Security audit

Corpus RAG & KG Search

Security checks for vulnerabilities and agentic risk

Overview

This plugin coherently provides user-triggered private corpus and knowledge-graph search, with credential use and token caching disclosed and scoped to that purpose.

Install only if you intend to connect OpenClaw to the configured private corpus service and are comfortable storing the plugin credentials and cached access token in your OpenClaw config. Queries and returned context will go to the configured baseUrl under the access permitted by dataAuthKey.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill metadata declares the skill as `corpus-kg-search`, but the body instructs use of `general-kg-search`, creating an inconsistency in the intended tool target. This can cause the agent to invoke the wrong backend or route sensitive knowledge-graph queries to an unintended plugin, leading to authorization mistakes, data exposure, or failed policy enforcement.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The user-facing description and usage instructions are entirely in Chinese, which imposes a specific language/locale on operators without any opt-in or alternative. Under the stated policy, locale constraints should either be optional for users or explicitly justified as region-specific.

Static analysis

No suspicious patterns detected.