Knowhere

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:42 AM UTC
• Version: 0.1.0-beta.0

Overview

This is a coherent document-ingestion skill, but users should understand that it relies on an external plugin and stores ingested documents for later use.

Before installing, confirm you trust the Knowhere plugin publisher and understand that files or URLs you ingest may be stored in the Knowhere scope for later retrieval. Avoid ingesting sensitive documents unless you are comfortable with that storage behavior, and use remove or clear actions only when you intend to delete stored document state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned External Plugin Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

markdown

Install the plugin before using this skill:

```bash
openclaw plugins install @ontos-ai/knowhere-claw

text

### Technical Analysis

The skill requires users to install `@ontos-ai/knowhere-claw` without specifying an exact version or integrity hash. The installed package is mutable third-party code whose implementation is not included in this repository. Therefore, its behavior cannot be validated as part of this audit and may change independently after the skill has been reviewed.

Installing a registry package can introduce executable plugin code and may trigger package lifecycle behavior. If the publisher account, distribution registry, or a future package release is compromised, following this instruction could install attacker-controlled code.

### Attack Path

1. An attacker compromises the package publisher account, registry distribution path, or a future release of `@ontos-ai/knowhere-claw`.
2. The attacker publishes a malicious package version under the expected package name.
3. A user follows the documented installation command, which resolves the unpinned dependency to the malicious release.
4. OpenClaw loads the installed plugin after it is enabled and restarted.
5. The malicious plugin executes with the permissions available to the OpenClaw process and can abuse its access to local or ingested documents.

### Impact Assessment

Successful exploitation could allow arbitrary plugin code execution with the privileges of the OpenClaw process. Depending on the host configuration, this may expose local files supplied for ingestion, stored document results, plugin configuration, and other resources accessible to that process. The exact impact cannot be established because the external plugin implementation and runtime permissions are outside the audited repository.

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, security-reviewed version rather than resolving the latest available release.
• Record and verify a package integrity hash or cryptographic signature before installation.
• Document the expected package registry and reject packages resolved from untrusted sources.
• Review and audit the corresponding plugin source for every approved release.
• Consider vendoring the reviewed dependency or using a lockfile-backed installation process.
• Disable package installation lifecycle scripts where supported and not required.
• Run the plugin with least privilege, restricting filesystem, network, credential, and document access to what is necessary.
• Establish an update-review process so dependency upgrades are not accepted automatically.

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned External Plugin Dependency Repeated in Installation Documentation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7–11
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

markdown

Install the plugin before using this skill:

```bash
openclaw plugins install @ontos-ai/knowhere-claw

text

### Technical Analysis

The README independently directs users to install the same external plugin without an exact version or integrity constraint. Package resolution can consequently select a release published after this project was audited. Because no plugin source is present in this repository, users cannot determine from the audited artifact whether the resolved package contains safe initialization, lifecycle, or runtime behavior.

This location represents the same underlying supply-chain weakness as the prerequisite in `SKILL.md`, but it is separately actionable because users may install the dependency by following the README alone.

### Attack Path

1. An attacker gains the ability to publish or substitute a release of `@ontos-ai/knowhere-claw`.
2. The attacker inserts malicious installation or plugin runtime logic.
3. A user follows the README command, which retrieves the attacker-controlled unpinned release.
4. The user enables the plugin and restarts OpenClaw as instructed.
5. The malicious code runs in the plugin environment and exercises the permissions granted to OpenClaw.

### Impact Assessment

Exploitation may result in arbitrary code execution under the OpenClaw process identity. Potentially affected resources include documents submitted for ingestion, stored retrieval results, configuration data, and any local or network resources available to the process. Actual privileges depend on the deployment environment and could not be verified from this documentation-only project.

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned command with an exact approved version.
• Publish and verify integrity metadata or a cryptographic signature for the package.
• Identify the trusted package registry explicitly.
• Link each pinned package release to auditable source and build provenance.
• Require security review before changing the documented version.
• Use a sandboxed, least-privilege plugin runtime with narrowly scoped filesystem and network access.
• Keep the README and SKILL.md installation instructions synchronized so neither offers an unsafe unpinned alternative.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs agents to ingest local files or URLs into a plugin-managed store, but it does not warn that doing so may transmit, persist, or expose user data beyond the immediate conversation. In a document-ingestion skill, that omission is security-relevant because users and downstream agents may assume attached files are only read ephemerally when they are actually stored for later retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill documents knowhere_remove_document and knowhere_clear_scope as cleanup actions but does not prominently warn that they delete stored document state and may be irreversible. That creates a risk of accidental data loss, especially because the skill encourages operational use of cleanup tools as part of normal workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.