Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent local knowledge-base skill, but it exposes private document search and admin APIs too broadly and can browse or index outside the intended folder.
Review before installing. Use this only on a trusted single-user machine, avoid putting sensitive documents in it until API binding/authentication/path limits are fixed, prefer verified Ollama/package installation steps, and do not expose ports 5777 or 8768 to a LAN or untrusted browser context.
SKILL.md:39Unverified Remote Installer Is Piped Directly into a Shell
scripts/knowledge_api.py:323Unauthenticated Network-Accessible Administrative and Document APIs
scripts/index_knowledge.py:267Unvalidated Configuration Paths Allow Indexing Outside the Approved Knowledge Root
start.py:158Unpinned Dependencies Are Installed and Executed During Setup or Startup
The installation instructions tell users to fetch a remote script and immediately execute it via the shell. If the remote server, transport path, or hosted script is compromised, users could run arbitrary code on their machine with the same privileges as the invoking user.
# 1. 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh
# 2. 拉取推荐模型（千问3 Embedding 8B）
ollama pull qwen3-embedding:8b
The '| sh' pattern is specifically dangerous because it removes any opportunity for users to review the downloaded content before execution. In the context of a developer-facing skill that users may follow directly, this meaningfully increases the chance of supply-chain compromise leading to local code execution.
# 1. 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh
# 2. 拉取推荐模型（千问3 Embedding 8B）
ollama pull qwen3-embedding:8b
A second documented mismatch exists because the skill appears to expose a browse API for local directories and a delete-file proxy, while the public description frames it mainly as storage, indexing, and semantic search. Hidden or under-described file-system enumeration and deletion capabilities are particularly risky in a local knowledge skill because they can reveal unrelated user data or enable destructive actions beyond expected note management.
A second documented mismatch exists because the skill appears to expose a browse API for local directories and a delete-file proxy, while the public description frames it mainly as storage, indexing, and semantic search. Hidden or under-described file-system enumeration and deletion capabilities are particularly risky in a local knowledge skill because they can reveal unrelated user data or enable destructive actions beyond expected note management.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: knowledge-rag
version: "1.6.0"
description: "个人知识库：存笔记、搜内容。用自然语言搜本地文档，不用记文件名。跟 AI 说'把这段存到知识库'自动保存并建索引。推荐搭配 Bilibili Auto Transcript：视频转录自动入库，转完即搜。"
metadata:
openclaw:
emoji: "📖"
requires:
bins: ["python3", "ollama"]
install:
- id: "ollama"
kind: "system"
label: "安装 Ollama（向量引擎）"
url: "https://ollama.com/download"
- id: "embed-model"
kind: "shell"
label: "下载推荐向量模型（千问3 Embeddi
The installation instructions use 'curl ... | sh', which executes a remotely fetched script directly without prior integrity verification or review. If the remote server, DNS, TLS trust chain, or distribution channel is compromised, users could execute arbitrary code immediately on their machine.
# 1. 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh
# 2. 拉取推荐模型（千问3 Embedding，中文最优）
ollama pull qwen3-embedding:8b
The pipe into 'sh' is a classic command-chaining pattern that removes the user's opportunity to inspect downloaded content before execution. In the context of a locally installed skill, this materially raises the risk of remote code execution during setup and makes compromise of the upstream installation endpoint especially impactful.
# 1. 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh
# 2. 拉取推荐模型（千问3 Embedding，中文最优）
ollama pull qwen3-embedding:8b
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
return False
print_status("启动网页服务...", "wait")
env = os.environ.copy()
env["PORT"] = str(TS_PORT)
proc = subprocess.Popen(
["npx", "tsx", "src/server.ts"],
The skill description encourages users to drop .txt, .md, .pdf, and .docx files into the knowledge directory and query them in natural language, which involves processing potentially sensitive personal documents. Although the README notes where data is stored later, it does not clearly warn at the point of use that uploaded content will be indexed and persisted locally, which is relevant to user data handling.
The skill advertises installation and operation steps that clearly require shell execution, file reads/writes, local networking, and environment interaction, yet it declares no explicit tool scope or permissions boundaries. This creates an authorization transparency problem: users and the platform cannot easily tell that the skill can touch local files, invoke commands, and access services, which increases the chance of over-privileged execution or unsafe agent behavior.
