Inkwell

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:38 AM UTC
• Version: 1.0.0

Overview

This is a coherent memory bootstrap skill, but it pushes users toward persistent transcript/session indexing, scheduled memory-writing jobs, and risky third-party install commands.

Review this skill before installing if you handle sensitive conversations or credentials. Prefer running only the local bootstrap first, avoid storing secrets in MEMORY.md or templates, keep transcripts opt-in with a retention limit, make consolidation produce reviewable drafts, use private delivery channels only, and replace the QMD install steps with pinned and verified installation methods.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/qmd-setup.md:35

Finding

Mutable Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: references/qmd-setup.md, lines 35–40
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code

powershell

# Install WSL2 if not already installed
wsl --install

# Inside WSL2:
curl -fsSL https://bun.sh/install | bash
bun install -g @tobilu/qmd

Technical Analysis

The response from https://bun.sh/install is passed directly to Bash without first saving, inspecting, pinning, or cryptographically verifying the downloaded content. TLS protects the connection in transit but does not establish that the returned script is immutable or that future responses match the version reviewed during this audit.

The effective payload can change after publication of the Skill. Compromise of the remote service, its deployment pipeline, DNS resolution, or the applicable TLS trust chain could consequently result in arbitrary shell commands being executed.

This behavior is not necessary for the Skill's core directory-bootstrap functionality. A local knowledge repository can be created without remote code execution. Even where QMD is desired, a verified and version-pinned installation method would provide a lower-risk alternative.

Attack Path

1. A user follows the documented Windows/WSL2 installation instructions.
2. The remote installer endpoint or its delivery chain is compromised or begins returning modified content.
3. curl retrieves the modified script.
4. The shell executes the response immediately because it is connected directly to bash.
5. The payload executes with all permissions available to the invoking user and may modify user files, shell startup configuration, installed binaries, or accessible application data.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the user running the command. The payload could read or alter the OpenClaw workspa ...[truncated 211 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash installation pattern.
• Pin Bun to a specifically audited release.
• Download the release artifact to a local file before execution.
• Verify a publisher signature or a SHA-256 digest obtained through an independently trusted channel.
• Permit the user to inspect the downloaded installer before running it.
• Prefer an operating-system package manager or another installation mechanism with package-signature validation.
• Run the installer as an unprivileged user and document the files and shell configuration it is expected to modify.
• Provide a QMD-free configuration using OpenClaw's built-in search when semantic search is not required.

T08 · Insecure Dependencies

Error

• Location: references/qmd-setup.md:17

Finding

QMD Is Installed Globally from an Unpinned Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: references/qmd-setup.md, lines 17–20; repeated at lines 39–40
Vulnerability Type: Unpinned global dependency installation
Risk Level: High

Vulnerable Code

bash

bun install -g @tobilu/qmd

bash

# Inside WSL2:
curl -fsSL https://bun.sh/install | bash
bun install -g @tobilu/qmd

Technical Analysis

The installation command does not specify an exact QMD version, lockfile, package-integrity digest, or reproducible dependency set. It therefore installs whichever release and transitive dependencies the package registry resolves at installation time.

Global installation expands the affected scope beyond the Skill directory and places the executable in the user's general command environment. Package lifecycle scripts or malicious runtime code could execute during installation or later when QMD is invoked. This is especially sensitive because the configured process is intended to index long-term memory, workspace knowledge, and session transcripts.

The audit did not establish that @tobilu/qmd is itself malicious. The vulnerability is the unsafe, mutable dependency installation procedure and the resulting supply-chain exposure.

Attack Path

1. An attacker compromises the QMD package, its publisher account, a transitive dependency, or the applicable package-registry delivery path.
2. A malicious release becomes the version resolved by the unpinned installation command.
3. The user runs bun install -g @tobilu/qmd.
4. Malicious package lifecycle code may execute during installation, or malicious application code executes when the gateway starts QMD.
5. The compromised process reads, modifies, or discloses content available through the user's account, including indexed memory and transcripts.

Impact Assessment

Exploitation can result in arbitrary code execution under the installing or runtime user. The compromised dependency may gain ac ...[truncated 255 chars]

Remediation

View remediation

Remediation Suggestions

• Pin QMD to an exact, audited version rather than resolving the latest release.
• Record and verify the package integrity digest.
• Use a committed lockfile to pin transitive dependencies.
• Install the dependency in an isolated project directory or dedicated service account rather than globally.
• Disable package lifecycle scripts where compatible with the package.
• Document the expected publisher, registry, version, and digest.
• Review package changes before updating the pinned version.
• Restrict the QMD process to only the directories that must be indexed and avoid exposing unrelated environment variables.
• Offer the built-in SQLite search backend as the default, with QMD as an explicit opt-in.

