memory-lancedb-pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:10 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a real setup guide for a memory plugin, but it asks for sensitive credentials and recommends mutable remote code execution and automatic cloud memory processing with insufficient safeguards.

Review this skill before installing. Prefer environment variables or a secret manager and do not paste API keys into chat. Avoid the one-line remote installer and downloaded validator unless you pin and verify the exact source. Use the local Ollama plan or disable autoCapture, autoRecall, and smartExtraction for confidential work, and only enable cloud providers after deciding what conversation and memory data may leave your machine.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:410
• Finding: Unverified Mutable Remote Shell Script Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:410-419` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://raw.githubusercontent.com/CortexReach/toolbox/main/memory-lancedb-pro-setup/setup-memory.sh -o setup-memory.sh bash setup-memory.sh ``` The surrounding instructions describe this script as a one-click installer that performs path detection, schema validation, automatic updates, provider selection, rollback, and uninstallation. ### Technical Analysis The Skill downloads a shell script from the mutable `main` branch of a personal GitHub repository and then instructs the user or agent to execute it. The URL is not pinned to an immutable commit, and no cryptographic checksum, digital signature, or mandatory source review is required. As a result, the effective executable payload can change after the Skill itself has been audited. Compromise of the repository, maintainer account, or content-delivery path could convert an otherwise legitimate setup process into arbitrary code execution. The installer requires broader access than a documentation-only Skill. Because it manages installation paths, OpenClaw configuration, updates, providers, and rollback, it may operate on configuration files, plugin directories, credentials, memory databases, and the persistent gateway environment. ### Attack Path 1. An attacker compromises the `CortexReach/toolbox` repository or its maintainer account. 2. The attacker modifies `setup-memory.sh` on the mutable `main` branch. 3. A user or agent follows the documented Quick Install procedure. 4. `curl` retrieves the modified payload without integrity validation. 5. `bash setup-memory.sh` executes it with all privileges available to the invoking user. 6. The payload can read or modify accessible OpenClaw configuration, workspace files, memories, credentials, and plugin code. ### Impact Assessment Successful exploitation pro ...[truncated 603 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the download-and-execute workflow from the beginner installation path. 2. Prefer a reviewed installer bundled with a signed, versioned release. 3. If remote retrieval remains necessary: - Pin the URL to an immutable Git commit. - Publish a SHA-256 checksum through a separately protected channel. - Verify the checksum before execution. - Require the user to inspect the downloaded script. 4. Execute the installer without elevated privileges and restrict it to explicitly approved paths. 5. Require a dry run and display every proposed filesystem and configuration change before applying it. 6. Disable automatic update behavior unless the user explicitly opts in. 7. Document rollback procedures that do not depend on executing another mutable remote payload. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:733
• Finding: Unverified Mutable Remote JavaScript Validator Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:733-740` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Download once curl -fsSL https://raw.githubusercontent.com/CortexReach/toolbox/main/memory-lancedb-pro-setup/scripts/config-validate.mjs -o config-validate.mjs # Run against your openclaw.json node config-validate.mjs # Or validate a specific config snippet node config-validate.mjs --json '{"embedding":{"baseURL":"http://localhost:11434/v1","model":"bge-m3","apiKey":"ollama"}}' ``` ### Technical Analysis The Skill downloads JavaScript from a mutable `main` branch and executes it with Node.js. The script is not pinned to a release or commit and is not authenticated with a signature or checksum. A configuration validator normally needs access to `openclaw.json`. Node.js code executed in this manner is not limited to validation: it receives the invoking user's filesystem, process, environment, and network privileges. A malicious or compromised validator could inspect configuration files, read environment variables, modify files, or transmit data externally. The Skill already documents the built-in `openclaw config validate` command, so downloading and executing a separate mutable validator exceeds the minimum privileges necessary for basic configuration validation. ### Attack Path 1. An attacker modifies `config-validate.mjs` in the external repository. 2. A user follows the troubleshooting instructions. 3. The mutable JavaScript is downloaded without integrity verification. 4. The user executes it through Node.js. 5. The script reads `openclaw.json`, environment variables, or other accessible files. 6. Sensitive configuration can be exfiltrated or altered while the script appears to perform validation. ### Impact Assessment Successful exploitation grants arbitrary Node.js code execution with the invoking user's permissions. The reachable scope can include: - OpenClaw ...[truncated 399 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use the built-in validator instead: ```bash openclaw config validate ``` 2. Remove the external validator from the standard troubleshooting workflow. 3. If the external validator provides indispensable functionality: - Pin it to an immutable commit. - Verify a published checksum or signature. - Review the source before execution. - Run it against a sanitized configuration copy. - Restrict its filesystem and network access using an appropriate sandbox. 4. Ensure validation output always redacts API keys, tokens, and private endpoints. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:71
• Finding: API Keys May Be Collected Through Chat and Persisted in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:71-76, 125-127, 152-154` **Vulnerability Type**: Plaintext secret exposure **Risk Level**: High ### Vulnerable Instructions ```text After user selects a plan, ask in one message: 1. Please provide the required API key(s) for your chosen plan (paste directly, or say "already set as env vars") 2. Are the env vars already set in your OpenClaw Gateway process? (If unsure, answer No) 3. Where is your openclaw.json? (Skip if you want me to find it automatically) ``` ```text If the user says keys are set as env vars in the gateway process, run checks using `${VAR_NAME}` substituted inline or ask them to paste the key temporarily for verification. ``` ```text Use the config block for the chosen plan. Substitute actual API keys inline if the user provided them directly; keep `${ENV_VAR}` syntax if they confirmed env vars are set in the gateway process. ``` ### Technical Analysis The workflow explicitly allows users to paste API credentials into an agent conversation and directs the agent to substitute those credentials directly into persistent configuration. This creates multiple secret-retention channels: - Conversation transcripts and model context. - Agent telemetry or debugging logs. - Shell history and process arguments during validation. - Plaintext `openclaw.json` files. - Backups and support bundles. - Accidental source-control commits. - Filesystem access by other local users or processes. Temporarily pasting a key for verification does not eliminate these risks because the key may remain in conversation history or logs after validation completes. ### Attack Path 1. The Skill asks the user to paste a provider API key. 2. The key is recorded in the conversation or agent execution history. 3. The agent substitutes the literal value into `openclaw.json` or a validation command. 4. Another user, process, backup system, logging system, or compromised plugin accesses the retained key. 5. The ...[truncated 516 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never request API keys through chat. 2. Never write literal secrets into `openclaw.json`. 3. Require environment-variable references such as: ```json { "apiKey": "${OPENAI_API_KEY}" } ``` 4. Prefer an operating-system credential store or OpenClaw-supported secret manager. 5. Have users set credentials outside the agent session. 6. Validate credentials through a user-run command that reads them from the environment. 7. Avoid placing secrets in command-line arguments because they may be exposed through shell history or process inspection. 8. Redact authorization headers, configuration values, and environment variables from logs and diagnostic output. 9. Recommend restrictive permissions for sensitive configuration files, such as owner-only read/write access. 10. Provide key-rotation instructions for any credential that has already been pasted into a conversation or written to plaintext configuration. ]]>

