Correlation Memory Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 2.1.0

Overview

The runtime plugin is mostly a read-only, purpose-aligned memory correlation tool, but its install path and dependency metadata are not reproducible enough for a local-only security claim.

Review this before installing. The runtime code is narrow and read-only, but install from a pinned tag or commit, prefer a regenerated lockfile with npm ci, and check the OpenClaw dependency graph before running npm install. Keep correlation rules specific so the tool does not surface sensitive or irrelevant memory context names too often.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64

Finding

Unpinned Source Installation and Broad Peer Dependency Reduce Supply-Chain Reproducibility

Content

View full analysis

=2026.1.26" } ``` `package-lock.json:1-13`: ```json { "name": "@openclaw/correlation-memory", "version": "2.0.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@openclaw/correlation-memory", "version": "2.0.1", "devDependencies": {}, "peerDependencies": { "openclaw": ">=2026.1.26" } }, ``` ### Technical Analysis The documented installation process clones the repository's current default branch without selecting an immutable tag or commit and then immediately invokes `npm install`. Consequently, the effective code installed by a user can differ from the code that was audited. The `openclaw` peer dependency accepts every release from `2026.1.26` onward and has no upper bound. Package managers that automatically resolve peer dependencies may therefore install a future release that has not been tested or audited with this plugin. The dependency metadata is also inconsistent: - `package.json` declares project version `2.1.0`, while `package-lock.json` identifies version `2.0.1`. - `package.json` declares Vitest as a development dependency, while the lockfile root records an empty `devDependencies` object. - The lockfile ...[truncated 1674 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: index.ts:352

Finding

Unbounded max_results Parameter Can Cause Excessive Processing and Output

Content

View full analysis

= maxResults) break; ``` The function can consequently inspect the complete rules collection and return every matching rule. Returned rules may also include multiple attacker-controlled `additional_searches` strings, increasing response size and downstream token consumption. This issue requires access to the registered tool and becomes materially more significant when the local rules file is unusually large or attacker-controlled. It does not provide code execution or access t ...[truncated 1231 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The static finding indicates the skill's declared purpose and safety claims do not match its actual behavior: it reportedly modifies OpenClaw config, removes plugins, creates backups, and depends on jq despite claiming zero external dependencies. That kind of description-behavior mismatch is dangerous because it can mislead operators into granting trust or running the skill in environments where configuration tampering or dependency execution was not expected.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- `tests/correlation.test.ts` — Unit tests

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · index.ts (reported line 90)May include surrounding context.

ts

function getKeywords(rule: CorrelationRule): string[] {
  // Handle both field naming conventions
  return rule.trigger_keywords || rule.keywords || [];
}

function getContext(rule: CorrelationRule): string {

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · index.ts (reported line 94)May include surrounding context.

ts

function getKeywords(rule: CorrelationRule): string[] {
  // Handle both field naming conventions
  return rule.trigger_keywords || rule.keywords || [];
}

function getContext(rule: CorrelationRule): string {

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tests/correlation.test.ts (reported line 136)May include surrounding context.

ts

function getKeywords(rule: CorrelationRule): string[] {
  // Handle both field naming conventions
  return rule.trigger_keywords || rule.keywords || [];
}

function getContext(rule: CorrelationRule): string {

Known Vulnerable Dependency: @mariozechner/pi-coding-agent==0.61.1 — 3 advisory(ies): CVE-2026-54326 (Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization by); CVE-2026-54328 (Pi Agent: Predictable temporary extension install paths allow local privilege es); CVE-2026-54327 (Pi Agent: Race condition in Pi auth.json writes could expose stored credentials)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The lockfile includes @mariozechner/pi-coding-agent 0.61.1 with multiple high-severity advisories involving XSS in exports, predictable temp paths, and auth.json race conditions. In an agent ecosystem, a coding-agent package is particularly sensitive because it may handle files, sessions, extensions, and credentials, making these issues more relevant than they would be in a purely offline library.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

axios 1.13.6 carries numerous advisories, including SSRF and prototype-pollution-related impacts, which are especially concerning in agent systems that may fetch remote content or honor proxy settings. Even if axios is optional/transitive here, its presence in the dependency graph is a true supply-chain vulnerability because network-capable agent plugins often operate on attacker-influenced URLs and configuration.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

basic-ftp 5.2.0 is flagged for command injection and denial-of-service issues, and FTP libraries are inherently high risk when fed attacker-controlled endpoints or paths. While this plugin does not itself demonstrate FTP use, an agent platform with broad automation capabilities makes any vulnerable file-transfer component more dangerous if reachable through transitive functionality.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.4 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection) +2 more