T02 · Agent Memory Poisoning

Error

• Location: references/consolidation.md:15

Finding

Untrusted Session Content Can Be Promoted into Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: references/consolidation.md, lines 15–36
Vulnerability Type: Persistent memory poisoning through automated transcript consolidation
Risk Level: High

Vulnerable Code

bash

openclaw cron add \
  --schedule "0 20 * * *" \
  --model "anthropic/claude-sonnet-4-20250514" \
  --channel "<your-channel>" \
  --prompt "$(cat <<'EOF'
Daily consolidation: Review all sessions from today and extract knowledge.

1. Read memory/YYYY-MM-DD.md (today's date) to see what's already captured.
2. Review recent session activity for anything not yet captured.
3. For each significant item found:
   - Decisions made → update relevant file in life/ or create a new ADR in life/resources/decisions/
   - Lessons learned → update MEMORY.md under "Lessons Learned"
   - Project updates → update the relevant file in life/projects/
   - Action items → add to MEMORY.md under "Open Items"
   - New knowledge → create or update files in life/resources/
4. Update today's daily note (memory/YYYY-MM-DD.md) with a consolidation summary.
5. Report what was updated in a brief summary message.

Be concise. Only extract genuinely useful knowledge — skip routine chatter.
EOF
)"

The intended transcript access is also explicitly described at lines 120–124:

markdown

- **Session coverage**: The cron job has access to session transcripts if QMD session indexing is enabled. Without it, it relies on daily notes and file changes.

Technical Analysis

The scheduled agent is instructed to review session activity and write selected content into MEMORY.md and other persistent knowledge files. The workflow does not define a trust boundary between user-authorized facts and instructions embedded in untrusted session content.

It also provides no source labeling, prompt-injection filtering, approval stage, schema validation, or rule preventing transcript text from being ...[truncated 1782 chars]

Remediation

View remediation

Remediation Suggestions

• Treat all session and transcript content as untrusted data rather than executable instructions.
• Add an explicit consolidation rule that instructions found inside transcripts must never modify system policy, tool permissions, security rules, or agent identity.
• Restrict consolidation to an allowlist of trusted direct-message sessions.
• Preserve the source session, author, timestamp, and exact supporting quotation for every proposed memory update.
• Separate factual notes from behavioral rules and prohibit automatic creation of persistent behavioral rules.
• Generate a proposed change set and require human approval before updating MEMORY.md.
• Validate changes against a restrictive schema and reject secret material, commands, policy overrides, and external-action requests.
• Keep an append-only audit log and support rollback of every consolidation change.
• Apply content scanning and prompt-injection detection before processing transcripts.
• Run consolidation with only the filesystem permissions required to write designated draft files.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/consolidation.md:15

Finding

Session-Derived Consolidation Summaries May Be Sent to an Unverified External Channel

Content

View full analysis

Vulnerability Details

File Location: references/consolidation.md, lines 15–42
Vulnerability Type: Unsafe disclosure configuration for sensitive session summaries
Risk Level: Medium

Vulnerable Code

bash

openclaw cron add \
  --schedule "0 20 * * *" \
  --model "anthropic/claude-sonnet-4-20250514" \
  --channel "<your-channel>" \
  --prompt "$(cat <<'EOF'
Daily consolidation: Review all sessions from today and extract knowledge.

1. Read memory/YYYY-MM-DD.md (today's date) to see what's already captured.
2. Review recent session activity for anything not yet captured.
3. For each significant item found:
   - Decisions made → update relevant file in life/ or create a new ADR in life/resources/decisions/
   - Lessons learned → update MEMORY.md under "Lessons Learned"
   - Project updates → update the relevant file in life/projects/
   - Action items → add to MEMORY.md under "Open Items"
   - New knowledge → create or update files in life/resources/
4. Update today's daily note (memory/YYYY-MM-DD.md) with a consolidation summary.
5. Report what was updated in a brief summary message.

Be concise. Only extract genuinely useful knowledge — skip routine chatter.
EOF
)"

The destination guidance at lines 38–42 is:

markdown

Replace `<your-channel>` with your delivery channel:
- Telegram: `telegram`
- Discord: `discord` or `discord:<channel-id>`

Technical Analysis

The task is authorized to review session activity and then deliver a summary through Telegram or Discord. The instructions do not require the destination to be private, verify that the intended user controls it, limit the source sessions to the same channel, or redact sensitive content before delivery.

