Security audit

claw_lance_memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill does what it advertises, but it has serious privacy and safety gaps around remote embeddings, automatic persistent memory, identity handling, and setup-time credential storage.

Install only after reviewing the privacy model and setup script. Treat stored memories as sensitive data, assume memory and search text may be sent to Zhipu AI, avoid using the automatic extractor on private content without review, remove the hard-coded default user identity, fix the shell command construction, and do not store API keys in ~/.bashrc.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (8)

T09 · Insecure Skill Coding Practices

Error

Location: hooks/memory-system/handler.js:29
Finding: Shell Command Injection Through OPENCLAW_USER_ID During Agent Bootstrap
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: skills/memory/auto_memory.py:89
Finding: Persistent Cross-Session Prompt Injection Through Automatically Stored Memory
Content: View full analysis
{ content += `- ${pref}\n`; }); user_profile.facts.forEach(fact => { content += `- ${fact}\n`; }); user_profile.tasks.forEach(task => { content += `- ⏰ ${task}\n`; }); ``` ### Technical Analysis Conversation text matching broad trigger phrases is persisted with no instruction detection, review requirement, provenance enforcement, or size restriction. Stored values are subsequently rendered as Markdown and injected during `age ...[truncated 1526 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: skills/memory/lancedb_memory.py:193
Finding: LanceDB Filter Injection Can Break User Isolation
Content: View full analysis
NOW())") if min_importance > 0: conditions.append(f"importance >= {min_importance}") where_clause = " AND ".join(conditions) results = (self.table .search(query_embedding) .where(where_clause) .limit(k) .to_list()) ``` ### Technical Analysis The user ID is incorporated into a LanceDB SQL-like filter by direct string interpolation. A user ID containing quotes or filter operators can alter the structure and meaning of the predicate. Additionally, identity is selected from an environment variable rather than being cryptographically or operationally bound to an authenticated caller. Even without filter syntax injection, any caller able to select another known user ID may query that user's records. The same unsafe construction pattern is used for type filters and in deletion operations elsewhere in the database module, although normal CLI type values are constrained. ### Attack Path 1. An attacker gains control over `OPENCLAW_USER_ID` or another caller-controlled `user_id` argument. 2. The attacker supplies a crafted value containing a quote and an alternative predicate, or supplies another user's valid identifier. 3. `search_memories` creates the `where_clause` by concatenating the value. 4. LanceDB interprets the resulting expression as filter syntax. 5. The i ...[truncated 522 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: hooks/memory-system/handler.js:28
Finding: Hard-Coded Default User Identity Can Expose Another User's Memories
Content: View full analysis
Remediation: View remediation

