Local Memory Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:34 AM UTC
• Version: 1.0.0

Overview

This looks like a real local memory search skill, but it under-discloses how much private memory data it reads, stores, and sends to a local embedding service.

Review this before installing if your OpenClaw memory or knowledge files may contain secrets, credentials, private notes, or sensitive work data. Running --build creates a persistent plaintext index under ~/.openclaw and processes memory content through a local Ollama component despite the documentation claiming TF-IDF and no external dependencies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: search.py:111
• Finding: Plaintext Duplication of Sensitive OpenClaw Memory Content<![CDATA[ ## Vulnerability Details **File Location**: `search.py:16-22`, `search.py:36-38`, `search.py:111-127` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code ```python WORKSPACE = os.path.expanduser("~/.openclaw/workspace") MEMORY_PATHS = [ f"{WORKSPACE}/MEMORY.md", f"{WORKSPACE}/memory/*.md", f"{WORKSPACE}/knowledge/**/*.md", ] INDEX_PATH = os.path.expanduser("~/.openclaw/memory_index.json") ``` ```python try: with open(filepath, 'r', encoding='utf-8') as f: content = f.read() except: return [] ``` ```python index = [] for i, chunk in enumerate(all_chunks): try: embedding = get_embedding(chunk['text'][:1000]) # 限制长度 index.append({ 'text': chunk['text'], 'file': chunk['file'], 'start_line': chunk['start_line'], 'end_line': chunk['end_line'], 'embedding': embedding }) if (i + 1) % 10 == 0: print(f"已处理 {i + 1}/{len(all_chunks)}") except Exception as e: print(f"跳过块 {i}: {e}") with open(INDEX_PATH, 'w') as f: json.dump(index, f) ``` ### Technical Analysis The index builder recursively collects OpenClaw memory and knowledge files, reads their complete contents, and stores each plaintext chunk in `~/.openclaw/memory_index.json`. The index therefore duplicates potentially sensitive material rather than storing only embeddings and minimal source references. The file is created using Python's default permissions as constrained by the current process umask. The implementation does not explicitly require restrictive mode `0600`, encrypt the stored content, enforce an allowlist, or remove entries when source files are deleted or changed. Consequently, rebuilding the index creates a consolidated data repository that can remain readable to other local principals depending on system permissions. The recursively indexed `knowledge/**/*.md` scope is also broader th ...[truncated 1225 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store source plaintext in the index. Store only embeddings, a stable document identifier, line ranges, and the minimum metadata required for retrieval. 2. Read the source snippet on demand after confirming that the current caller is authorized to access the source file. 3. Create the index with explicit owner-only permissions, such as mode `0600`, rather than relying on the ambient umask. 4. Write the index atomically through a securely created temporary file in the destination directory, apply restrictive permissions, and then replace the previous index. 5. Allow users to configure explicit path allowlists and exclusions. Clearly document that `knowledge/**/*.md` is recursively indexed. 6. Remove stale records when files are deleted or changed, and provide a command to securely remove the entire index. 7. Avoid storing absolute paths unless they are necessary; use validated workspace-relative paths instead. 8. Warn users that memory files may contain secrets and recommend excluding credentials or other high-sensitivity data from indexing. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: search.py:70
• Finding: Undisclosed Ollama Dependency and Sensitive Data Processing<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-15`, `SKILL.md:20-22`, `SKILL.md:29-33`, `search.py:24`, `search.py:70-91` **Vulnerability Type**: Security-relevant documentation and implementation mismatch **Risk Level**: Low ### Vulnerable Code and Documentation The documentation states: ```markdown ## Features - Searches MEMORY.md and memory/*.md - TF-IDF based semantic matching - Zero external dependencies - Fast local execution - Returns top snippets with file path and line numbers ## How It Works 1. Builds inverted index of all memory files 2. Uses TF-IDF scoring for relevance 3. Returns ranked results with context ## Requirements - Python 3.8+ - No pip packages needed (uses stdlib only) ``` The implementation instead uses an Ollama embedding model: ```python EMBEDDING_MODEL = "nomic-embed-text" ``` ```python def get_embedding(text): """通过 ollama CLI 获取 embedding""" result = subprocess.run( ['ollama', 'embed', EMBEDDING_MODEL, text], capture_output=True, text=True ) if result.returncode != 0: # 备用方案：用 API import urllib.request import json as json_lib data = json_lib.dumps({"model": EMBEDDING_MODEL, "input": text}).encode() req = urllib.request.Request( "http://localhost:11434/api/embed", data=data, headers={"Content-Type": "application/json"} ) with urllib.request.urlopen(req) as resp: result = json_lib.loads(resp.read()) return result['embeddings'][0] return json.loads(result.stdout)['embeddings'][0] ``` ### Technical Analysis The implementation does not use TF-IDF or an inverted index. It invokes the external `ollama` executable with the `nomic-embed-text` model and, if that command fails, sends the input to an Ollama-compatible HTTP endpoint at `http://localhost:11434/api/embed`. During index construction, the input consists of content taken from OpenClaw memory and kno ...[truncated 1841 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Either implement the documented standard-library TF-IDF algorithm or update `SKILL.md` to disclose the Ollama dependency, model requirement, HTTP fallback, and exact data flow. 2. Require explicit user consent before sending memory contents or search queries to an embedding executable or service. 3. Resolve the Ollama executable through a trusted configured path where appropriate, and document the trust assumptions for the local service. 4. Add a finite HTTP timeout and validate response status, content type, response size, JSON structure, embedding type, and embedding dimensions. 5. Provide a configuration option to disable the HTTP fallback and fail closed when the executable is unavailable. 6. Make the embedding endpoint configurable only through validated settings, and warn users against configuring an untrusted or remote endpoint. 7. Add automated tests ensuring that documented indexing behavior, dependencies, and indexed path scope remain consistent with the implementation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_embedding(text):
    """通过 ollama CLI 获取 embedding"""
    result = subprocess.run(
        ['ollama', 'embed', EMBEDDING_MODEL, text],
        capture_output=True, text=True
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Internal Network Request

Medium

• Category: Server-Side Request Forgery

Content

import urllib.request
        import json as json_lib
        data = json_lib.dumps({"model": EMBEDDING_MODEL, "input": text}).encode()
        req = urllib.request.Request(
            "http://localhost:11434/api/embed",
            data=data,
            headers={"Content-Type": "application/json"}

• Confidence: 70% confidence
• Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: During index building, the script sends memory file contents to the Ollama embedding backend without an explicit consent prompt or clear disclosure at the point of transmission. In a memory-search skill, those files may contain sensitive notes, secrets, or personal data, so silent transmission to a local service can violate user expectations and widen exposure if the service is remote-bound, logged, or shared.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: Docstrings, usage text, and runtime messages are presented in Chinese only, and the skill provides no language selection or opt-in mechanism. This can violate language/locale policy where tools must not force a specific language without user choice or clear justification.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The search query is sent to the embedding service without explicit notice. While lower risk than bulk memory indexing, queries can still contain sensitive information, so undisclosed transmission creates a privacy issue.

Static analysis

No suspicious patterns detected.