T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:35- Finding
Documented Pipe-to-Shell Installation Executes Mutable Remote Code
- Content
View full analysis
- Remediation
View remediation
Security audit
vector-memory
Security checks for vulnerabilities and agentic risk
Overview
This memory-search skill is mostly purpose-aligned, but it contains unsafe command execution and file-reading flaws that could expose local files or run unintended commands.
Review before installing. The local semantic-memory goal is understandable, but install only from a trusted, pinned source; avoid the curl | bash path; and fix or wait for fixes to command execution and file path containment before using it on a workspace with secrets or sensitive files.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
vector-memory/smart_memory.js:95- Finding
Shell Command Injection Through Interpolated Tool Arguments
- Content
View full analysis
- Remediation
View remediation
100) { throw new TypeError('Invalid maxResults'); } const result = execFileSync( process.execPath, [ path.join(WORKSPACE, 'vector-memory', 'vector_memory_local.js'), '--search', String(query), '--max-results', String(limit) ], { cwd: WORKSPACE, encoding: 'utf-8', timeout: 30000 } ); ``` - Prefer direct JavaScript imports over starting a subprocess. - Configure tool bindings to pass structured arguments rather than constructing shell commands. - Validate `max_results`, line numbers, and all other numeric parameters against strict bounds. - Treat framework-level escaping as defense in depth rather than the primary control. - Add automated tests using quotes, backticks, `$()`, semicolons, newlines, and other shell metacharacters. ]]>
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
vector-memory/smart_memory.js:148- Finding
Memory Retrieval Permits Workspace Escape and Arbitrary File Disclosure
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:39- Finding
Installer Retrieves Unpinned Source and Executes an Unlocked Dependency Installation
- Content
View full analysis
/dev/null; then # Git available - clone cd /tmp rm -rf vector-memory-temp 2>/dev/null || true git clone --depth 1 "$REPO_URL.git" vector-memory-temp # Copy files cp -r vector-memory-temp/skills/vector-memory "$WORKSPACE/skills/" cp -r vector-memory-temp/vector-memory "$WORKSPACE/" rm -rf vector-memory-temp else # No git - download tarball cd /tmp curl -L "$REPO_URL/archive/main.tar.gz" | tar xz cp -r vector-memory-openclaw-main/skills/vector-memory "$WORKSPACE/skills/" cp -r vector-memory-openclaw-main/vector-memory "$WORKSPACE/" rm -rf vector-memory-openclaw-main fi echo "✅ Files installed" echo "" # Install dependencies echo "📦 Installing dependencies..." cd "$WORKSPACE/vector-memory" npm install --silent ``` The package uses a version range and the project contains no lockfile: ```json "dependencies": { "@xenova/transformers": "^2.17.2" } ``` ### Technical Analysis The installer clones or downloads the mutable `main` branch without pinning a commit and without verifying a checksum or signature. It then runs `npm install --silent` on the downloaded package. No package lockfile is included, and the dependency is specified with a caret range. Consequently, installations performed at different times may resolve different transitive dependency trees. NPM installation may also execute dependency lifecycle scripts unless explicitly disabled. The fallback archive is streamed directly into `tar`, so the archive is neither retained for inspection nor verified before extraction. These design choices allo ...[truncated 1049 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
vector-memory/vector_memory_local.js:21- Finding
Embedding Model Is Downloaded at Runtime Without Project-Level Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (40)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashconstruct creates an immediate execution chain from downloaded content to the shell, eliminating any opportunity for inspection and amplifying the impact of repository or transport compromise. Because this is an installation path for a developer-facing skill, it directly normalizes unsafe command execution and can lead to full local code execution.- Content
From GitHub
bash curl -sL https://raw.githubusercontent.com/YOUR_USERNAME/vector-memory-openclaw/main/install.sh | bashManual
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Claiming 'works immediately' and 'no setup required' while requiring explicit sync/indexing and possible model download/cache setup is a material behavior mismatch. In the context of an installable skill that can run shell commands, this can cause users to trigger unexpected setup, downloads, or state changes they did not knowingly approve.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Claiming 'works immediately' and 'no setup required' while requiring explicit sync/indexing and possible model download/cache setup is a material behavior mismatch. In the context of an installable skill that can run shell commands, this can cause users to trigger unexpected setup, downloads, or state changes they did not knowingly approve.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Claiming 'works immediately' and 'no setup required' while requiring explicit sync/indexing and possible model download/cache setup is a material behavior mismatch. In the context of an installable skill that can run shell commands, this can cause users to trigger unexpected setup, downloads, or state changes they did not knowingly approve.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node vector-memory/smart_memory.js --sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node vector-memory/smart_memory.js --sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node vector-memory/smart_memory.js --sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node vector-memory/smart_memory.js --sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node vector-memory/smart_memory.js --sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `memory.js` | OpenClaw wrapper |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The explicit '| bash' chaining removes any review boundary between untrusted network content and code execution, making compromise of the hosting source immediately exploitable. In the context of a skill installer that later clones a repo and runs npm install, this pattern is especially dangerous because it compounds trust in multiple remote execution stages.