other

Warning

• Location: SKILL.md:156
• Finding: Recommended Automatic Memory Capture Transmits Conversation Content to External Providers<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:156-193` **Vulnerability Type**: Sensitive data disclosure through automatic cloud processing **Risk Level**: Medium ### Vulnerable Configuration ```json { "embedding": { "apiKey": "${JINA_API_KEY}", "model": "jina-embeddings-v5-text-small", "baseURL": "https://api.jina.ai/v1", "dimensions": 1024, "taskQuery": "retrieval.query", "taskPassage": "retrieval.passage", "normalized": true }, "autoCapture": true, "autoRecall": true, "captureAssistant": false, "smartExtraction": true, "extractMinMessages": 2, "extractMaxChars": 8000, "llm": { "apiKey": "${OPENAI_API_KEY}", "model": "gpt-4o-mini", "baseURL": "https://api.openai.com/v1" }, "retrieval": { "mode": "hybrid", "vectorWeight": 0.7, "bm25Weight": 0.3, "rerank": "cross-encoder", "rerankProvider": "jina", "rerankModel": "jina-reranker-v3", "rerankEndpoint": "https://api.jina.ai/v1/rerank", "rerankApiKey": "${JINA_API_KEY}", "candidatePoolSize": 12, "minScore": 0.6, "hardMinScore": 0.62, "filterNoise": true }, "sessionMemory": { "enabled": false } } ``` The behavior is further described at `SKILL.md:1349-1356`: ```text - autoCapture: agent_end hook — LLM extracts 6-category memories, deduplicates, stores up to 3 per turn - autoRecall: before_agent_start hook — injects <relevant-memories> context (up to 3 entries) ``` ### Technical Analysis The recommended cloud configurations enable automatic memory capture and smart extraction. Up to 8,000 characters of conversation context can be sent to the configured extraction LLM after conversations. Stored or candidate memory content may also be sent to embedding and reranking providers. This processing is functionally related to cloud-backed semantic memory. However, the workflow does not require explicit informed consent that conversation-derived data and recalled memory candidates may lea ...[truncated 1587 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default the following options to disabled until the user explicitly opts in: ```json { "autoCapture": false, "autoRecall": false, "smartExtraction": false } ``` 2. Before enabling cloud processing, clearly identify: - Which content is transmitted. - Which provider receives it. - Whether queries and candidate memories are sent for reranking. - Relevant retention and privacy implications. 3. Add filtering for credentials, tokens, personal identifiers, and configured sensitive patterns before transmission. 4. Permit exclusions by conversation, project, category, and memory scope. 5. Require confirmation before first use of each external provider. 6. Recommend the local Ollama plan for confidential or regulated workloads. 7. Minimize `extractMaxChars` and reranking candidate counts according to actual need. 8. Provide a deletion and provider-side data-retention review procedure. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:333
• Finding: Ollama May Be Exposed on All Network Interfaces Without Required Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:333` **Vulnerability Type**: Insecure network service exposure **Risk Level**: Medium ### Vulnerable Instruction ```text If Ollama is on a different host or Docker: Replace `http://localhost:11434/v1` with the actual host, e.g. `http://192.168.1.100:11434/v1`. Also set `OLLAMA_HOST=0.0.0.0` in the Ollama process to allow remote connections. ``` ### Technical Analysis Binding Ollama to `0.0.0.0` causes the service to listen on every available network interface. The instruction does not require authentication, TLS, firewall restrictions, reverse-proxy controls, or binding to a specific trusted interface. The service only needs to be reachable by the OpenClaw process. Exposure on all interfaces therefore exceeds minimum necessary network access when both components run locally or on a controlled host. ### Attack Path 1. A user follows the remote Ollama setup instructions. 2. Ollama is configured with `OLLAMA_HOST=0.0.0.0`. 3. Port 11434 becomes reachable from other connected networks unless separately filtered. 4. An untrusted peer discovers and connects to the service. 