ClawHub
Back to skill

Security audit

TokenSaver Korean

Security checks for vulnerabilities and agentic risk

Overview

This memory skill mostly matches its stated purpose, but it can send saved/query memory to Fireworks automatically and has unsafe path handling that can write outside its intended storage directory.

Review before installing. Use this only for data you are comfortable storing locally and potentially sending to Fireworks when embeddings are enabled. Avoid running the bundled init_bora_context.py unless you intentionally want those specific OpenClaw state files imported. Prefer a restricted storage directory, avoid untrusted URI/category inputs, and purge local memory, WAL, session, backup, and embedding files when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 Β· Insecure Skill Coding Practices

Error
Location
token_saver/client.py:128
Finding

Automatic Transmission of Sensitive Agent Memory to an External Embedding Service

Content
View full analysis
Optional[List[float]]: """Fireworks API둜 μž„λ² λ”© 생성""" if not self.api_key: print("[Embedding] API ν‚€ μ—†μŒ, μž„λ² λ”© 생성 λΆˆκ°€") return None try: headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" } payload = { "model": f"accounts/fireworks/models/{self.EMBEDDING_MODEL}", "input": text[:2000] # μ΅œλŒ€ 2000자둜 μ œν•œ } response = requests.post( self.API_ENDPOINT, headers=headers, json=payload, timeout=30 ) ``` The API endpoint is defined at `token_saver/client.py:91`: ```python API_ENDPOINT = "https://api.fireworks.ai/inference/v1/embeddings" ``` A remote similarity check is performed automatically during saves at `token_saver/client.py:738-739`: ```python if merge_if_similar: similar_items = self.embeddings.find_similar(context.content, threshold=0.85) ``` The bundled initializer reads sensitive Agent state and passes it to the save operation at `init_bora_context.py:21-58`: ```python files = [ { "uri": "memories/보라/MEMORY", "content": open(r"C:\Users\Roken\.openclaw\workspace\MEMORY.md", encoding="utf-8").read(), "category": "memories" }, { "uri": "memories/보라/USER", "content": open(r"C:\Users\Roken\.openclaw\workspace\USER.md", encoding="utf-8").read(), "category": "memories" }, { "uri": "memories/보라/SOUL", "content": open(r"C:\Users\Roken\.openclaw\workspace\SOUL.md", encoding="utf-8" ...[truncated 3187 chars]
Remediation
View remediation

