T08 · Insecure Dependencies
Warning
- Location
bootstrap_deps.sh:66- Finding
Unverified Third-Party Package Installation and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw SQLite Knowledge
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed wrapper for a pinned PyPI knowledge-base CLI, with ordinary install and local data-storage risks but no hidden or purpose-mismatched behavior found.
Install this only if you are comfortable running a PyPI-backed CLI wrapper that creates a persistent local knowledge store. Review the clawsqlite package provenance separately if you need high assurance, and prefer running it in an isolated Python environment because the bootstrap can install dependencies outside the skill-local fallback path.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Configuration
Create or edit the local private config in a knowledge instance home, not in the skill directory:
bash
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to run shell commands, including dependency installation and local CLI execution, but does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and can let a consumer invoke a shell-capable skill without clear review of its execution boundary, especially since bootstrap installs code from PyPI via a shell script.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
directory:
bash mkdir -p ~/.openclaw/workspace/data/clawsqlite-knowledge/default cd ~/.openclaw/workspace/data/clawsqlite-knowledge/default
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code can delete the local dependency target with rm -rf, install packages via pip, and write into a local target directory, which are safety-relevant filesystem and environment-modifying actions. Although some error messages and status text exist, they do not clearly disclose these side effects before they occur or ask for confirmation.
- Content
Static analysis
No suspicious patterns detected.