other
- Location
references/openclaw-automation-recipes.md:34- Finding
Recurring Collection and Persistence of Sensitive Conversation and Agent-Memory Data
- Content
View full analysis
Vulnerability Details
File Location:
references/openclaw-automation-recipes.md, lines 34–42 and 65–71
Vulnerability Type: Sensitive Agent State and Conversation Collection
Risk Level: MediumEvidence
The following is an English translation of the complete relevant documentation segment at lines 34–42:
markdown Recommended checklist: 1. Review today's recent conversations and context 2. Check whether today's TODO contains overdue items 3. Check whether `00-Inbox` needs to be cleared 4. Check whether `99-Resource-Library/Reading-Queue.md` requires a reminder 5. Check whether failed cron tasks should be retried 6. Determine whether the user should be proactively reminded 7. Periodically organize `MEMORY.md`The log-generation instructions at lines 65–71 additionally specify:
markdown ### Log generation Input source priority: 1. Actual chat records from the main session 2. `memory/YYYY-MM-DD.md` 3. The current day's TODO and project notesTechnical Analysis
The automation recipe recommends that recurring heartbeat and log-generation tasks inspect actual main-session chat records, recent conversation context, daily memory files, project notes, and long-term
MEMORY.mdcontent.These sources can contain personal information, confidential project details, credentials pasted into conversations, access tokens, financial information, or material unrelated to the PKM task. The recipe does not establish:
- Explicit user consent before conversation or memory access
- A restriction to named sessions or task-relevant records
- Secret detection and redaction
- A preview or approval step before information is persisted
- Retention and deletion limits
- Restrictions against storing generated logs in synchronized or shared repositories
This is not confirmed Agent Memory Poisoning because the documentation does not inject attacker-controlled instructions into memory or override future safety rules. It is instead an unclassified ...[truncated 1734 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed opt-in before any heartbeat or scheduled task reads conversations or Agent-memory files.
- Restrict collection to specifically named sessions, approved date ranges, and fields necessary for the current PKM task.
- Default to structured TODO and project metadata instead of raw conversation transcripts.
- Add mandatory filtering for passwords, API tokens, private keys, authentication cookies, financial data, health data, and other sensitive identifiers.
- Generate a proposed summary and require user confirmation before writing it to
MEMORY.mdor another durable location. - Define retention limits and provide a documented process for deletion from active files, repository history, synchronization targets, and backups.
- Keep generated logs and memory files outside shared repositories by default, and apply restrictive filesystem permissions.
- Record the source, collection time, and approval status of persisted summaries to support later review.
- Document that cron and heartbeat automation must run with the minimum file-access permissions necessary.
- Disable conversation-derived logging by default and make structured, local-only reporting the safer default.