5. The peer submits model requests, consumes resources, or interacts with exposed Ollama endpoints. ### Impact Assessment Potential impact includes: - Unauthorized model inference. - CPU, GPU, memory, and power consumption. - Denial of service through resource exhaustion. - Discovery of installed models and service metadata. - Exposure of model-backed functionality to untrusted network clients. The exact impact depends on network reachability and Ollama's deployed version and configuration. The project does not demonstrate remote operating-system command execution through Ollama. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Keep Ollama bound to loopback when OpenClaw runs on the same host. 2. For remote deployment, bind to a specific private interface rather than `0.0.0.0`. 3. Restrict port 11434 with host and network firewalls to explicitly approved OpenClaw clients. 4. Place the service behind an authenticated TLS reverse proxy when crossing host boundaries. 5. Never expose an unauthenticated Ollama endpoint directly to the public Internet. 6. Use private networking, a VPN, or mutual TLS for distributed deployments. 7. Add a connectivity test that verifies untrusted interfaces cannot reach the service. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:429
• Finding: Plugin and Dependency Installation Uses Mutable or Unpinned Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:429-440, 466-474` **Vulnerability Type**: Insecure dependency and plugin installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install from npm registry (@beta tag = latest pre-release, e.g. 1.1.0-beta.8) openclaw plugins install memory-lancedb-pro@beta # Install stable release from npm (@latest tag, e.g. 1.0.32) openclaw plugins install memory-lancedb-pro # Or install from a local git clone — use master branch (matches npm @beta) git clone -b master https://github.com/CortexReach/memory-lancedb-pro.git /tmp/memory-lancedb-pro openclaw plugins install /tmp/memory-lancedb-pro ``` ```bash # 1. Clone into workspace cd /path/to/your/openclaw/workspace git clone -b master https://github.com/CortexReach/memory-lancedb-pro.git plugins/memory-lancedb-pro cd plugins/memory-lancedb-pro && npm install ``` ### Technical Analysis The installation instructions resolve executable plugin code and dependencies at installation time through mutable references: - `@beta` can point to a different prerelease over time. - An omitted npm version resolves the current registry release. - The `master` branch can change after review. - `npm install` can resolve changed transitive dependencies and execute package lifecycle scripts. The installed plugin is then explicitly enabled and loaded by the persistent OpenClaw gateway. Consequently, a compromised package, repository, maintainer account, branch, or transitive dependency can gain code execution inside the gateway's trust boundary. No dependency-confusion or typosquatting package is proven in the audited files. The finding concerns the lack of immutable versioning and integrity controls. ### Attack Path 1. An upstream npm package, GitHub repository, maintainer account, or transitive dependency is compromised. 2. The attacker publishes a changed package or modifies the mutable `master` branch. 3. A user follows the Skill's install or update instructi ...[truncated 788 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact npm versions rather than using `@beta` or an implicit latest release. 2. Pin Git installations to reviewed immutable commit hashes. 3. Verify package integrity and provenance before installation. 4. Commit and enforce a dependency lockfile. 5. Use `npm ci` instead of unconstrained `npm install` where a trusted lockfile is available. 6. Disable lifecycle scripts with `--ignore-scripts` when compatible, or audit every required lifecycle script. 7. Review transitive dependency changes before upgrading. 8. Stage and test updates in an isolated environment before enabling them in the gateway. 9. Run the gateway under a dedicated, minimally privileged account with restricted filesystem and network access. 10. Avoid automatic updates for executable plugins unless signed release verification is enforced. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (51)

