Memory Lancedb Pro Skill Main

• Outcome: Review
• Latest audit: May 28, 2026 · 9:03 AM UTC
• Version: 1.0.0

Overview

This appears to be a real memory-plugin setup skill, but it asks for raw API keys in chat and recommends unverified remote code execution while changing persistent OpenClaw configuration.

Review before installing. Do not paste API keys into chat; configure them through environment variables or a local secret manager. Avoid the quick installer and downloaded validation script unless you inspect and pin them first. Back up openclaw.json before changes, confirm any gateway restart, and enable autoCapture or autoRecall only after deciding what data may be stored and how you will delete it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly tells the agent to ask users to paste API keys directly into chat and to collect them before proceeding. That creates an unnecessary secret-handling channel where credentials may be exposed in chat history, agent memory, logs, telemetry, or downstream tooling, which is especially risky for an installation/configuration skill that does not require the agent to possess raw secrets.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The quick-install path instructs users to download and execute a remote shell script via curl and bash. This is dangerous because it grants immediate code execution from mutable network content without integrity verification, review, pinning to a commit hash, or sandboxing.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs downloading and executing an external JavaScript validation script from a remote repository. Even though framed as config validation, it still introduces remote code execution from network-fetched content that is not integrity-checked and exceeds the minimum capability needed for safe configuration guidance.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README advertises a natural-language trigger phrase, "help me enable the best config," that can cause the skill to activate on broad user wording rather than an explicit request to use this specific skill. Because the skill is designed to read local configuration, modify files, and restart services, ambiguous activation increases the risk of unintended high-impact actions being proposed or executed in the wrong context.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The automatic trigger section lists many broad phrases and states that the skill loads automatically when they are mentioned, but it does not define clear activation boundaries or safeguards. In a skill that contains operational guidance for installation, configuration changes, and service restarts, this ambiguity can cause over-triggering, context pollution, or accidental execution of sensitive workflows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The 7-step workflow explicitly includes reading the current openclaw.json, building merged config, applying changes, validating, restarting the gateway, and running smoke tests, but the skill description does not prominently warn users that local configuration will be inspected and modified and services may be restarted. This omission is dangerous because it reduces informed consent around sensitive local actions and can lead to unintended disruption or exposure of local environment details.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill asks users to paste API keys directly but does not warn that chat systems, logs, memory plugins, or support transcripts may retain those secrets. In this context, the omission materially increases the chance of credential leakage and later misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-install instructions use curl piped to bash without any explicit safety warning or trust-boundary explanation. Users may execute arbitrary changed remote code believing it is a routine setup step, which is unsafe for a broadly distributed skill document.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow normalizes temporary disclosure of API keys to the agent as part of setup. That is a direct secret-exposure pattern: the agent, its runtime, or integrated memory/logging systems may capture the credentials, and the step is not necessary when env-var presence or provider-side test flows can be used instead.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This step explicitly suggests asking the user to paste keys temporarily even when they are already set as environment variables. That increases the attack surface for no legitimate benefit and is especially dangerous in a skill for a memory plugin, where secret retention in long-term memory would be particularly harmful.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/full-reference.md:201

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:1356