other

Error

Location: skills/memory/lancedb_memory.py:36
Finding: Memory and Search Content Is Transmitted to an External Embedding Service Contrary to Privacy Claims
Content: View full analysis
List[float]: """Convert text to an embedding vector""" try: response = self.client.embeddings.create( model=self.model, input=text ) return response.data[0].embedding ``` Memory contents are passed to that method: ```python # Generate Embedding embedding = self.embeddings.embed_query(content) ``` Search queries are also transmitted: ```python # Generate query vector query_embedding = self.embeddings.embed_query(query) ``` The project documentation makes a conflicting claim: ```markdown ## Privacy and Security - Local storage: All memory data is stored locally - API encryption: Zhipu AI API calls use HTTPS - Multi-user isolation: Different users' data is completely isolated - No data upload: Memory data is not uploaded to any server ``` ### Technical Analysis The Zhipu AI SDK receives the complete plaintext supplied as memory content or a search query. HTTPS protects transport confidentiality but does not prevent the external provider from receiving and processing the text. Because memories may contain personal details, project information, tasks, or other sensitive context, this is a material external disclosure. The statement that memory data is not uploaded is incompatible with the implementation. ### Attack Path 1. A user adds a memory, automatic extraction stores conversation content, or a user performs a memory search. 2. The relevant text is passed to `embed_query`. 3. The Zhipu AI SDK sends the text to the provider's embedding API. 4. The external service receives and processes the plaintext. 5. This occurs d ...[truncated 398 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: enable.sh:37
Finding: Setup Script Stores the API Key in Plaintext and Allows Shell Profile Injection
Content: View full analysis
> ~/.bashrc fi ``` ### Technical Analysis The API key is collected using `read -p`, which does not suppress terminal echo, and is appended in plaintext to `~/.bashrc`. Shell profiles are commonly readable by the account owner, included in backups, inspected during support operations, or exposed through unrelated file-read vulnerabilities. The key is enclosed in single quotes without escaping embedded single quotes. A crafted value can terminate the quoted string and append shell syntax. Because `.bashrc` is executed by future interactive shells, this creates a persistent command-execution path. ### Attack Path Credential exposure path: 1. A user enters a valid API key during setup. 2. The key is visible during terminal entry and written to `~/.bashrc`. 3. Any process or person able to read the profile obtains the credential. Shell injection path: 1. A malicious value containing a single quote and shell commands is supplied as the API key. 2. The setup script appends the value without safe serialization. 3. The generated `.bashrc` line contains attacker-controlled shell syntax. 4. A later interactive shell loads `.bashrc`. 5. The injected command executes with the user's privileges. ### Impact Assessment Credential compromise allows unauthorized use of the Zhipu AI account and may incur costs or expose account-level metadata. Shell-profile injection provides persistent command execution as the affected local user whenever the profile is sourced. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Automatically Installed Dependencies Are Not Reproducibly Pinned
Content: View full analysis
=0.30.0 pyarrow>=15.0.0 langchain>=0.3.0 langchain-community>=0.3.0 langchain-core>=0.3.0 zhipuai>=2.0.0 numpy>=1.24.0 ``` The setup script installs whatever versions currently satisfy those ranges: ```bash echo "Installing dependencies..." pip install -q -r requirements.txt echo "Dependencies installed" ``` ### Technical Analysis Every dependency uses an open-ended lower-bound constraint. A future version can therefore be selected without review, including changed transitive dependencies. The installation is not protected by a lock file or package hashes. No specific malicious dependency was identified in the reviewed files. The confirmed issue is that installation is non-reproducible and trusts future package releases automatically. ### Attack Path 1. A future or compromised package release satisfies one of the `>=` constraints. 2. A user executes `enable.sh`. 3. `pip` resolves the newest compatible packages and transitive dependencies. 4. Package installation hooks or imported package code execute in the environment. 5. Any malicious or vulnerable release gains the privileges available to the setup or runtime process. ### Impact Assessment Impact depends on the compromised dependency and installation privileges. Potential effects include arbitrary code execution during installation or import, credential theft, database compromise, and modification of the OpenClaw workspace. Open-ended versions also create availability and integrity risks through incompatible updates. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/memory/session_start.py:57
Finding: Session Start Utility Can Overwrite Arbitrary Files Accessible to the Process
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (50)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation states that memory data is 'never uploaded to any server', yet the skill also documents use of a remote Zhipu AI embedding API. Generating embeddings for memory content typically requires sending that content, or a substantial representation of it, to the external provider, so the privacy claim is materially misleading and may cause users to expose sensitive data under false assumptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The automatic memory extraction feature analyzes arbitrary user messages and saves extracted content as memories, yet the docs provide no warning that user inputs may be automatically interpreted, retained, and reused. This is more dangerous than manual storage because developers may enable passive collection by default, causing unnoticed capture of sensitive information and later prompt-context leakage.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The documented rm -rf memory_lancedb/ command is a destructive shell operation that can be copied directly by users. In skill context, this is more dangerous because it is presented as the prescribed way to manage memory deletion, normalizing unsafe command execution and risking irreversible data loss if the working directory or path is wrong.
Content: Scanner excerpt · docs/FAQ.md (reported line 43)May include surrounding context.
Q: 如何删除记忆？

A: 目前不支持直接删除，可以清理整个数据库：

bash
rm -rf memory_lancedb/

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · docs/INSTALL.md (reported line 43)May include surrounding context.
law_lance

text
### 2. 创建虚拟环境 ```bash python3 -m venv venv source venv/bin/activate # Linux/macOS # 或 venv\Scripts\activate # Windows