T09 Β· Insecure Skill Coding Practices

Error
Location
token_saver/client.py:1118
Finding

Path Traversal Through User-Controlled Memory URI and Category

Content
View full analysis
Path: """URIλ₯Ό 파일 경둜둜 λ³€ν™˜""" # viking://memories/ν”„λ‘œμ νŠΈ/λ§ˆμΌ€νŒ….md -> memories/ν”„λ‘œμ νŠΈ/λ§ˆμΌ€νŒ….json if uri.startswith("viking://"): uri = uri[9:] # viking:// 제거 return self.base_path / f"{uri}.json" ``` The path is used for directory creation and file writing at `token_saver/client.py:748-770`: ```python # 2. URIμ—μ„œ 파일 경둜 생성 path = self._uri_to_path(context.uri) path.parent.mkdir(parents=True, exist_ok=True) # 3. κΈ°μ‘΄ 파일 쀑볡 체크 (μžμΉ΄λ“œ μœ μ‚¬λ„) if check_duplicate and path.exists(): with open(path, 'r', encoding='utf-8') as f: existing_data = json.load(f) existing_text = existing_data.get("content", "") if self.similarity_checker.is_duplicate(context.content, existing_text, tokenizer): print(f"(System) μœ μ‚¬ν•œ λ‚΄μš© 감지, 버전 μ—…κ·Έλ ˆμ΄λ“œ: v{existing_data.get('version', 1)} β†’ v{existing_data.get('version', 1) + 1}") context.version = existing_data.get('version', 1) + 1 context.access_count = existing_data.get('access_count', 0) context.created_at = datetime.fromisoformat(existing_data.get('created_at', datetime.now().isoformat())) self.version_backup.backup(path, context.uri) # 4. μž„λ² λ”© 생성 및 μ €μž₯ embedding = self.embeddings.get_embedding(context.uri, context.content) if embedding: context.meta['has_embedding'] = True # 5. JSON으둜 μ €μž₯ with open(path, 'w', encoding='utf-8') as f: json.dump(context.to_dict(), f, ensure_ascii=False, indent=2) ``` Both `category` and `uri` are incorporated without validation at `token_saver/client.py:1179-1205`: ```python def save_memor ...[truncated 3760 chars]
Remediation
View remediation
Path: candidate = (self.base_path / f"{uri}.json").resolve() root = self.base_path.resolve() if not candidate.is_relative_to(root): raise ValueError("URI resolves outside the storage directory") return candidate ``` 4. Perform the containment check after path resolution to address `..` components. 5. Reject symlink traversal, or open files using directory-relative APIs with protections against symlink following where supported. 6. Prefer mapping logical URIs to encoded filenames rather than using them as paths. For example, hash the URI and store the original URI only as JSON metadata. 7. Allow nested logical namespaces only after validating every component against a conservative expression such as: ```text [A-Za-z0-9_.-]+ ``` Add an explicitly designed Unicode policy if Korean path components must remain supported. 8. Apply identical validation to save, load, backup, merge, archive, and deletion operations. 9. Add security tests for absolute POSIX paths, Windows drive paths, UNC paths, mixed separators, repeated traversal components, and symlink escapes. 10. Run the Skill under a dedicated low-privilege account with filesystem access limited to its database directory. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The declared description presents a broad context DB product with multiple advanced capabilities. The supplied code chunk is much narrower: it is an initialization utility for one persona/context ('보라') that imports specific local markdown files into an existing TokenSaverKorean client, prints token savings, and performs test queries. While parts of the description are loosely consistent with saving memories and searching/abstracting them, the code does not implement or evidence several headline features named in the description, and it accesses hardcoded local resources for a specific setup. That makes the actual behavior materially narrower and somewhat different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description presents a substantial data/storage and retrieval system with concrete capabilities such as semantic embedding search, deduplication/merging, memory hierarchy management, archiving, WAL, and entity extraction. However, the supplied code chunk does not implement a database, storage layer, retrieval algorithm, embeddings, WAL, or archival logic. It consists entirely of prompt strings and configuration dictionaries intended to guide an LLM in Korean, plus some token-optimization settings. While these templates loosely relate to memory extraction, compression, and context search, they are only instructional text, not the actual mechanisms claimed in the description. The code also adds unrelated prompt utilities like overview generation, abstract generation, intent analysis, and tool-chain generation, which are not part of the declared purpose. Therefore the description materially overstates and misrepresents the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description presents a full-featured Korean context database for AI agents with multiple advanced capabilities. The supplied code chunk does not implement such a system; it is a standalone test file that measures rough token savings using substring-based summaries, simulates search with keyword inclusion checks, and demonstrates simple compression on hardcoded examples. While it loosely supports the marketing claim about token reduction and hints at hierarchical loading, the primary purpose and implemented behavior are far narrower than declared, and most listed capabilities are absent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README identifies the skill as 'TokenSaver Korean' and describes it as 'ν•œκ΅­μ–΄ μ΅œμ ν™”', indicating a Korean-specific language constraint. The document does not offer users a language choice or explain a necessary region/compliance reason for restricting the skill to Korean, which fits the locale policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README demonstrates commands and APIs that save memories, read from local paths, and integrate as a persistent plugin, but it does not warn users that the tool writes data to local storage and retains memory across sessions. In an agent context, undocumented persistence can lead to unintentional storage of sensitive prompts, business data, or personal information, increasing privacy and data retention risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt Β· README.md (reported line 76)May include surrounding context.

bash
# ν”ŒλŸ¬κ·ΈμΈ μ„€μΉ˜
mkdir -p ~/.openclaw/extensions/memory-token-saver
cp -r . ~/.openclaw/extensions/memory-token-saver/
cd ~/.openclaw/extensions/memory-token-saver && npm install

