memory-archivist

Fail

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: HIGHPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [PERSISTENCE]: The skill provides explicit instructions to modify the host system's crontab (30 16 * * * ...) to execute a local bash script (scan-carry-forward.sh) nightly. This ensures the archiving logic persists across container restarts and maintains access to the host environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes daily memory files (~/.openclaw/workspace/memory/*.md) that may contain untrusted data, using the extracted content to influence future agent decisions and synthesis outputs.
  • Ingestion points: The skill reads all daily journal files in the workspace memory directory.
  • Boundary markers: None identified; the skill relies on searching for specific section headers without using delimiters to isolate data from instructions.
  • Capability inventory: Includes shell command execution (ls, bash), file system writes (memory/weekly-YYYY-WXX.md), and network operations (curl).
  • Sanitization: None identified; extracted text is interpolated directly into synthesis templates and audit logs.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to list and sort memory files (ls) and to run local scripts via the crontab scheduling mechanism.
  • [DATA_EXFILTRATION]: The skill performs network POST requests using curl to an internal service (http://arifosmcp_server:8080/mcp) to transmit session context and trigger the 'seal_vault' method.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 11, 2026, 05:28 PM