3. 安装依赖

bash
pip install -r requirements.txt

4. 配置 API Key

获取智谱 AI API Key: https://open.bigmodel.cn/

bash
# 临时设置 export ZHIPU_API_KEY="your-key-here" # 永久设置（添加到 ~/.bashrc） echo 'export ZHIPU_API_KEY="your-key-here"' >> ~/.bashrc source ~/.bashrc

5. 测试安装

bash
python3 skill.py stats

如果显示统计信息，说明安装成功！

启用 Hook

bash
# 方法 1: 使用启用脚本 bash enable.sh # 方法 2: OpenClaw 命令 openclaw hooks enable memory-system

故障排查

Python 版本过低

bash
python3 --version # 需要 3.8+

如果版本过低，请升级 Python。

依赖安装失败

bash
# 升级 pip pip install --upgrade pip # 使用国内镜像 pip install -r requirements.txt -i https://pypi.tun

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · enable.sh (reported line 47)May include surrounding context.
sh
Y" ]; then echo "" echo "⚠️ ZHIPU_API_KEY not set" echo "" echo "Please get your API key from: https://open.bigmodel.cn/" echo "Then add to ~/.bashrc:" echo "" echo " export ZHIPU_API_KEY='your-key-here'" echo "" echo "Or set it now:" read -p "Enter ZHIPU_API_KEY: " api_key if [ -n "$api_key" ]; then export ZHIPU_API_KEY="$api_key" echo "export ZHIPU_API_KEY='$api_key'" >> ~/.bashrc fi fi # Test memory system echo "" echo "🧪 Testing memory system..." if python3 skill.py stats > /dev/null 2>&1; then echo "✅ Memory System is ready!" else echo "❌ Memory system test failed" exit 1 fi echo "" echo "==============================" echo "✅ Setup Complete!" echo "" echo "Next steps:" echo " 1. Set ZHIPU_API_KEY (if not set)" echo " 2. Run: python3 skill.py profile" echo " 3. Add memory: python3 skill.py add --content '...' --type preference" echo ""

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill markets itself as local and privacy-safe while simultaneously requiring a third-party embedding service, without a clear warning that user memory content may leave the local environment. In a memory system, this is especially sensitive because stored content may include personal preferences, tasks, and background facts that users would reasonably expect to remain local.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly describes storing user memories and building system prompts from them, but it does not warn about persistence, sensitivity, consent, retention, or privacy boundaries. In a memory-management skill, this omission can lead integrators to collect and reuse personal data in prompts without informing users, increasing the risk of privacy violations and inappropriate disclosure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The FAQ states that all data remains local and is never uploaded, but elsewhere says embeddings require calling an external API. This is a misleading security/privacy claim that can cause users to expose sensitive memory content under false assumptions about data locality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation recommends a destructive rm -rf memory_lancedb/ command to delete memory data without a prominent warning about irreversible data loss. Users may execute it casually and wipe all stored memories or, depending on context and path confusion, delete unintended data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document describes retrieving user memory from LanceDB and injecting it into agent context at bootstrap without any notice about consent, data minimization, retention, or visibility boundaries. In a memory system, this can expose sensitive prior-user data to prompts, tools, logs, or downstream model providers, making privacy leakage a realistic risk.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · docs/HOOK.md (reported line 83)May include surrounding context.
检查文件

bash
ls -la ~/.openclaw/hooks/memory-system/

应该包含：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guide instructs users to add, auto-extract, export, and clean up persistent memory containing personal preferences, facts, and tasks, but provides no privacy notice, consent guidance, retention expectations, or deletion caveats. In a memory-management skill, this omission can lead to unintended storage or disclosure of sensitive user data and unsafe operational use by integrators.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script presents itself as a routine setup helper, but it also persistently alters the user's shell startup file by appending an API key export to ~/.bashrc. That creates a lasting side effect involving sensitive data storage, and the change is not surfaced as a distinct security-relevant action requiring explicit informed consent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · enable.sh (reported line 18)May include surrounding context.
sh
echo "✅ Python version: $(python3 --version)" # Create virtual environment if not exists if [ ! -d "venv" ]; then echo "📦 Creating virtual environment..." python3 -m venv venv