A user can therefore accidentally configure a group, shared Discord channel, or incorrect destination. Information gathered from broad session history may then cross conversation ...[truncated 1059 chars]

Remediation

View remediation

Remediation Suggestions

• Default consolidation to silent local execution with output retained only in protected local logs.
• Make external delivery an explicit opt-in rather than part of the primary setup command.
• Validate that the destination is a private, user-controlled direct-message channel.
• Display the resolved destination and require confirmation before registering the scheduled task.
• Restrict source sessions to an explicit allowlist and prevent cross-channel aggregation by default.
• Redact credentials, tokens, personal data, infrastructure identifiers, URLs, and other sensitive values before delivery.
• Send only a generic completion notification externally and keep the substantive report local.
• Provide a dry-run mode showing exactly what would be sent and where.
• Document how users can revoke or modify the cron job if the destination is configured incorrectly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill markets itself as a 'complete' memory system with QMD integration, daily consolidation, transcript verification, and sign-off automation, but this file only documents scaffolding and deferred manual setup. That mismatch can cause operators to assume security- and reliability-relevant controls are already present when they are not, leading to unsafe deployment decisions and overtrust in nonexistent functionality.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The instruction curl -fsSL https://bun.sh/install | bash fetches a remote script and immediately executes it, which creates a supply-chain and remote-code-execution risk if the source is compromised, intercepted, or changed unexpectedly. Because this skill is specifically about bootstrapping agent memory infrastructure, operators may run setup commands with trust and little scrutiny, increasing the likelihood of unsafe execution.

Content

Scanner excerpt · references/qmd-setup.md (reported line 39)May include surrounding context.

wsl --install

Inside WSL2:

curl -fsSL https://bun.sh/install | bash bun install -g @tobilu/qmd

text

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | bash construct is dangerous because it turns downloaded network content directly into executable shell commands without review or integrity verification. In a setup guide for an agent skill, this normalizes unsafe command chaining and could lead to full compromise of the local environment if the upstream content is malicious or tampered with.

Content

Scanner excerpt · references/qmd-setup.md (reported line 39)May include surrounding context.

wsl --install

Inside WSL2:

curl -fsSL https://bun.sh/install | bash bun install -g @tobilu/qmd

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill instructs an automated cron job to review all sessions from the day, potentially including indexed transcripts, and to write changes across multiple memory and project files without any explicit consent, scoping limits, or privacy warning. That creates a real risk of unintended collection of sensitive data and silent modification of persistent knowledge stores, especially because the job runs unattended on a schedule.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/qmd-setup.md (reported line 26)May include surrounding context.

If running OpenClaw as a service, ensure QMD is on the service's PATH:

bash

sudo ln -s ~/.bun/bin/qmd /usr/local/bin/qmd

Windows

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases include common conversational terms like "goodnight," "shut down," and "call it a night," which can plausibly appear in ordinary dialogue without the user intending to invoke an operational routine. In this skill's context, accidental activation is more dangerous because the routine performs state-changing actions such as running consolidation, modifying memory files, checking subagents, and potentially leading toward gateway shutdown.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/transcripts.md (reported line 15)May include surrounding context.

md

## Why Verify Transcripts

Voice-to-text transcription is imperfect. Names, technical terms, and context-dependent phrases are often misheard. Without verification:
- Decisions get recorded incorrectly
- Action items get wrong details
- Knowledge base accumulates errors over time

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly instructs agents to persist raw voice transcripts locally but only addresses git exclusion, not consent, minimization, retention controls, access restrictions, or handling of sensitive personal data. Raw transcripts can contain secrets, personal information, or regulated data, so encouraging storage by default creates a real privacy and data-exposure risk even if no exfiltration is intended.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions create a persistent append-only log of raw natural-language transcripts and corrections, which increases the chance of sensitive information accumulating over time in a searchable local store. Even if gitignored, local compromise, backups, sync tools, or accidental sharing can expose high-value conversational data, making this a substantive retention and leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template explicitly prompts users to document provider, gateway, and channel configuration details, which commonly include API keys, tokens, webhook URLs, hostnames, and other sensitive operational data. Because there is no warning to exclude secrets or store them separately, users may copy credentials into a long-term memory file that could later be indexed, synced, searched, or exposed to other tools in the agent environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

At L034, the documentation makes a specific behavioral claim: the setup script creates starter files and never overwrites existing files. In this file, that guarantee is asserted but not evidenced, and such a claim could mislead users about safety if the actual script behavior differs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents setup and behavior for a local-first search sidecar, but the only mention of QMD auto-downloading ~2 GB of models appears in troubleshooting rather than as a user-facing warning near installation or first-use steps. Because automatic downloads affect bandwidth, storage, and involve network activity, the skill description should warn users before they enable or invoke it.

Content

No source excerpt is available for this finding.