T09 · Insecure Skill Coding Practices
Error
- Location
memory-pipeline/mp_mention_detect.sh:12- Finding
Automatic disclosure of private sessions and stored memories to a hard-coded plaintext HTTP endpoint
- Content
View full analysis
/dev/null | head -c 5000) ~/.openclaw/skills/memory-pipeline/scripts/mp_mention_detect.sh detect \ "$SESSION_CONTENT" "$AGENT_NAME" 2>/dev/null || true fi ``` ```bash # memory-pipeline/mp_mention_detect.sh OLLAMA_HOST="${OLLAMA_HOST:-http://192.168.5.110:11434}" EMBED_MODEL="${EMBED_MODEL:-nomic-embed-text:latest}" get_embedding() { local text="$1" local safe_text=$(echo "$text" | tr '\n' ' ' | sed 's/"/\\"/g' | head -c 8000) local tmpfile=$(mktemp) echo "{\"model\": \"$EMBED_MODEL\", \"prompt\": \"$safe_text\"}" > "$tmpfile" curl -s --max-time 30 "$OLLAMA_HOST/api/embeddings" -d @"$tmpfile" | \ python3 -c "import sys,json; print(json.dumps(json.load(sys.stdin).get('embedding', [])))" 2>/dev/null rm -f "$tmpfile" } ``` ```python # Embedded Python in memory-pipeline/mp_mention_detect.sh for mem in memories: filepath = mem['file'] content = mem['content'][:1500] data = json.dumps({ 'model': EMBED_MODEL, 'prompt': content.replace('"', '\\"').replace('\n', ' ')[:8000] }).encode('utf-8') req = urllib.request.Request( OLLAMA_HOST + '/api/embeddings', data=data, headers={'Content-Type': 'application/json'} ) with urllib.request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode()) ``` ...[truncated 2544 chars]- Remediation
View remediation