T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:83- Finding
Unverified Remote Installation Script Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Vector Mind Map Fusion
Security checks for vulnerabilities and agentic risk
Overview
This is a real local memory skill, but it needs Review because it scans and persists chat history while adding under-disclosed network, credential, installer, and unsafe serialization risks.
Install only if you are comfortable with this skill scanning OpenClaw session history and keeping derived memory files. Keep Ollama bound to localhost, do not set OLLAMA_BASE_URL to a remote server unless you intend to send conversation text there, avoid the curl pipe-to-shell and --break-system-packages install steps, use an isolated virtual environment, and leave Feishu notifications disabled unless you understand the credential and recipient behavior.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/l3/l3_cron.py:238- Finding
Undocumented Access to Global OpenClaw Credentials for External Notifications
- Content
View full analysis
str: import urllib.request data = json.dumps({"app_id": app_id, "app_secret": app_secret}).encode() req = urllib.request.Request( "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", data=data, headers={"Content-Type": "application/json"}, method="POST" ) with urllib.request.urlopen(req, timeout=10) as resp: result = json.loads(resp.read()) return result.get("tenant_access_token", "") ``` ```python req = urllib.request.Request( "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id", data=data, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {token}" }, method="POST" ) with urllib.request.urlopen(req, timeout=15) as resp: result = json.loads(resp.read()) ``` ```python app_id = "cli_a9637ebd21785ccd" secrets_file = Path.home() / ".openclaw/credentials/lark.secrets.json" app_secret = None if secrets_file.exists(): with open(secrets_file) as f: app_secret = json.load(f).get("lark", {}).get("appSecret") ``` ### Technical Analysis When `--user-open-id` or `FEISHU_USER_OPEN_ID` is supplied, the L3 entry point reads an application secret from the global OpenClaw credential directory outside the project. It combines that secret with a hard-coded application ID, obtains a Feishu tenant token, and sends an external notification. The declared core function is local extraction, consolidation, and retrieval of semantic memory. Direct access to a global platform credential is not necessary for that function and is not clearly disclosed in the Skill's architec ...[truncated 1528 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/l2/l2_daily.py:208- Finding
Private Session Content Can Be Transmitted to an Unrestricted Configurable Embedding Endpoint
- Content
View full analysis
list[list[float]]: import urllib.request import time url = f"{self.base_url}/api/embeddings" headers = {'Content-Type': 'application/json'} for attempt in range(self.max_retries): try: batch_results = [] for text in texts: payload = json.dumps({"model": self.model, "prompt": text}).encode('utf-8') req = urllib.request.Request(url, data=payload, headers=headers) with urllib.request.urlopen(req, timeout=self.timeout_sec) as resp: result = json.loads(resp.read()) ``` The submitted text originates from user session messages: ```python obj = json.loads(line) if obj.get('type') == 'message': msg = obj.get('message', {}) if msg.get('role') == 'user': content = self._extract_content(msg.get('content', [])) if content and len(content.strip()) >= 5: chunk = self._parse_user_message(session_id, content, line_pos) if chunk: chunks.append(chunk) ``` A similar transmission is performed by `src/l3/l3_biweekly_consolidate.py:68-80`: ```python client = httpx.Client(base_url=self.base_url, timeout=self.timeout_sec) resp = client.post( "/api/embeddings", json={"model": self.model, "prompt": text} ) ``` ### Technical Analysis The system collects user-authored text from OpenClaw session files and submits that text as an embedding prompt. The default endpoint is the loopback Ollama service, which ...[truncated 1683 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/recall/infinitydb_lite.py:145- Finding
Unsafe Pickle Deserialization of Persistent HNSW Indexes
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Automatic Installation of Unpinned Runtime and Development Dependencies
- Content
View full analysis
=0.25.0 numpy>=1.24.0 # Optional: hnswlib for faster vector search (not required) # hnswlib>=0.7.0 # Testing pytest>=7.0.0 pytest-asyncio>=0.21.0 # Code quality black>=23.0.0 ruff>=0.1.0 ``` ```bash if ! python3 -c "import httpx" 2>/dev/null; then pip install -r requirements.txt -q fi ``` The documentation additionally recommends modifying the system Python environment: ```bash pip install --break-system-packages httpx ``` ### Technical Analysis Every dependency uses an open-ended minimum version rather than an exact reviewed version and artifact hash. When `httpx` is absent, the startup script installs the complete requirements file, including testing and code-quality packages that are not required for normal runtime operation. This does not prove that any listed package is malicious. The vulnerability is the supply-chain exposure created by resolving arbitrary future releases during startup. A future compromised release accepted by the lower-bound constraints could execute package installation code or introduce vulnerable behavior without a corresponding project change. The dependency check only tests whether `httpx` can be imported. It does not verify the installed versions or integrity of `numpy` and the other packages. ### Attack Path 1. A permitted future version of a listed dependency or one of its transitive dependencies is compromised. 