ClawHub
Back to skill

Security audit

pinecone-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent Pinecone memory tool, but its instructions can upload local memory to Pinecone more broadly than a user may expect and its sensitive-data filtering is limited.

Review exactly which files are under MEMORY.md and memory before running sync or enabling scheduled sync. Do not rely on the built-in redaction for secrets or private notes; use dry-run, separate Pinecone namespaces, a least-privilege API key, and avoid installing a cron or scheduled task unless continuous upload is intended.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
tools/pinecone-memory.mjs:259
Finding

Incomplete Secret Redaction Allows Sensitive Data to Be Uploaded to Pinecone

Content
View full analysis
0) { const index = getIndex(pc, indexName); const ns = getNamespace(index, namespace); const statsBefore = await statIndex(index, namespace); const beforeCount = Number(statsBefore.namespaceRecordCount || 0); const batchSize = 50; for (let i = 0; i < records.length; i += batchSize) { const batch = records.slice(i, i + batchSize); await upsertRecords(ns, batch); } ``` ### Technical Analysis The Skill processes local Markdown memory files and transmits their contents to an external Pinecone index. Its security control consists of three regular expressions that only recognize narrow variations of `api_key`, `token`, and `password` followed by `:` or `=`. This approach does not reliably detect many common sensitive-data formats, including: - PEM private keys and other multiline credentials. - Authorization headers and bearer tokens. - Cloud access keys and secret keys. - Session cookies. - Database and service connection strings. - Credentials represented as JSON, YAML, Markdown tables, or natural-language ...[truncated 2152 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package.json:17
Finding

Unpinned Pinecone Dependency and Missing Lockfile Create Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains all operational instructions in Chinese, which effectively forces a specific language for users. Under the stated policy, language-specific instructions are a violation unless the skill offers user opt-in or clearly documents a justified regional/locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup guide is written entirely in Chinese from the opening description onward, and there is no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because the documentation effectively imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes destructive and remote data-handling operations (cleanup, sync, backup, restore) but does not require an explicit user confirmation or warning before transmitting local memory to Pinecone or deleting namespace contents. In a memory-management context, this can lead to unintended disclosure of sensitive local content to a third-party service or accidental deletion/restoration of data, especially because the workflow text presents these commands as standard operational steps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The query script hardcodes the text 用户偏好, which is Chinese for 'user preferences'. This may indicate a language-specific default in a general-purpose skill package without documented user opt-in or justification, potentially violating language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code builds records from markdown content and writes them to a JSONL backup file on disk, but there is no confirmation prompt or user-facing warning at the write site about creating a potentially sensitive local backup. While the operation is named 'backup', the implementation lacks any runtime disclosure that source content will be persisted to a file path, which is relevant for user data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language description and trigger phrasing are written to operate in Chinese, and the file does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a language/locale policy violation unless explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
0% confidence
Finding

No finding should be reported here because the trigger-related category applies to manifest files, but this package.json does not define ambiguous natural-language activation conditions; it only defines concrete npm script names and commands. The script names like check, sync, query, cleanup, backup, and restore are specific operational labels rather than broad end-user trigger phrases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
0% confidence
Finding

No finding should be reported because the cleanup operation is clearly part of the stated purpose of a CLI package and includes an explicit confirmation flag (--confirm yes). Other potentially impactful operations are likewise semantically aligned with the package purpose as a Pinecone memory CLI.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
78% confidence
Finding

The dependency @pinecone-database/pinecone is specified with a caret range (^5.0.0), allowing newer minor and patch releases to be installed without explicit review. This can introduce supply-chain risk if an upstream release is compromised or contains breaking security-relevant changes, especially since this skill performs read, write, cleanup, backup, and restore operations against a memory index.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json
"restore": "node tools/pinecone-memory.mjs restore --input backup/pinecone-memory-backup.jsonl --index openclaw-memory --namespace default --verify-write true"
  },
  "dependencies": {
    "@pinecone-database/pinecone": "^5.0.0"
  }
}

Static analysis

No suspicious patterns detected.