T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:408- Finding
Unverified Remote Setup Script Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Lancedb Pro Skill Main
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its memory-plugin purpose, but it asks users to expose API keys and runs unverified remote setup code, so it needs careful review before installation.
Install only after reviewing or replacing the remote installer and validator steps with pinned, verified artifacts. Do not paste API keys into chat or store literal keys in openclaw.json; use environment variables or a secret manager, and consider disabling autoCapture while configuring credentials.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:733- Finding
Unverified Remote JavaScript Validator Execution
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:428- Finding
Mutable and Unpinned Plugin Installation Sources
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:72- Finding
Plaintext API Credentials Requested Through Agent Context and Persistent Configuration
- Content
View full analysis
" ``` The configuration instructions permit literal persistence: ```text Substitute actual API keys inline if the user provided them directly; keep `${ENV_VAR}` syntax if they confirmed env vars are set in the gateway process. ``` ### Technical Analysis The Skill explicitly asks users to paste API credentials into the agent conversation. It then permits those credentials to be embedded directly in persistent OpenClaw configuration. Secrets introduced through a conversation can be retained in chat history, agent context, logs, telemetry, or automatic memory capture. The Skill recommends enabling `autoCapture`, which increases the risk that credential-bearing setup conversations will be processed or stored. Literal keys written to `openclaw.json` may also be exposed through backups, support bundles, file reads, configuration display commands, or overly permissive filesystem permissions. Placing bearer tokens directly into command invocations can expose them through shell history or process inspection, depending on how the command is run. The verifi ...[truncated 1463 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (52)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill tells the agent to substitute actual API keys inline in configuration when provided directly. That risks writing secrets into persistent config files, emitting them back in responses, and leaking them through version control, backups, or system diagnostics.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill recommends downloading and immediately executing a remote shell script via
curl ... | bash/download-then-run workflow from GitHub. This bypasses review of the installer contents, creates a supply-chain execution path, and is broader than merely documenting plugin setup because it instructs the agent to run arbitrary remote code on the user's machine.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 3. **Env vars in gateway process**: `${OPENAI_API_KEY}` requires env vars set in the *OpenClaw Gateway service* process—not just your shell. 4. **Absolute vs. relative paths**: For existing deployments, always use absolute paths in `plugins.load.paths`. 5. **`baseURL` not `baseUrl`**: The embedding (and llm) config field is `baseURL` (capital URL), NOT `baseUrl`. Using the wrong casing causes a schema validation error: "must NOT have additional properties". Also note the required `/v1` suffix: `http://localhost:11434/v1`, not `http://localhost:11434`. Do not confuse with `agents.defaults.memorySearch.remote.baseUrl` which uses a different casing. 6. **jiti cache invalidation**: After modifying `.ts` files under plugins, run `rm -rf /tmp/jiti/` BEFORE `openclaw gateway restart`. 7. **Unknown plugin id = error**: OpenClaw treats unknown ids in `entries`, `allow`, `deny`, or `slots` as validation errors. The plugin id must be discoverable before referencing it. 8. **Separate LLM config**: If embedding and LLM use different providers, configure the `llm` section separately — it falls back to embedding key/URL otherwise. 9. **Scope isolation**: Multi-scope requires explicit `scopes.agentAccess` mapping — without it, agents only see `global` scope.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md - `log` (optional): Diagnostic callback ### API Integration Details - System prompt: "You are a memory extraction assistant. Always respond with valid JSON only." - Temperature: 0.1 (low randomness for deterministic extraction) - Response parsing: Markdown fence extraction → balanced brace matching - Error recovery: Network/empty/invalid JSON → logging + null return (graceful degradation)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises the trigger phrase "help me enable the best config," which overlaps with common user phrasing and is not uniquely tied to this specific skill or product. Because the file also presents it as a direct invocation example, this could cause accidental activation in unrelated configuration conversations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automatic trigger list includes ambiguous aliases such as 'memory pro' and 'lancedb pro' that are not tightly scoped to this specific skill. In an agent environment, overly broad triggers can cause unintended skill loading, injecting irrelevant or risky instructions into unrelated tasks and increasing the chance of mis-execution or prompt-surface expansion.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow explicitly asks users to paste API keys directly into the conversation for verification. That encourages secret disclosure into chat transcripts, agent memory, logs, telemetry, and downstream generated config, increasing the chance of credential leakage well beyond what is needed for configuration guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Collecting API keys through the conversation channel without an explicit safety warning or safer alternative is insecure handling of secrets. In this context, the skill not only omits a warning but normalizes direct credential sharing with the agent, which materially increases exposure risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions direct the agent to collect pasted API keys and potentially handle them during setup, which can expose secrets in conversation history, tool traces, screenshots, or generated files. Because this is an agent skill for automation, the context makes the secret-handling risk more acute than ordinary documentation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Plan A / Plan B — Jina embedding check:
bash curl -s -o /dev/null -w "%{http_code}" \ https://api.jina.ai/v1/embeddings \ -H "Authorization: Bearer <JINA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"model":"jina-embeddings-v5-text-small","input":["test"]}'
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- references/full-reference.md:201
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- SKILL.md:1356