2. The target environment does not have `httpx` installed. 3. A user runs `start.sh`. 4. The startup script automatically invokes pip against the unpinned requirements. 5. Pip selects the latest compatible releases, including the compromised artifact. 6. Malicious package installation or import-time code executes with the user's privileges. ...[truncated 484 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (94)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Piping a remote script directly into the shell executes unverified code from the network with the user's privileges, creating a straightforward remote code execution and supply-chain risk. In an installation guide, this is especially dangerous because users are encouraged to copy-paste it without inspecting the script.
- Content
bash # macOS/Linux curl -fsSL https://ollama.com/install.sh | sh # Windows: https://ollama.com/download
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The command chains a network fetch directly into shell execution using a pipe, removing any inspection boundary between downloaded content and command execution. This pattern amplifies the risk of compromise from a malicious or tampered installer and is a well-known unsafe installation practice.
- Content
bash # macOS/Linux curl -fsSL https://ollama.com/install.sh | sh # Windows: https://ollama.com/download
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash ollama serve curl http://localhost:11434/api/tags # 验证4. 安装 Python 依赖
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash ollama serve curl http://localhost:11434/api/tags # 验证4. 安装 Python 依赖
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash ollama serve curl http://localhost:11434/api/tags # 验证4. 安装 Python 依赖
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash ollama serve curl http://localhost:11434/api/tags # 验证4. 安装 Python 依赖
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch includes an undeclared external HTTP call to the Ollama embeddings service while claiming a broader memory-management role. Undeclared network communication changes the threat model because user content intended for local memory operations may be sent to a service endpoint without clear disclosure or permission boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This mismatch includes an undeclared external HTTP call to the Ollama embeddings service while claiming a broader memory-management role. Undeclared network communication changes the threat model because user content intended for local memory operations may be sent to a service endpoint without clear disclosure or permission boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
This mismatch includes an undeclared external HTTP call to the Ollama embeddings service while claiming a broader memory-management role. Undeclared network communication changes the threat model because user content intended for local memory operations may be sent to a service endpoint without clear disclosure or permission boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch includes an undeclared external HTTP call to the Ollama embeddings service while claiming a broader memory-management role. Undeclared network communication changes the threat model because user content intended for local memory operations may be sent to a service endpoint without clear disclosure or permission boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This mismatch includes an undeclared external HTTP call to the Ollama embeddings service while claiming a broader memory-management role. Undeclared network communication changes the threat model because user content intended for local memory operations may be sent to a service endpoint without clear disclosure or permission boundaries.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This mismatch includes an undeclared external HTTP call to the Ollama embeddings service while claiming a broader memory-management role. Undeclared network communication changes the threat model because user content intended for local memory operations may be sent to a service endpoint without clear disclosure or permission boundaries.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises persistent memory storage, proactive scanning, incremental updates, and cross-session correlation without clearly warning users about retention and privacy consequences. In a memory system, lack of transparent notice and consent is especially dangerous because highly sensitive conversational data may be stored and later resurfaced across sessions.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The documentation instructs users to execute a remote script via 'curl ... | sh', which is a classic supply-chain and remote-code-execution risk. If the remote host, transport path, or published installer is compromised, arbitrary code will run immediately on the user's machine with the shell's privileges.
