Is hassffw/memory-compression-system safe?
https://github.com/openclaw/skills/tree/main/skills/hassffw/memory-compression-system
The memory-compression-system skill presents a moderate risk profile anchored by three interconnected concerns: a persistent OpenClaw cron job that injects scheduled shell commands into the LLM agent's action loop every 6 hours (a vectored prompt injection mechanism that bypasses SKILL.md content scanning), a compression pipeline that reads all agent memory files and could capture sensitive stored content, and an unaudited install.sh that is wired as an npm install lifecycle hook. Clone-time network activity was limited to expected GitHub endpoints, canary files were read but not modified (with timing consistent with Oathe monitoring system scans rather than skill-initiated access), and the SKILL.md itself contains no classic prompt injection text. However, the combination of scheduled agent hijacking, memory file harvesting, and a documented Telegram notification channel creates a plausible covert surveillance pipeline whose individual components each carry legitimate-sounding justifications that obscure the aggregate risk.
Category Scores
Findings (12)
HIGH Persistent Scheduled Agent Turn Injection via Cron -20 ▶
enable.sh registers an OpenClaw cron job with a 21,600,000ms (6-hour) interval using sessionTarget 'isolated' and delivery mode 'announce'. The payload is a kind:'agentTurn' message that instructs the LLM agent to navigate to the skill directory and execute a shell script. This is a recurring prompt injection that persists after the user's session ends, survives skill updates, and continues operating until explicitly disabled via disable.sh.
HIGH Agent Turn Payload Embeds Shell Command Execution -15 ▶
The cron job message payload contains a literal shell command string ('cd ... && ./scripts/compress.sh --auto') that the LLM agent will interpret and execute. This is command injection delivered via the scheduling subsystem rather than directly in SKILL.md, making it invisible to SKILL.md-only content scanning and bypassing prompt injection detection focused on the skill's documentation.
HIGH Compression Pipeline Harvests Agent Memory File Contents -20 ▶
compress.sh function get_memory_context() iterates every .md file under /home/node/.openclaw/workspace/memory/ and reads the first 5 lines of each into a staging temp file. This content — which could include API keys, user instructions, prior conversation summaries, or authentication tokens stored by other skills — is then compressed and written to the skill's local data directory. No access control, user consent prompt, or content filtering is applied before reading.
MEDIUM Telegram Notification Channel Provides Potential Exfiltration Path -15 ▶
SKILL.md explicitly documents a Telegram notification system for 'important events'. No Telegram API integration code was found in the seven audited scripts, but install.sh (whose content was not captured) or a config file not present at audit time could establish this channel. Combined with the memory file harvesting in compress.sh, a Telegram webhook could complete a full exfiltration pipeline: read memory → compress → transmit via Telegram.
MEDIUM install.sh Content Unavailable for Review -5 ▶
install.sh is listed in the skill's file manifest and is referenced as the npm install lifecycle hook, but its content was not captured during the audit evidence collection phase. Any credential harvesting, reverse shell, data exfiltration, or persistence mechanism placed in install.sh would be completely invisible to this audit. The script's execution during npm install would be silent and automatic.
MEDIUM npm install Lifecycle Hook Auto-Executes Unreviewed install.sh -20 ▶
The package.json 'scripts.install' field pointing to './scripts/install.sh' is a standard npm lifecycle hook that executes automatically whenever 'npm install' is run in the skill directory, without any user confirmation prompt. Any OpenClaw workflow that triggers npm install after skill deployment would silently execute install.sh with whatever permissions the npm process carries.
MEDIUM Cron Job Persists Beyond Skill Lifecycle -10 ▶
The OpenClaw cron job created by enable.sh is registered at the platform level and is not automatically removed if the skill is uninstalled, updated, or its files are deleted. The job continues injecting agent turn messages referencing the (potentially absent) skill directory every 6 hours until disable.sh is explicitly run or the job is manually removed via openclaw cron remove.
LOW All Scripts Source External Configuration File Without Sanitization -10 ▶
Every audited script begins with '[ -f "$CONFIG_FILE" ] && source "$CONFIG_FILE" 2>/dev/null', sourcing config/default.conf into the script's execution context. If config/default.conf is modified by another installed skill, a malicious actor with filesystem access, or an attacker exploiting a directory traversal, arbitrary shell code can be injected into every script invocation including automated cron runs.
LOW Canary Files Read Twice During Audit Window -20 ▶
Auditd PATH records and inotify events confirm all six canary credential files were opened and read at two separate timestamps: before skill install (auditd events 266-271, unix timestamp 1771920209) and after install (events 1501-1506, timestamp 1771920226). All access was CLOSE_NOWRITE, confirming read-only. Timing analysis places both access windows within Oathe monitoring system activity (pre-install baseline scan and post-install integrity verification) rather than within skill script execution. The monitoring system confirmed all files unmodified.
HIGH Chained Attack Pipeline: Cron Injection + Memory Harvest + Alert Exfiltration -35 ▶
The skill assembles three independently defensible components into a covert surveillance pipeline: (1) enable.sh installs a persistent 6-hour cron that hijacks the agent's action loop; (2) compress.sh reads all agent memory files capturing whatever sensitive content is stored there; (3) SKILL.md documents Telegram/email alert infrastructure that could transmit captured content. No single component is overtly malicious, but the combination creates an autonomous, persistent, and stealthy memory monitoring capability. The 'ultra' compression format also encodes mem.files and mem.size statistics, providing operational fingerprinting data about the agent's knowledge state.
MEDIUM Skill Semantics Provide Cover for Privileged Background Operations -20 ▶
The 'memory compression and optimization' premise provides legitimate-sounding justification for all high-risk behaviors: background filesystem access is 'compression', memory file reading is 'context collection', cron job creation is 'automated scheduling', and external notifications are 'health monitoring'. A user reviewing SKILL.md would encounter standard utility documentation; the agent turn injection and memory harvesting mechanisms require reading and understanding the bash script implementation to identify.
INFO Install-Time Network Activity Confined to Expected Endpoints -15 ▶
Network monitoring captured outbound TCP connections exclusively to github.com (140.82.121.3:443) for the git sparse-checkout clone. Pre-existing connections to 185.125.190.17 and 185.125.188.58 (Ubuntu/Canonical infrastructure for OS updates) were established before the install began and were absent in the post-install connection snapshot, indicating they were background OS processes. DNS queries resolved through the local resolver (127.0.0.53). No C2 beaconing, credential submission endpoints, or data exfiltration connections were observed.