Security audit

Narrative Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent personal memory skill, but it saves sensitive life-event text and behavioral patterns locally with broad automatic-capture triggers and weakly documented privacy controls.

Install only if you are comfortable with a local memory tool saving life events, moods, values, reflections, and raw source text under ~/.openclaw/workspace/.soul. Before enabling proactive capture, verify how to review, redact, delete, and back up these records, and do not assume the data is encrypted or automatically minimized based on the current artifacts.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script exposes broad introspection commands that read and print stored daily context, timeline entries, and pattern statistics from the user's long-term memory store. In a memory skill, this greatly increases the chance of privacy leakage because highly personal historical data can be enumerated and replayed outside the narrow capture flow.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger description is very broad, covering milestones, key decisions, value judgments, emotional turning points, first experiences, and deep reflection, which can match a large fraction of normal user conversation. In an agent setting, this increases the chance of over-triggering, causing excessive capture and retention of sensitive personal content without sufficiently clear user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code persists sensitive user text into a local narrative store without any notice, consent flow, retention limit, or masking. Because the stored material includes reflective and emotional disclosures, compromise of the local account, backups, logs, or later introspection commands can expose highly sensitive personal data.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The script silently reads sensitive profile/value data from a local file and uses it for analysis without clear disclosure. While local reads are not inherently unsafe, undisclosed processing of personal values increases privacy risk and can surprise users in a skill designed to infer meaning from personal text.

Ssd 3

High

Confidence: 96% confidence
Finding: The accumulation layer persistently records topic mentions, emotional patterns, value tendencies, and text snippets into long-term local state. This creates a durable behavioral profile of the user, which is especially sensitive in a narrative-memory skill because the entire purpose is to extract meaning from intimate personal disclosures over time.

Ssd 3

High

Confidence: 98% confidence
Finding: Narrative creation stores the full original input as source_text and the timeline feature later exposes stored entries, enabling replay of sensitive statements. This is dangerous because secrets, health details, relationships, financial concerns, or regrets disclosed in free text may be permanently retained and trivially surfaced later.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The daily context analysis function reads and prints user summaries, mood, events, and observations directly to console. Plain-text exposure of accumulated personal context can leak into terminal history, logs, screenshots, shared sessions, or other monitoring layers.

Static analysis

No suspicious patterns detected.