The skill explicitly promises automatic saving and indexing but does not pair that with a strong, prominent warning about persistence, retention, and searchability of stored data. This is dangerous because users may treat the interaction like ephemeral chat while the skill writes potentially sensitive text into a searchable local corpus.
The invocation phrase '把这段存到知识库' is broad enough to overlap with ordinary conversation and could trigger unintended persistence of user content. In a skill that writes to disk and updates an index, accidental invocation can silently store sensitive chat content or proprietary data without deliberate opt-in at that moment.
The script sends document chunks to an external HTTP service via requests.post for embedding generation. Even though the default target is localhost, this still transmits potentially sensitive knowledge-base content out of the process boundary to another service, and it uses unauthenticated plain HTTP, so a reconfigured endpoint or exposed local service could leak private data.
def embed(text):
"""调 Ollama 向量化"""
resp = requests.post(OLLAMA_URL, json={
"model": get_embed_model(),
"prompt": text,
}, timeout=30)
This code exposes a POST endpoint that writes arbitrary configuration data to a persistent JSON file on disk, potentially changing future indexing behavior and storage location. There is no confirmation prompt, warning log, or explanatory comment near the write operation indicating that user-supplied settings will overwrite saved configuration.
The /api/browse endpoint accepts an arbitrary path parameter, normalizes it, and returns directory entries for any readable local directory rather than restricting access to the configured knowledge base. In this note-search skill context, that exposes filesystem structure outside the intended data scope and can leak sensitive local paths or filenames to any process or webpage able to reach the API.
This endpoint deletes rows from the chunks table and commits the change immediately, making it a destructive operation that alters stored index data. The code contains no confirmation step, user-facing disclosure, or nearby documentation warning that invoking the endpoint will permanently remove index entries for the specified file.
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
def _check_ollama():
try:
resp = requests.get("http://localhost:11434/api/tags", timeout=3)
data = resp.json()
models = [m["name"] for m in data.get("models", [])]
current_model = qk.get_embed_model()
The module docstring and CLI usage/output text consistently force a Chinese-language interface, which can violate a language/locale policy when no user choice is offered. There is no indication that the locale constraint is optional, configurable, or justified as region-specific.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def embed(text):
resp = requests.post(OLLAMA_URL, json={
"model": get_embed_model(), "prompt": text,
}, timeout=30)
resp.raise_for_status()
This Python file contains its top-level docstring and key user-facing runtime messages only in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy explicitly calls for flagging language or locale constraints when the skill does not offer user choice or document a justified region-specific limitation.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
warnings = []
try:
result = subprocess.run(["ollama", "--version"], capture_output=True, text=True, timeout=5)
if result.returncode != 0:
print_status("Ollama 未安装，请从 https://ollama.com/download 安装后重试", "err")
return False
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print_status("Ollama 已安装", "ok")
try:
result = subprocess.run(["ollama", "list"], capture_output=True, text=True, timeout=10)
installed_models = result.stdout
except Exception:
warnings.append("无法查询已安装模型")
The startup script auto-downloads models, which extends behavior from launching a local tool into network retrieval and local installation. In an agent-skill context, that extra capability matters because users may expect a launcher, not an installer that changes system state and trusts upstream content.
Automatically pulling an embedding model from ollama causes network retrieval and installation of executable/model artifacts during startup. While model setup is related to the skill's purpose, doing it implicitly increases supply-chain exposure and performs host modifications without an explicit user confirmation step.
else:
print_status(f"推荐模型 {expected_model} 未安装，正在自动下载...", "wait")
try:
subprocess.run(["ollama", "pull", expected_model], check=True, timeout=300)
print_status(f"模型 {expected_model} 下载完成", "ok")
except Exception as e:
warnings.append(f"模型下载失败: {e}，请手动运行: ollama pull {expected_model}")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
log_dir = os.path.join(SCRIPTS_DIR, "..", "logs")
os.makedirs(log_dir, exist_ok=True)
log_file = os.path.join(log_dir, "python_api.log")
proc = subprocess.Popen(
[get_python(), script, str(PYTHON_API_PORT)],
stdout=open(log_file, "a"), stderr=subprocess.STDOUT,
)
No suspicious patterns detected.