- Content
bash # macOS/Linux curl -fsSL https://ollama.com/install.sh | sh # Windows: https://ollama.com/download
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping network-fetched content directly into 'sh' is a dangerous command chain because it removes any opportunity for inspection or integrity validation before execution. In a skill context, including this pattern normalizes unsafe operational practices and could lead to immediate compromise if followed by users or automated tooling.
- Content
bash # macOS/Linux curl -fsSL https://ollama.com/install.sh | sh # Windows: https://ollama.com/download
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_feishu_tenant_token(app_id: str, app_secret: str) -> str: """获取飞书 tenant access token""" import urllib.request data = json.dumps({"app_id": app_id, "app_secret": app_secret}).encode() req = urllib.request.Request(
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Referencing and opening a local secrets file is direct credential access. In the context of a semantic-memory skill, this is especially risky because the capability is unnecessary to the stated purpose and gives the code access to reusable secrets that could be abused for unauthorized messaging or further account actions.
- Content
python # 读取飞书 credentials（不走 env，cron 执行时 env 不会透传给子进程） app_id = "cli_a9637ebd21785ccd" secrets_file = Path.home() / ".openclaw/credentials/lark.secrets.json" app_secret = None if secrets_file.exists(): with open(secrets_file) as f:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Loading executable serialization data from disk without warning or trust validation is dangerous because pickle payloads can run arbitrary code at deserialization time. In the context of a memory-management skill that routinely reads persistent state from a shared workspace, this becomes more dangerous: poisoned state can survive across sessions and be triggered later, expanding the blast radius beyond a single run.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The script automatically loads all entries from a local .env file into the process environment using shell parsing that is unsafe and overly broad. This can expose secrets to child processes and can misparse crafted .env content, causing unintended variable assignment or command/argument injection behavior during startup.
- Content
sh echo "==========================================" # 加载环境变量 if [ -f .env ]; then echo "[启动] 加载 .env 配置" export $(cat .env | grep -v '^#' | xargs) fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The presence and automatic use of a .env file for startup configuration means credentials stored there are implicitly trusted and injected into the runtime environment. In the context of a memory/knowledge skill, this increases sensitivity because API keys, database tokens, or vector-store credentials may be loaded and then inherited by Python and pip processes.
- Content
sh # 加载环境变量 if [ -f .env ]; then echo "[启动] 加载 .env 配置" export $(cat .env | grep -v '^#' | xargs) fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
export $(cat .env | grep -v '^#' | xargs)is an unsafe pattern for reading .env files because word splitting and shell interpretation can corrupt values or turn maliciously crafted content into unexpected exports. If an attacker can modify .env, they may influence subprocess behavior via environment variables such as Python/pip-related settings, potentially redirecting package sources, altering module loading, or exposing secrets to invoked tools.- Content
sh # 加载环境变量 if [ -f .env ]; then echo "[启动] 加载 .env 配置" export $(cat .env | grep -v '^#' | xargs) fi # 检查依赖
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README describes persistent storage in InfinityDB and deletion of intermediate memory layers, but it does not clearly warn users that data will be retained and transformed across layers. This is dangerous because users may unknowingly allow long-term retention and lifecycle changes of potentially sensitive session content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installation and quick-start sections tell users how to run the system but omit a clear warning that local session JSONL data will be scanned, classified, embedded, and stored into persistent memory layers. In this context, the omission materially increases privacy risk because users may execute commands before understanding the scope of data processing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases for activating consolidation and memory operations are broad enough to match ordinary user conversation, which can cause unintended storage, restructuring, or retrieval of user data. In a memory-management skill, accidental invocation is especially risky because it can persist sensitive content or modify stored knowledge without clear user intent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents capabilities that involve filesystem access, network access, and persistent state, but it does not declare any explicit tool scope or allowed-tools boundary. This is dangerous because a memory-oriented skill can end up with broader execution privileges than users expect, increasing the blast radius of prompt-triggered actions and making abuse or accidental misuse harder to contain.
- Content