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises capabilities that imply access to environment variables, local storage, and external network services, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, that omission weakens user visibility and policy enforcement, making it easier for the skill to access sensitive data or perform unintended side effects without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to configure an external embedding provider key and promotes embedding-based search, but it does not disclose that stored memory content and user queries may be transmitted to a third-party service. In a context database skill, that can expose highly sensitive prompts, business data, or personal information to an external processor without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file bundles embeddings keyed to unrelated domains such as sales, health, personal, and family alongside the advertised agent context DB content. Even though embeddings are numeric vectors, the labels and presence of broad-domain memory artifacts indicate over-bundled or residual data that can expose unintended knowledge domains, create privacy/compliance issues, and contaminate retrieval behavior for downstream agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script reads multiple local markdown files containing likely sensitive memory, identity, and user data, then sends their full contents into an external client API without any consent prompt, minimization, or disclosure boundary. In an agent-skill context, files like MEMORY.md, USER.md, SOUL.md, AGENTS.md, and IDENTITY.md strongly suggest personal/system secrets and persistent profile data, so this creates a real exfiltration risk if the client stores, syncs, embeds remotely, or logs content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language description states the skill is a "ν•œκ΅­μ–΄ Context DB for AI Agents," which presents a language-specific constraint without any indication that users can choose another language or opt in to Korean-only behavior. This can violate language/locale policy expectations for skills that should not silently force a specific language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This Python file consists entirely of Korean-specific prompt templates and optimization settings, with instructions such as 'ν•œκ΅­μ–΄ κ°„κ²°ν™”' and multiple *_KO constants indicating a forced Korean locale. Under the policy rule, a skill should not impose a specific language without user opt-in or a clearly documented, justified regional constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hardcoded Fireworks API endpoint indicates the component is designed for outbound data transmission to a third-party service. In the context of a memory database, this is security-relevant because users may reasonably expect local storage semantics while content can instead leave the host for embedding generation.

Content

Scanner excerpt Β· token_saver/client.py (reported line 91)May include surrounding context.

python
"""Fireworks μž„λ² λ”© API κ΄€λ¦¬μž"""
    
    EMBEDDING_MODEL = "qwen3-embedding-8b"
    API_ENDPOINT = "https://api.fireworks.ai/inference/v1/embeddings"
    SIMILARITY_THRESHOLD = 0.85  # 쀑볡 병합 μž„κ³„κ°’
    
    def __init__(self, api_key: Optional[str] = None, embeddings_path: Optional[Path] = None):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

User-provided content is sent to the Fireworks embedding API automatically when embeddings are enabled and an API key is present, without an explicit warning at the save/search call sites. This can expose sensitive memory contents to a third party, which is especially risky because this skill is designed to store persistent context and may handle confidential notes, tasks, or personal data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This requests.post call transmits content to an external API endpoint, crossing a trust boundary and potentially exposing sensitive stored memories to a third party. Because the skill's purpose is long-term context retention, the transmitted text may contain accumulated personal, business, or operationally sensitive information.

Content

Scanner excerpt Β· token_saver/client.py (reported line 141)May include surrounding context.

python
"input": text[:2000]  # μ΅œλŒ€ 2000자둜 μ œν•œ
            }
            
            response = requests.post(
                self.API_ENDPOINT,
                headers=headers,
                json=payload,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The tokenizer downloads NLTK resources at runtime, creating undeclared outbound network activity during normal local processing. This expands the trust boundary, can leak environment metadata such as IP and timing, and allows behavior to depend on external infrastructure not obviously required by users of a local context store.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The WAL guidance to save before responding semantically promotes persistent logging of interaction-derived data ahead of user confirmation or completion. In practice this can preserve sensitive content, metadata, and failed operations in wal.json, broadening the amount of recoverable user information stored on disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill persists SESSION-STATE.md as cross-session working memory containing current task, context, pending actions, and decisions. That creates a durable plaintext record of potentially sensitive user interactions beyond the expected scope of a token-saving context database, increasing privacy and retention risk if the workspace is shared or later exfiltrated.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The session-state template explicitly encourages durable capture of active task details, context, pending actions, and decisions in plain language. In an agent setting, that can accumulate sensitive operational or personal information across sessions in a predictable file, increasing exposure through local compromise, accidental commit, or later tool access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The cleanup routine relocates JSON memory files into an archive directory, modifying stored user data state and filesystem layout. While there is a dry-run option and a completion print, there is no confirmation prompt or upfront warning before the non-reversible file move occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The language detection logic falls back to "ko" when it cannot identify English characters, which imposes a specific language behavior by default. This can violate language/locale policy expectations because the file presents multilingual support but does not provide opt-in or user control for this fallback behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description explicitly states 'Korean-first + English support,' and later repeats 'ν•œκ΅­μ–΄ μš°μ„ , μ˜μ–΄ 지원,' which indicates a built-in language preference. The file does not clearly frame this as an optional user-selected mode or a region-specific constraint, so it can conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file's natural-language description and the use of TokenSaverKorean indicate the skill is designed specifically around Korean, with all user-facing messages also fixed in Korean. There is no visible opt-in, language selection, or documented justification that this locale restriction is required, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.