- Content
sh #!/bin/bash # One-line installer for Vector Memory # Usage: curl -sL https://raw.githubusercontent.com/YOUR_USERNAME/vector-memory-openclaw/main/install.sh | bash set -e
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashpipeline is a classic unsafe command-chaining pattern because it turns downloaded text directly into shell commands without any review or verification step. In a README for a developer tool, this materially increases danger since installation is a high-trust moment and users may execute the command verbatim, enabling immediate arbitrary command execution.- Content
From GitHub
bash curl -sL https://raw.githubusercontent.com/YOUR_USERNAME/vector-memory-openclaw/main/install.sh | bashManual
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README instructs users to execute a remote installer directly with
curl ... | bashand provides no warning or verification steps. This is dangerous because any compromise of the GitHub account, repository, branch, or network path can result in arbitrary shell command execution on the user's machine.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill advertises commands that invoke shell execution and rely on environment variables, but the manifest does not declare any tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it easier for an installer or agent runtime to grant broader execution capability than users expect.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
Using
npx clawhub install vector-memorywithout a pinned version permits installation of whatever version is current at execution time. This creates a supply-chain risk where a compromised or malicious updated package could be fetched and executed unexpectedly.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest describes a memory-search skill that works immediately and focuses on semantic/vector fallback behavior, but this installer also fetches code from GitHub and runs npm dependency installation. While expected for installation machinery, these operations materially exceed the behavior implied by the manifest description of the skill itself and 'no setup required'.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script deletes the /tmp/vector-memory-temp directory via rm -rf, but the only surrounding user-facing messages describe downloading and installation rather than removal of files. Although temporary cleanup is common, this is still a destructive filesystem action with no explicit disclosure of the deletion step.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
The README instructs users to run
npx clawhub install vector-memorywithout pinning a specific package version. This can lead to non-reproducible installs and increases supply-chain risk if a later compromised or malicious version of the package is published and then implicitly trusted by users.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README tells users to fetch a remote script and pipe it directly into
bash, which executes unreviewed network content immediately on the local system. This is dangerous because any compromise of the GitHub account, repository, branch, or network path can turn installation into arbitrary code execution with the user's privileges.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This is a manifest file, so vague-trigger checks apply. The description and tool text emphasize broad phrases like 'Zero configuration - works immediately after install' and 'natural language, concepts, or keywords' but do not define when this skill should or should not be invoked, which can cause unintended activation overlap with general memory or search requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest says the skill 'falls back to built-in search otherwise' and that 'memory_search works immediately,' but memorySearch only invokes the vector backend and, on failure, logs an error and returns an empty array. There is no built-in search fallback path in this file, so the described behavior is not implemented here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
memoryGet joins a user-controlled filePath with the workspace root but does not normalize and verify that the resolved path remains inside WORKSPACE. An attacker can supply traversal sequences such as ../ to read arbitrary files accessible to the process, which is especially dangerous in a memory/search skill because callers are expected to provide file paths and may expose configuration, secrets, or other sensitive host data.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The package description says "100% local vector memory using transformers.js embeddings" and the entrypoint name reinforces a local-only implementation. This conflicts with the skill manifest, which describes "automatic vector fallback" and immediate operation via built-in search when embeddings are unavailable, indicating broader behavior than the package documentation states.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- vector-memory/memory.js:23
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- vector-memory/smart_memory.js:97
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- vector-memory/references/pgvector.md:28