ClawHub
Back to skill

Security audit

ollama-memory-embeddings

Security checks for vulnerabilities and agentic risk

Overview

The skill’s purpose is coherent, but it has review-worthy safety flaws that can change local state unexpectedly and persistently alter OpenClaw settings.

Review before installing. The skill is not clearly malicious, but only use it if you are comfortable with it editing OpenClaw config, pulling or creating Ollama models, and optionally installing a launchd watchdog. Avoid --dry-run as a trusted non-mutating approval step, avoid --install-watchdog until the plist interval validation is fixed, and keep a separate backup of ~/.openclaw/openclaw.json.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
lib/config.js:43
Finding

Configuration Read or Parse Failures Cause Destructive Overwrite

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
install.sh:320
Finding

Dry-Run Mode Performs Persistent Ollama Model Operations

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
watchdog.sh:63
Finding

Unvalidated Watchdog Interval Permits LaunchAgent Plist Injection

Content
View full analysis
--restart-on-heal" fi cat > "$PLIST_PATH" < Label ${esc_plist_name} ProgramArguments
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Continuous watchdog monitoring, automatic drift remediation, and installation of a macOS launchd job introduce persistence and autonomous system modification beyond a simple one-time configuration change. In a skill ecosystem, undeclared persistence mechanisms are security-relevant because they can continue changing user configuration, create logs, and restart services without ongoing user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding

Continuous watchdog monitoring, automatic drift remediation, and installation of a macOS launchd job introduce persistence and autonomous system modification beyond a simple one-time configuration change. In a skill ecosystem, undeclared persistence mechanisms are security-relevant because they can continue changing user configuration, create logs, and restart services without ongoing user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Continuous watchdog monitoring, automatic drift remediation, and installation of a macOS launchd job introduce persistence and autonomous system modification beyond a simple one-time configuration change. In a skill ecosystem, undeclared persistence mechanisms are security-relevant because they can continue changing user configuration, create logs, and restart services without ongoing user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Continuous watchdog monitoring, automatic drift remediation, and installation of a macOS launchd job introduce persistence and autonomous system modification beyond a simple one-time configuration change. In a skill ecosystem, undeclared persistence mechanisms are security-relevant because they can continue changing user configuration, create logs, and restart services without ongoing user awareness.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
- Adds an idempotent drift-enforcement command (`enforce.sh`)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · verify.sh (reported line 131)May include surrounding context.

sh
TMP_BODY="$(mktemp)"
TMP_ERR="$(mktemp)"
set +e
HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w "%{http_code}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \
  "$EMBED_URL" 2>"$TMP_ERR")"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

text
3. **Direct endpoint check:**
   ```bash
   curl -s -X POST http://127.0.0.1:11434/v1/embeddings \
     -H "Content-Type: application/json" \
     -d '{"model":"nomic-embed-text:latest","input":"test"}' | head -c 200

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 18)May include surrounding context.

md
- `install.sh` - install and configure memory embeddings provider
- `verify.sh` - endpoint and model verification only
- `enforce.sh` - idempotent config enforcement with lock protection
- `watchdog.sh` - optional drift healing and optional launchd install
- `audit.sh` - read-only report (no mutation)
- `uninstall.sh` - best-effort revert using latest config backup

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 43)May include surrounding context.

sh
- `install.sh` - install and configure memory embeddings provider
- `verify.sh` - endpoint and model verification only
- `enforce.sh` - idempotent config enforcement with lock protection
- `watchdog.sh` - optional drift healing and optional launchd install
- `audit.sh` - read-only report (no mutation)
- `uninstall.sh` - best-effort revert using latest config backup

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill writes persistent configuration, may restart the OpenClaw gateway, and can install drift-enforcement/watchdog components, which together create durable changes across sessions. Even though the stated purpose is configuration management, persistence plus optional automated healing increases risk because it can override later user changes or maintain an unintended state over time.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
- `model = <selected model>:latest`
  - `remote.baseUrl = "http://127.0.0.1:11434/v1/"`
  - `remote.apiKey = "ollama"` (required by client, ignored by Ollama)
- Performs a post-write config sanity check (reads back and validates JSON)
- Optionally restarts the OpenClaw gateway (with detection of available
  restart methods: `openclaw gateway restart`, systemd, launchd)
- Optional memory reindex during install (`openclaw memory index --force --verbose`)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 47)May include surrounding context.

sh
--model <id>                embeddinggemma | nomic-embed-text | all-minilm | mxbai-embed-large
  --import-local-gguf <mode>  auto | yes | no   (default: no)
                              Use yes to explicitly scan/import a local GGUF.
  --import-model-name <name>  model name to create in Ollama (default: embeddinggemma-local)
  --openclaw-config <path>    OpenClaw config path (default: ~/.openclaw/openclaw.json)
  --non-interactive           do not prompt; use supplied/default values
  --restart-gateway <mode>    yes | no (default: no)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · install.sh (reported line 117)May include surrounding context.

sh
}

ollama_running() {
  curl -fsS "http://127.0.0.1:11434/api/tags" >/dev/null 2>&1
}

# Search for any embedding GGUF (embeddinggemma, nomic-embed, all-minilm, mxbai-embed).

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 240)May include surrounding context.

sh
uid="$(id -u)"
    echo "  macOS (launchd):  launchctl kickstart -k gui/${uid}/bot.molt.gateway"
  fi
  # Linux systemd
  if command -v systemctl >/dev/null 2>&1 && systemctl --user is-enabled openclaw-gateway 2>/dev/null; then
    echo "  Linux (systemd):  systemctl --user restart openclaw-gateway"
  fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The apply-enforce command modifies and writes the provided configuration file via writeConfig, but this path has no confirmation prompt, log message, comment, or other user disclosure indicating that the file will be changed. Because this is a file write that can alter user configuration and credentials, it matches the missing-warning criterion for code files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · verify.sh (reported line 131)May include surrounding context.

sh
TMP_BODY="$(mktemp)"
TMP_ERR="$(mktemp)"
set +e
HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w "%{http_code}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \
  "$EMBED_URL" 2>"$TMP_ERR")"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 29)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 30)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 152)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 160)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 164)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 176)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 178)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 208)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 209)May include surrounding context.

sh
UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"