Security audit
Security checks for vulnerabilities and agentic risk
This memory skill is not clearly malicious, but it needs Review because it persists raw conversation text by default and loads classifier code from a mutable external workspace path.
Install only after reviewing the memory behavior. Disable auto_write unless you intentionally want conversation text saved, avoid storing secrets or sensitive personal data, inspect and clear the memory-focal data files regularly, and do not use this package where ~/.openclaw/workspace/memory-focal/scripts can be modified by untrusted code or users.
memory_manager.py:151Persistent Agent Memory Poisoning Through Untrusted User Messages
memory_manager.py:27External Python Module Precedence Allows Classifier Substitution
描述与代码存在明显能力范围不一致。代码确实与“消息分类”以及是否应读写记忆的决策有关，这与声明的一部分相符；但声明所描述的是一个更完整的记忆管理系统，包含自动标签、遗忘曲线和 token 优化等核心能力，而提供的代码块并未实现这些内容。该代码的实际作用更像是记忆系统中的一个分类/路由组件，而非完整的“焦距记忆系统”。因此应判定为描述与实际行为不完全匹配，属于夸大声明。
整体上，代码与“记忆管理系统”的大方向是吻合的：确实包含消息分类、自动写入、自动标签和记忆加载，也未发现明显越权、网络访问或与声明无关的危险能力。但描述中的若干核心卖点与实际实现不一致，尤其是“遗忘曲线”完全未实现；此外“按需加载”和“Token 优化 40-60%”的表述明显强于代码实际能力。代码主要是本地 JSON/JSONL 记忆读写与简单筛选，而不是完整的遗忘曲线记忆系统。因此应判定为存在描述与行为不匹配。
The README advertises automatic memory loading and writing of user information, preferences, and new information without any privacy notice, consent flow, retention policy, or warning about sensitive data handling. In a memory-management skill, this omission is security-relevant because users may unknowingly persist personal or confidential content, increasing the risk of over-collection, unintended disclosure, and unsafe long-term retention.
The skill documents automatic reading and writing of memory files but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, undeclared file access weakens user consent and platform enforcement, making silent persistence of conversation data more likely and harder to audit.
The auto-tagging feature states that it calls external LLM APIs, but the description does not clearly warn that memory text may be transmitted to third-party services. If sensitive user conversations are sent off-device or off-platform without prominent consent, this creates a significant privacy and compliance risk.
The skill says it auto-processes and auto-writes memories during conversation, but it does not present a prominent privacy warning about long-term retention, archival, or deletion behavior at the point of use. This can cause users to disclose sensitive information without understanding that it may be stored persistently and later processed.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
解决： 检查 CLI 路径和权限
ls -la ~/.openclaw/workspace/memory-focal/scripts/cli.py
chmod +x ~/.openclaw/workspace/memory-focal/scripts/cli.py
The manifest description is written entirely in Chinese and presents the skill in that locale without any indication that users can choose another language or that the skill is specifically intended for a Chinese-only audience. This can violate language/locale policy where skills should not force a specific language without opt-in or clear regional justification.
The module docstring defines the skill entirely in Chinese, and the user-facing labels and examples are also exclusively Chinese. This indicates a fixed language/locale assumption rather than offering a choice, which matches the policy category for language or locale constraints without opt-in.
The module docstring and user-facing descriptive text are written in Chinese, presenting the skill's behavior and usage in a single language without offering a language choice or documenting a justified locale restriction. This can violate language/locale policy when the skill is not clearly scoped to a Chinese-only environment.
The manifest and module documentation advertise '遗忘曲线' behavior, implying time-based decay or pruning of memories. In the code, memories are only appended, loaded, counted, and indexed; there is no decay, expiration, retention scheduling, or forgetting-curve computation anywhere in the implementation.
The module prepends an external workspace path to sys.path and then imports MessageClassifier from that location. This creates a code-loading trust boundary violation: any attacker or untrusted skill able to modify ~/.openclaw/workspace/memory-focal/scripts/classifier.py can influence execution of this skill, leading to arbitrary code execution in the agent context.
Automatically loading previously stored memories into active context risks re-exposing sensitive user data in unrelated future interactions. Because the system selects top memories by access count rather than relevance or sensitivity, private content may be unnecessarily surfaced and influence downstream model behavior or be disclosed in responses.
The skill reads and processes stored conversational memories from local files without any privacy boundary, provenance checks, or user-facing disclosure. This can surface previously stored sensitive data into future contexts and also trusts locally stored content that may have been altered by other components.
The skill automatically persists user messages to disk based on classifier decisions, without any visible consent, notice, minimization, or sensitivity filtering. In a memory-management skill, this is particularly risky because users are likely to provide personal preferences, rules, schedules, or other sensitive conversational data that then becomes durable local storage.
Persistently storing raw user messages creates a clear data retention and confidentiality risk, especially because messages may include credentials, personal data, operational instructions, or other secrets. The memory-skill context increases danger because retention is the feature, making over-collection and later leakage more likely if no minimization, encryption, or consent controls exist.
The README content, headings, and usage guidance are presented in Chinese throughout, with no indication that users can choose another language. This can constitute a language-policy issue when a skill effectively forces a specific language without explicit opt-in or documented locale justification.
The file presents the skill description and usage documentation exclusively in Chinese, with no indication that users can select another language or that the skill is intended only for a Chinese-speaking audience. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
The usage example and write API suggest the system writes conversational memory from both user message and response. In practice, write_memory accepts a response parameter but only stores the message text, so the actual behavior is narrower than the documented conversational-memory implication.
No suspicious patterns detected.