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The script instructs the user to add the API key to ~/.bashrc, encouraging persistent storage of a sensitive credential across sessions. While common in developer tooling, persisting secrets in shell init files expands exposure and should be treated as a security-sensitive design choice.
Content: Scanner excerpt · enable.sh (reported line 39)May include surrounding context.
sh
echo "⚠️ ZHIPU_API_KEY not set" echo "" echo "Please get your API key from: https://open.bigmodel.cn/" echo "Then add to ~/.bashrc:" echo "" echo " export ZHIPU_API_KEY='your-key-here'" echo ""

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script reads a secret from the terminal and persists it to ~/.bashrc without warning the user that this stores the credential in plaintext on disk. Plaintext secret persistence increases the chance of accidental disclosure through backups, dotfile sync, shell history adjacent handling, local compromise, or overly broad file permissions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This hook explicitly loads long-term user memory from a vector database and injects it into the system prompt during bootstrap, but the description provides no clear user-facing warning or consent language about this sensitive data flow. Because bootstrap occurs before normal workspace context is injected, the memory may influence all subsequent agent behavior and expose personal data more broadly than a user expects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The environment variable description assumes a specific locale and user identity context (Chinese-language text and a default tied to a particular Feishu user ID) without indicating user choice or neutral defaults. This can lead to privacy, misbinding, or deployment errors where memory is fetched for the wrong user or where behavior is implicitly tailored to one language/community without consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The hook launches an external Python process using a shell-constructed command string and feeds it environment-derived inputs, including a user identifier and an API key. In a bootstrap hook this is more dangerous because it runs automatically and can execute attacker-controlled code if the workspace, virtualenv, script path, or environment are tampered with, creating a path to credential exposure or arbitrary code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The hook explicitly passes ZHIPU_API_KEY into a subprocess without disclosure, scoping, or assurance that the called script is trusted. Because this executes during bootstrap and the script lives under workspace-controlled paths, a modified script can exfiltrate the secret or misuse it for external API calls without user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The auto_extract path automatically derives memories from a user message and immediately persists them via save_memories(extracted) with no consent prompt, dry-run mode, or visibility before storage. In a memory system, messages can contain sensitive personal, confidential, or regulated data, so silent persistence increases privacy risk and can store information the user did not intend to retain.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The cleanup command deletes expired memories immediately and returns only a success count, with no confirmation, preview, or safeguard against accidental invocation. While this is primarily an integrity/availability issue rather than a direct exploit path, it can still cause unintended data loss, especially if expiration policies are misconfigured or users do not realize cleanup is destructive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code persists extracted memories automatically once they are identified, with no confirmation, notice, or opt-in from the user. Because the extraction patterns target personal preferences, work details, and tasks, this can silently store sensitive or regulated personal data that the user did not intend to make persistent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The conversation processor iterates through all user messages and automatically extracts and stores statements as persistent memory without sensitivity classification, minimization, or consent. In a memory skill context, this is especially risky because users may reveal personal identity, employment, plans, or other sensitive facts in ordinary conversation, and the system will retain them by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The test harness hard-codes a concrete user identifier, which can leak or normalize use of a real-looking account ID in source, logs, screenshots, or copied test environments. Even if only used in local testing, embedding identifiers in code increases the risk of unintended data access, privacy exposure, and unsafe reuse in production-like contexts.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: hooks/memory-system/handler.js:37

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T02 · Agent Memory Poisoning

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

other

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Intent-Code Divergence

Missing User Warnings

Tool Parameter Abuse

Q: 如何删除记忆？

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

3. 安装依赖

4. 配置 API Key

5. 测试安装

启用 Hook

故障排查

Python 版本过低

依赖安装失败

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

File System Enumeration

检查文件

Missing User Warnings

Intent-Code Divergence

Session Persistence

Session Persistence

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Ssd 3

Intent-Code Divergence

Static analysis

Shell command execution detected (child_process).