步、向量检索、自愈健康监控、自动归档/分类/清理，不需要人工干预。Self-evolving memory system for OpenClaw agents."
---

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: agent-openclaw-memory
description: "OpenClaw Agent 自进化记忆系统。零 token 成本运行、Obsidian vault 实时同步、向量检索、自愈健康监控、自动归档/分类/清理，不需要人工干预。Self-evolving memory system for OpenClaw agents."
---

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
88% confidence
Finding

The code copies userPrompt-derived content directly into the compressed title when no stronger type-specific title applies. In an observation-compression pipeline, this can propagate sensitive prompt contents, secrets, or adversarial instructions into downstream storage, logs, indexes, or UI surfaces, increasing the risk of prompt leakage and secondary prompt injection if later consumed by other agents or retrieval systems.

Content

Scanner excerpt · scripts/compress.py (reported line 198)May include surrounding context.

python
elif obs_type == "subagent":
        return "子任务"
    else:
        return prompt[:60] if prompt else tool_name or "操作"


def compress(raw: dict) -> dict:

Ssd 3

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The prompt templates embed example failures and observations taken from session logs and compressed narratives into text that is later sent to a remote model. Because these examples are natural-language excerpts from operational logs, they can include secrets, personal data, internal system details, or sensitive incidents, creating a high-risk data exfiltration path.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This batching logic selects examples derived from scanned logs and packages them for LLM refinement, preserving the original text in _examples and using the first example directly in the outbound task. In this skill context, execution logs are likely to contain highly sensitive operational content, so transforming them into prompts for a third-party model substantially increases exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The combined batch prompt concatenates multiple log-derived examples and sends them in a single external chat completion request, broadening both the quantity and sensitivity of data exposed in one transaction. Batching magnifies impact because a single request may leak information spanning multiple sessions, tools, failures, and users, while also bypassing any per-item review opportunity.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/elevate_frequent.py (reported line 499)May include surrounding context.

python
cfg = _load_config()
    prompts = cfg.get("distill_prompts", {})
    if prompts:
        return prompts
    # Hard fallback (ASCII-only, avoids encoding issues in Python source)
    return {
        "knowledge": (

Ssd 3

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The parser converts user prompts and assistant outputs from session transcripts into structured observations for long-term indexing and later distillation. This semantic repurposing is dangerous because it captures broad conversational content, including potentially sensitive or misleading assistant text, and feeds it into persistent stores and downstream model workflows.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code sends up to 1000 characters of conversation content to an LLM to extract durable 'memories' such as preferences, decisions, and discoveries, without any semantic filtering for secrets, regulated data, or private user content. Because the explicit purpose is to transform conversational material into long-term memory, the context makes this more dangerous, not less, as it systematizes retention and external exposure of sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Automatic PowerShell remediation is performed without confirmation, preview, or safeguards, and the command source is the antibody definition rather than a trusted built-in action. In context, this is especially dangerous because the script is designed to run routinely as a maintenance tool, turning data-file tampering into unattended code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly promotes persistent memory, automatic synchronization of an Obsidian vault, observation capture, and periodic processing of conversations and notes, but it does not warn users that potentially sensitive personal or organizational data will be continuously collected, retained, and processed. In a memory skill, that omission is security-relevant because users may enable it without understanding the privacy and data-retention implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly advertises fully automatic background syncing, scheduled maintenance, and self-healing against a user's Obsidian vault and memory store, but does not clearly warn that it will continuously monitor, index, modify, and potentially reorganize local data. In a memory-management skill, this behavior is functionally relevant, but undisclosed ongoing file and data processing can surprise users, expand the blast radius of mistakes, and create privacy/integrity risk if sensitive vault content is ingested or altered automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installation steps instruct users to clone code, install dependencies, start persistent services with docker-compose, and run setup against a user-supplied vault path, but they do not warn that this will enable background indexing and long-lived processing of personal knowledge-base data. This is dangerous because users may point the system at sensitive notes without understanding the extent of ingestion, retention, or automated modification behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The top-level documentation describes a narrowly scoped behavior: adding links to files without wiki-links. However, the implementation also includes a separate repair mode that rewrites files to comment out broken links (L199-L231, L239-L242) and performs a health-report side effect at module import time (L265-L270). This is an active mismatch between stated intent and implemented behavior, not merely omitted detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script performs bulk modifications to markdown files with no interactive confirmation, preview requirement, backup creation, or path-scoped safeguard. In a skill/automation context, this can lead to accidental mass data modification if invoked against the wrong vault or with overly broad rules, especially because the writes are persistent and automatic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Repair mode rewrites files by commenting out links it deems broken, again without confirmation or manual review. Because link detection is filename-based and may misclassify valid links, the mode can silently remove or disable legitimate references across many notes, creating integrity loss in the vault.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/build_project_profile.py (reported line 39)May include surrounding context.

python
if offset:
            payload["offset"] = offset

        resp = requests.post(
            f"{QDRANT_URL}/collections/{KB_COLLECTION}/points/scroll",
            json=payload,
            timeout=30,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/elevate_frequent.py (reported line 157)May include surrounding context.

python
if offset:
            payload["offset"] = offset

        resp = requests.post(
            f"{QDRANT_URL}/collections/{KB_COLLECTION}/points/scroll",
            json=payload,
            timeout=30,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/qdrant_utils.py (reported line 62)May include surrounding context.

python
if offset:
            payload["offset"] = offset

        resp = requests.post(
            f"{QDRANT_URL}/collections/{KB_COLLECTION}/points/scroll",
            json=payload,
            timeout=30,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file is documented as a script for building a project profile from Qdrant data and writing it to the vault, but it also unconditionally reports task status through system_health.task_report at module import time. This adds an extra capability unrelated to the core profile-construction logic and causes externally visible behavior even when the script is merely imported.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Natural-language text in the module docstring and CLI help forces a specific language/locale for users of this script. The file does not indicate that the locale is optional, configurable, or justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code performs a potentially destructive file operation by replacing the live queue with a backup and then recreating an empty queue. Although the module docstring explains usage, there is no user-facing warning, confirmation, or inline comment here indicating that processing will consume and clear the queue contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring and many inline comments are written exclusively in Chinese, which imposes a locale/language constraint on users and maintainers without any opt-in or documented justification. The policy specifically calls for flagging language or locale restrictions when the skill does not offer a choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file-level documentation states that LLM refinement should go through a gateway client, but the implementation later sends requests directly to DeepSeek using its own API key. This kind of security-relevant documentation/behavior mismatch is dangerous because operators may rely on the documented trust boundary, logging, policy enforcement, or redaction controls that the gateway was supposed to provide, while sensitive data is actually sent through an unmediated external path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.