Vta Memory

Reward and motivation system for AI agents. Dopamine-like wanting, not just doing. Part of the AI Brain series.

This skill appears internally consistent and runs entirely on local files, but review these before installing: 1) It reads conversation transcripts (~/.openclaw/agents/<id>/sessions) and writes summaries and logs into ~/.openclaw/workspace/memory — sensitive conversation content will be processed and stored locally. 2) It generates VTA_STATE.md (first‑person motivation text) which OpenClaw auto-injects into sessions and will change agent behavior; test it in a non-production agent first. 3) install.sh can register cron agent-turns via the openclaw CLI to run decay/encoding periodically — run install.sh without --with-cron initially to inspect behavior, and only enable cron after confirming you accept automated runs. 4) Inspect workspace sync/backup settings (if your workspace is backed up to cloud or shared) because processed transcripts and logs are stored in cleartext. If you want to proceed: run in a sandbox/test agent, audit the generated files (reward-state.json, brain-events.jsonl, VTA_STATE.md) and confirm no network calls are being made from your environment.

Type: OpenClaw Skill Name: vta-memory Version: 1.2.0 The skill bundle contains several vulnerabilities that could be exploited by a malicious actor. The `generate-dashboard.sh` script is vulnerable to Cross-Site Scripting (XSS) as it directly injects user-controlled data (e.g., agent name from `IDENTITY.md`, memory summaries, emotion triggers, reward sources from JSON state files) into the generated HTML without proper escaping. Additionally, the `sync-motivation.sh` script creates `VTA_STATE.md` by directly embedding user-controlled content (from `seeking`, `anticipating`, and `recentRewards.source` fields in `reward-state.json`) which, when auto-injected into agent sessions, presents a prompt injection vulnerability. Finally, the `prompts/encode-rewards.md` instructs the agent to construct and execute shell commands with arguments derived from conversation analysis, posing a risk of arbitrary command execution if the agent can be tricked into generating malicious arguments via prompt injection. These are vulnerabilities, not evidence of intentional malicious behavior by the skill itself.