ClawHub
Back to skill

Security audit

Bm25 Rerank Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory-search skill has a coherent purpose, but it directs broad local memory retrieval through an external API and an unreviewed local script without enough controls or disclosure.

Review this before installing if your memory files may contain private conversations, credentials, business data, or internal instructions. Use it only if you trust the external SiliconFlow processing path and the local /opt/memory/bm25_rerank_search.py script, and prefer an isolated environment with pinned dependencies and explicit limits on which memory files can be indexed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:3
Finding

Sensitive memory may be processed by an unverifiable external service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3-31
Vulnerability Type: External processing of sensitive agent memory without documented safeguards
Risk Level: Medium

Evidence

The skill states that it searches Markdown memory files under /root/workspace/Remember, invokes a script outside the reviewed project, and uses the SiliconFlow API for vector embedding and reranking:

text
Search Markdown memory files under /root/workspace/Remember.
Invoke the local retrieval script /opt/memory/bm25_rerank_search.py.
Vector and reranking service: SiliconFlow API

The documented commands are:

bash
python3 /opt/memory/bm25_rerank_search.py search <query>
python3 /opt/memory/bm25_rerank_search.py reindex

The documented retrieval process is:

text
1. BM25 keyword matching produces candidate set A.
2. BGE-M3 vector similarity produces candidate set B.
3. Candidate sets A and B are merged.
4. BGE-Reranker-v2-m3 reranks the merged results.

Technical Analysis

The skill is designed to read memory from a root-owned workspace and depends on an external API for embedding and reranking. Memory files can contain conversation history, credentials, personal information, internal instructions, or operational secrets.

The implementation at /opt/memory/bm25_rerank_search.py is outside the reviewed project and was not available for inspection. Consequently, the audit cannot verify:

  • Which memory content is transmitted to SiliconFlow.
  • Whether secrets or personal data are redacted.
  • Whether requests are limited to approved endpoints.
  • Whether transport and certificate validation are securely configured.
  • Whether queries, document fragments, embeddings, or reranking candidates are retained externally.
  • Whether reindexing sends the entire memory corpus to the service.

Accessing /root/workspace/Remember also creates a broad privilege boundary. The document ...[truncated 1714 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include /opt/memory/bm25_rerank_search.py in the reviewed package or provide a reproducibly pinned source reference so its file access and network behavior can be audited.
  2. Restrict retrieval to an explicit allowlist of approved files and reject path traversal, symbolic-link escapes, and access outside the configured memory directory.
  3. Run the script as a dedicated unprivileged account rather than relying on broad access to a root-owned workspace.
  4. Use local embedding and reranking models when memory may contain sensitive information.
  5. If an external service is required, obtain explicit user consent and document the endpoint, transmitted fields, retention policy, and data-processing boundary.
  6. Redact credentials, tokens, personal data, and other secrets before any network request.
  7. Minimize transmitted content and avoid sending complete documents when short, sanitized fragments or local embeddings are sufficient.
  8. Enforce HTTPS certificate validation, an endpoint allowlist, request-size limits, timeouts, and auditable network logging.
  9. Separate reindexing from external processing and ensure that reindexing cannot upload the entire memory corpus without explicit authorization.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned system-wide Python package installation bypasses environment safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-13
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

Evidence

The dependency installation instruction is:

bash
pip install rank-bm25 --break-system-packages

No package version, artifact hash, lock file, or trusted package index is specified.

Technical Analysis

Installing an unpinned package causes the resolved artifact and transitive dependency graph to vary over time. If the package repository, maintainer account, release process, or dependency chain is compromised, following this instruction could install attacker-controlled code.

Python package installation can execute build backends or setup logic with the privileges of the invoking user. The --break-system-packages option bypasses protections intended to prevent pip from modifying an externally managed system Python environment. This can overwrite or conflict with operating-system-managed packages and may affect other applications using the same interpreter.

There is no evidence that rank-bm25 is malicious. The vulnerability is the unsafe installation practice: mutable dependency resolution combined with explicit circumvention of system package-management safeguards.

Attack Path

  1. A user follows the setup instruction.
  2. Pip resolves the current rank-bm25 release and any required dependencies from its configured index.
  3. A compromised or unexpectedly modified package artifact is downloaded.
  4. Package build or installation logic executes with the invoking user's privileges.
  5. Because system-environment protections are bypassed, packages in the system Python environment may be installed, replaced, or made incompatible.
  6. Applications sharing that interpreter may subsequently import the altered components.

Impact Assessment

Successful supply-chain exploitation could execute code with the privileges of the user running ...[truncated 345 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --break-system-packages from the installation instructions.
  2. Install dependencies in a dedicated virtual environment, container, or other isolated runtime.
  3. Pin rank-bm25 and every transitive dependency to reviewed versions.
  4. Use a lock file with cryptographic hashes and require hash verification during installation.
  5. Configure an explicit trusted package index rather than relying on ambient pip configuration.
  6. Build and verify dependency artifacts in a controlled environment before deployment.
  7. Run installation and runtime processes as an unprivileged user.
  8. Add automated dependency vulnerability scanning and a controlled process for reviewing upgrades.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly depends on SiliconFlow API for embeddings and reranking, which means user queries and potentially retrieved memory content may be transmitted to an external service. Because the skill description does not warn users about this data flow, operators may unknowingly expose sensitive local memory data outside the host boundary, creating a confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language content of the skill description and usage instructions is written in Chinese, but there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a specific language is imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.