ClawHub
Back to skill

Security audit

Notes Knowledge Mapper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local document knowledge-mapping helper with disclosed local storage, but its submitted package appears incomplete and users should understand that imported notes persist on disk.

Before installing, confirm you have the actual knowledge-graph CLI implementation because it was not included in the inspected artifact. Treat imported notes as persistent local data stored under ~/.openclaw/data/knowledge-graph/ and avoid adding sensitive documents unless you are comfortable managing or deleting that database yourself.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The natural-language instructions and usage guidance are presented in Chinese throughout the markdown file, while the skill does not indicate that it is intentionally region-specific or provide an opt-in language choice. This can violate language/locale policy expectations because users may be forced into a specific language without prior consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation encourages users to add personal notes and research documents but does not clearly warn, at the point of use, that content is persisted in a local SQLite database under the user's home directory. This can create a privacy and data-retention risk because users may reasonably assume the tool performs transient analysis, especially given the skill metadata's local-first framing, and may ingest sensitive notes without realizing they remain stored on disk.

Static analysis

No suspicious patterns detected.