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

brace-expansion 5.0.4 is associated with multiple denial-of-service issues caused by pathological expansion patterns and large ranges. In agent ecosystems that may process user-controlled glob patterns, file selectors, or package metadata, this can become exploitable for CPU or memory exhaustion even when the package is only transitive.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

- ✅ **No network requests** - Read-only local file operations
- ✅ **No credential access** - Does not handle secrets or tokens
- ✅ **No environment variable harvesting** - Uses SDK config only
- ✅ **Read-only filesystem operations** - Cannot write to disk

**Security Audit:** March 20, 2026 - Passed deep security review.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 229)May include surrounding context.

text

Options:
- `--force`: Skip confirmation prompt
- Environment variable `OPENCLAW_CONFIG_PATH`: Override config location (default: `~/.openclaw/openclaw.json`)

The uninstall script will:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill metadata declares no explicit tool scope or permissions, yet the surrounding installation instructions include a git clone from GitHub and npm install, which introduce network-reliant behavior and expand the trust boundary. Even if the runtime plugin is claimed to be local-only, omitting tool/permission declarations makes it harder for reviewers and agents to constrain execution safely and can lead to unintended external access during setup or operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger keywords for the session-recovery rule include very generic terms such as "crash" and "restart," which can activate the rule in unrelated contexts. In a memory-retrieval plugin, broad activation can pull in unrelated operational context and increase the chance of unnecessary exposure of sensitive historical data or misleading the agent with irrelevant state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The security-audit rule uses broad keywords like "security," "audit," and "credential," which are likely to match many benign conversations. Because this plugin automatically fetches correlated memory, overbroad security triggers can surface access logs or recent security context more often than necessary, expanding data exposure and potentially biasing responses with irrelevant sensitive material.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/deployment.md (reported line 40)May include surrounding context.

}

text

### 4. Create Correlation Rules

Create `memory/correlation-rules.json` in your workspace with your correlation rules:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The test case says retired lifecycle states should be filtered, yet the local matchRules implementation shown in this file never references lifecycle or ACTIVE_STATES when deciding matches. That means the inline documentation and asserted intent directly contradict the code under test in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The test states that zero or negative confidence entries are filtered, but matchRules only skips rules when confidence is below the provided minConfidence, whose default is 0. Under this implementation, a rule with confidence 0 would still match, so the documented intent conflicts with the actual code behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The rule sets lifecycle.state to "proposal" at L075-L077, but the note at L080 says "Promoted because this fires often and always helps." That is a direct contradiction in the file's intent/documentation, even though it does not change runtime behavior.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @anthropic-ai/sdk==0.80.0 — 2 advisory(ies): CVE-2026-34451 (Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to ); CVE-2026-41686 (Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesys)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The lockfile pins @anthropic-ai/sdk to 0.80.0, and the cited advisories describe filesystem-related weaknesses that can matter in agent/plugin environments where tools may read or write local files. Even though this file is only a dependency manifest and does not prove exploitability by itself, shipping a known-vulnerable SDK in an OpenClaw plugin increases attack surface if that SDK is reachable at runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 76% confidence

Finding

@hono/node-server 1.19.11 is flagged for middleware bypass and Windows path traversal issues in static file serving. In this lockfile alone there is no proof the plugin exposes static files, but including a known-vulnerable HTTP server component is still a genuine supply-chain risk if the broader OpenClaw runtime or plugin path invokes it.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @protobufjs/utf8==1.1.0 — 1 advisory(ies): CVE-2026-44288 (protobufjs has overlong UTF-8 decoding)

Low

• Category: Supply Chain
• Confidence: 72% confidence

Finding

@protobufjs/utf8 1.1.0 is reported vulnerable to overlong UTF-8 decoding, which can enable parsing inconsistencies or filter bypasses in systems relying on strict UTF-8 handling. In this plugin context the danger appears limited because the lockfile alone does not show direct parsing of attacker-controlled protobuf data, but the dependency is still outdated and vulnerable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 68% confidence

Finding

body-parser 2.2.2 is reported vulnerable to a denial-of-service condition tied to invalid limit handling. This is a real vulnerable version, but the practical risk for this specific skill appears low because the lockfile does not establish that the plugin exposes Express endpoints that parse untrusted request bodies.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"test:watch": "vitest"
  },
  "devDependencies": {
    "vitest": "^3.0.0"
  },
  "peerDependencies": {
    "openclaw": ">=2026.1.26"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The test name and first comment indicate strict mode should reject context-only matches, but the expectation checks that cr-001 does match. The later comment explains this is actually due to a keyword boundary match on 'setting', so the earlier documentation is internally contradictory to the asserted behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.