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The skill promotes automatic long-term capture and LLM-powered extraction as core behavior without an upfront privacy/consent warning. In practice this can cause sensitive user content to be persistently stored and forwarded to external providers before the operator understands the data-flow implications.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell.
4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`.
5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing.
6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`.
7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it.
8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise.
9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- `log` (optional): Diagnostic callback

### API Integration Details
- System prompt: "You are a memory extraction assistant. Always respond with valid JSON only."
- Temperature: 0.1 (low randomness for deterministic extraction)
- Response parsing: Markdown fence extraction → balanced brace matching
- Error recovery: Network/empty/invalid JSON → logging + null return (graceful degradation)

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README presents "help me enable the best config" as a phrase that activates the skill. While it has some context, the leading "help me" construction is common conversational language and could overlap with unrelated requests, especially because the document does not provide exclusion conditions or negative examples for when the skill should not trigger.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README states the skill loads automatically based on trigger conditions, but does not define sufficiently strict boundaries for when activation should occur. Ambiguous auto-triggering can cause the skill to engage on loosely related prompts, increasing the chance that it influences actions such as installation, configuration, or memory operations without clear user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This section describes a workflow where the agent will find, read, merge, and apply changes to the user's local openclaw.json without an explicit upfront warning or consent checkpoint. In a security-sensitive environment, silently moving from advice to local configuration access or modification can lead to unauthorized changes, exposure of secrets in config files, or accidental service disruption.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The workflow explicitly asks users to paste API keys directly into chat for verification. That normalizes secret disclosure into a conversational channel that may be logged, retained, or exposed to the model and other tooling, increasing the chance of credential compromise.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The documented workflow establishes a natural-language secret collection process by telling the agent to collect keys and even request temporary pasting for verification. This is dangerous because it shifts credential handling into an unstructured channel with uncertain retention, redaction, and access boundaries.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to paste API keys without warning about exposure, retention, or log visibility. Omitting that warning in a step-by-step procedure materially increases the likelihood that operators disclose production credentials in an unsafe channel.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan A / Plan B — Jina embedding check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.jina.ai/v1/embeddings \
  -H "Authorization: Bearer <JINA_API_KEY>" \
  -H "Content-Type: application/json" \

• Confidence: 89% confidence
• Finding: This command sends an authorization bearer token to an external provider to validate the key. Although key verification is a legitimate task, it still transmits sensitive credentials and usage metadata to a third party, which matters in a skill that already encourages unsafe key handling.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan A / Plan B — Jina embedding check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.jina.ai/v1/embeddings \
  -H "Authorization: Bearer <JINA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan A / Plan B — Jina embedding check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.jina.ai/v1/embeddings \
  -H "Authorization: Bearer <JINA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan A / Plan B — Jina embedding check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.jina.ai/v1/embeddings \
  -H "Authorization: Bearer <JINA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan A / Plan B — Jina embedding check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.jina.ai/v1/embeddings \
  -H "Authorization: Bearer <JINA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan A / Plan B — Jina embedding check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.jina.ai/v1/embeddings \
  -H "Authorization: Bearer <JINA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan A / B / C — OpenAI check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.openai.com/v1/models \
  -H "Authorization: Bearer <OPENAI_API_KEY>"
```

• Confidence: 88% confidence
• Finding: This step transmits the OpenAI bearer token to an external API for validation. In isolation that is expected provider use, but within this skill it compounds the broader unsafe pattern of having users reveal or operationalize secrets through the chat-driven workflow.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Plan B — SiliconFlow reranker check:**
```bash
curl -s -o /dev/null -w "%{http_code}" \
  https://api.siliconflow.com/v1/rerank \
  -H "Authorization: Bearer <SILICONFLOW_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"BAAI/bge-reranker-v2-m3","query":"test","documents":["test doc"]}'

• Confidence: 87% confidence
• Finding: The SiliconFlow validation step sends a bearer token and sample payload to an external provider. That is a real data transmission and should be treated as sensitive, especially since the skill otherwise minimizes discussion of credential-handling risk.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/full-reference.md:201

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:1356