Security audit

Knowledge Management

Security checks for vulnerabilities and agentic risk

Overview

This skill organizes local memory files, but it needs review because indexing can execute JavaScript from markdown metadata and cleanup can permanently delete local knowledge files.

Install only after reviewing the code or using it in a dedicated test workspace. Avoid `km summarize` on folders containing markdown you did not create or trust, and avoid `km cleanup` or scheduled cleanup until deletion is replaced with a recoverable archive/quarantine or requires explicit confirmation after a dry-run review.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: index-local.js:571
Finding: Arbitrary JavaScript Execution Through Unsafe Frontmatter Parsing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index-local.js:473
Finding: Destructive Cleanup Deletes Legitimate Files When State Is Missing or Corrupt
Content: View full analysis
f.endsWith('.md')); for (const f of files) { allFiles.add(path.join(folder, f)); } } } // Files tracked in state const trackedFiles = new Set(Object.values(this.state)); // Orphans = files on disk not in state const orphanFiles = [...allFiles].filter(f => !trackedFiles.has(f)); info(`Found ${allFiles.size} knowledge files on disk`); info(`State tracks ${trackedFiles.size} files`); info(`Found ${orphanFiles.length} orphan files to archive`); if (dryRun) { info('DRY-RUN: would delete these files:'); for (const f of orphanFiles) info(` - ${f}`); return; } for (const f of orphanFiles) { try { fs.unlinkSync(f); this.logAction('ARCHIVED_ORPHAN', `deleted ${f}`); } catch (e) { error(`Error deleting ${f}: ${e}`); this.logAction('ARCHIVE_ERROR', `file ${f}: ${e.message}`); } } } ``` ### Technical Analysis State-loading errors are handled by returning an empty object. The cleanup algorithm treats every Markdown file not represented in that object as an orphan and permanently removes it with `fs.unlinkSync`. Consequently, an absent, malformed, truncated, unreadable, or incompatible ...[truncated 1904 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: index-local.js:462
Finding: Dry-Run Mode Performs Undocumented Filesystem Writes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cron examples automate km sync --days_back 7 --cleanup, causing recurring unattended deletion based on sync-state logic. If the state file becomes stale, corrupted, or parsing/classification changes, legitimate files could be repeatedly deleted without user review, making the impact higher than one-off manual cleanup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description frames the skill as simple organization/classification, but the documented behavior includes deletion, persistent state/log creation, index generation, and processing of additional files. This mismatch can mislead users into granting trust to a skill that performs materially broader and more destructive local actions than its summary suggests.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
md
Customize by editing the `EntryClassifier` class in `index-local.js`.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation and log language say orphan files will be 'archived', but the implementation uses fs.unlinkSync() to permanently delete them. This mismatch is dangerous because users may invoke cleanup expecting reversible behavior and instead lose data irreversibly.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
No API keys needed! Just ensure your workspace structure exists:

bash
mkdir -p ~/.openclaw/workspace/{Research,Decision,Insight,Lesson,Pattern,Project,Reference,Tutorial}

The skill will create folders automatically if missing.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README documents a --cleanup mode that deletes files deemed orphaned, but it does not clearly emphasize that deletion may be permanent or that misclassification/state corruption could remove legitimate data. In a knowledge-management skill that operates on a user's local workspace, destructive operations are security-relevant because users may run them routinely without understanding recovery implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example shows km cleanup directly after km cleanup --dry_run, but does not include a caution that the non-dry-run variant will delete files from the local knowledge base. Documentation that normalizes a destructive command without warning increases the chance of accidental data loss, especially for users copying commands verbatim.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents use of the OPENCLAWORKSPACE environment variable and therefore depends on ambient environment-derived behavior, but it does not declare any explicit tool scope or permission boundary. That makes file selection and write targets less transparent to users and reviewers, increasing the risk of unintended access to local data when the environment is manipulated or misunderstood.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill exposes a cleanup feature that removes orphaned files, but the warning language is weak relative to the destructive effect. Users may invoke cleanup assuming it is harmless maintenance, when incorrect state or path resolution could cause irreversible deletion of local files in the managed output tree.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

--output-dir <path> CLI argument (relative to workspace or absolute)

Default: <workspace>/memory/KM

The skill will create the output directory and all content-type folders automatically.

If you want to pre-create:

bash

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's stated purpose is organization and classification, but it also performs destructive file deletion in cleanupOrphans(). It scans type folders and unlinks any markdown file not present in its state file, which can remove legitimate knowledge files if state is missing, corrupted, stale, or output paths are misconfigured.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Cleanup mode deletes orphaned markdown files immediately without a strong user-facing warning or confirmation at the point of deletion. In this skill's context, users are managing local knowledge stores, so silent permanent deletion increases the risk of accidental data loss from normal use, especially when state tracking is incomplete.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The documentation states that the skill automatically creates directories and writes organized files, but it does not foreground that local filesystem contents will be modified. While expected for this skill type, the lack of a prominent safety notice can still surprise users and lead to unintended changes in sensitive workspaces.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The cron integration example specifies --tz "Asia/Singapore", which imposes a locale-specific setting in natural-language guidance. The documentation does not indicate that users should choose their own timezone or that this locale is required for a region-specific use case.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: index-local.js:584