memory-archivist
Fail
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: HIGHPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PERSISTENCE]: The skill provides explicit instructions to modify the host system's crontab (
30 16 * * * ...) to execute a local bash script (scan-carry-forward.sh) nightly. This ensures the archiving logic persists across container restarts and maintains access to the host environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes daily memory files (
~/.openclaw/workspace/memory/*.md) that may contain untrusted data, using the extracted content to influence future agent decisions and synthesis outputs. - Ingestion points: The skill reads all daily journal files in the workspace memory directory.
- Boundary markers: None identified; the skill relies on searching for specific section headers without using delimiters to isolate data from instructions.
- Capability inventory: Includes shell command execution (
ls,bash), file system writes (memory/weekly-YYYY-WXX.md), and network operations (curl). - Sanitization: None identified; extracted text is interpolated directly into synthesis templates and audit logs.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to list and sort memory files (
ls) and to run local scripts via the crontab scheduling mechanism. - [DATA_EXFILTRATION]: The skill performs network POST requests using
curlto an internal service (http://arifosmcp_server:8080/mcp) to transmit session context and trigger the 'seal_vault' method.
Recommendations
- AI detected serious security threats
Audit Metadata