T02 · Agent Memory Poisoning
Error
- Location
optimizer.py:89- Finding
Persistent Agent Memory Poisoning Through Untrusted Summary Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Sophie Optimizer
Security checks for vulnerabilities and agentic risk
Overview
This skill is clearly intended to manage OpenClaw context, but it can delete main session files, restart the gateway, and write persistent memory without enough safeguards or scoping.
Review carefully before installing. This skill should only be used by an operator who intentionally wants automated OpenClaw session resets and memory rewriting, and it should be changed to require explicit confirmation, enforce the documented token threshold, restrict deletion scope, sanitize summaries before writing MEMORY.md, and avoid unattended cron use until those controls exist.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
optimizer.py:171- Finding
Unprotected Destructive Session Reset Without Enforced Token Threshold
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
optimizer.py:19- Finding
Sensitive Context Archives Created With Implicit Filesystem Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented purpose frames the skill as benign context optimization, but the described behavior includes destructive reset actions and a gateway service restart that are not clearly disclosed as primary risks. This mismatch can mislead operators into authorizing the skill under false assumptions, increasing the chance of unintended data loss or disruption.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh if [ -d "$SESSION_DIR" ]; then echo "[Sophie Optimizer] Cleaning session files in $SESSION_DIR..." # Remove .jsonl and .json files, keeping the directory structure rm -f "$SESSION_DIR"/*.jsonl rm -f "$SESSION_DIR"/*.json echo "[Sophie Optimizer] Session storage purged." else
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh echo "[Sophie Optimizer] Cleaning session files in $SESSION_DIR..." # Remove .jsonl and .json files, keeping the directory structure rm -f "$SESSION_DIR"/*.jsonl rm -f "$SESSION_DIR"/*.json echo "[Sophie Optimizer] Session storage purged." else echo "[Sophie Optimizer] Warning: Session directory not found at $SESSION_DIR"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and documents file read, file write, and shell-like capabilities but does not declare any explicit tool scope or permissions boundary. That makes the skill harder to review, easier to overprivilege in practice, and increases the risk that destructive operations such as file deletion or service restart are invoked without appropriate constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill openly describes wiping session storage and performing a hard reset but provides no warning, safeguard, or confirmation guidance. In context, this is dangerous because the skill targets the main session and long-term memory workflow, so misuse or accidental invocation can destroy active state and interfere with recovery.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill recommends manual or cron-based automated execution for a destructive reset workflow without cautioning against unattended operation. Automating session wipes and service restarts can repeatedly erase state, interrupt availability, and compound operational damage before anyone notices.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # Notify Start try: subprocess.run(["openclaw", "message", "send", "--message", f"🔄 Iniciando otimização de contexto ({args.tokens} tokens)..."], check=False) except Exception: pass
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # Notify Progress try: subprocess.run(["openclaw", "message", "send", "--message", f"✅ Contexto arquivado em {os.path.basename(filepath)}. Memória atualizada."], check=False) except Exception: pass
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Executing an external reset shell script exceeds simple archiving and memory-update behavior and creates a privileged execution boundary that is not visible in this file. Because the script's content is not constrained here, this expands the attack surface significantly and could enable destructive or persistent host changes under the guise of routine optimization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A session reset is a disruptive and potentially destructive operation, yet the code performs it immediately when --reset is supplied, without an interactive confirmation, authorization check, or external safety gate. In this skill context, automatic resets are more dangerous because they are framed as routine maintenance and may be triggered in normal workflows, increasing the chance of accidental service interruption or data loss.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print("Triggering reset script...") # Notify Reset try: subprocess.run(["openclaw", "message", "send", "--message", "⚠️ Reiniciando sistema para limpeza de sessão. Volto já! 👑"], check=False) except Exception: pass
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Starting the reset process in a new session allows it to outlive the parent process and reduces operator visibility and control over what continues running. In combination with an external shell script, this persistence makes unintended or malicious changes harder to interrupt, audit, or roll back.
- Content
python except Exception: pass # Use nohup to allow the script to survive if the parent dies, # though systemctl restart might handle it. subprocess.Popen(["/bin/bash", RESET_SCRIPT], start_new_session=True)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
This call launches an external shell script via bash in a detached session, which can execute arbitrary commands contained in reset.sh with the privileges of the current process. In a skill whose stated purpose is context maintenance, handing control to an opaque shell script materially increases risk because it can reset services, alter files, or persist beyond the invoking session without further checks.
- Content
python # Use nohup to allow the script to survive if the parent dies, # though systemctl restart might handle it. subprocess.Popen(["/bin/bash", RESET_SCRIPT], start_new_session=True) if __name__ == "__main__": main()
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The stated purpose focuses on automated context health management: monitoring tokens, snapshotting memory, and resetting sessions. In addition to those tasks, the code emits multiple status messages through the OpenClaw CLI, which is a behavioral surface not mentioned in the manifest and not strictly necessary to implement archiving or reset logic.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill sends user-visible status messages in Portuguese such as 'Iniciando otimização de contexto' and 'Reiniciando sistema', but there is no indication that the user opted into this locale. This is a natural-language policy issue because it imposes a specific language in user-facing interactions without documented choice or justification.
- Content
Static analysis
No suspicious patterns detected.