Security audit
Security checks for vulnerabilities and agentic risk
This skill is intended to manage local data pods, but it needs review because its advertised consent protections are not enforced and it can persist, import, export, and package sensitive data with weak safeguards.
Install only if you are comfortable reviewing each operation before it runs. Avoid using it for health, personal, client, or confidential research data until pod-name validation, safe archive import, read-only query controls, enforced consent checks, and clear export/LLM-sharing warnings are added. Treat exported .vpod and LLM markdown files as containing the full sensitive contents of the selected pod.
scripts/pod.py:118Consent Layer Is Not Enforced by Pod Operations
scripts/pod.py:27Unvalidated Pod Names Allow Filesystem Path Traversal
scripts/podsync.py:76Archive Import Destination Can Escape the Pod Storage Directory
SKILL.md:63Unpinned Dependencies and Mutable Embedding Model Retrieval Create Supply-Chain Risk
Claiming capabilities that do not exist is not just a product-quality issue; it can mislead operators about what data is processed, how, and where. Undeclared export or packaging behavior for LLM/ChatGPT context could move data into new contexts and create confidentiality risks if users assume the skill remains purely local and limited to pod management.
Claiming capabilities that do not exist is not just a product-quality issue; it can mislead operators about what data is processed, how, and where. Undeclared export or packaging behavior for LLM/ChatGPT context could move data into new contexts and create confidentiality risks if users assume the skill remains purely local and limited to pod management.
Claiming capabilities that do not exist is not just a product-quality issue; it can mislead operators about what data is processed, how, and where. Undeclared export or packaging behavior for LLM/ChatGPT context could move data into new contexts and create confidentiality risks if users assume the skill remains purely local and limited to pod management.
Claiming capabilities that do not exist is not just a product-quality issue; it can mislead operators about what data is processed, how, and where. Undeclared export or packaging behavior for LLM/ChatGPT context could move data into new contexts and create confidentiality risks if users assume the skill remains purely local and limited to pod management.
The skill encourages ingestion, semantic indexing, and export/sharing of documents, including potentially sensitive categories like health and research data, without clear privacy and data-handling warnings. In this context, users may unintentionally ingest confidential files, create searchable local embeddings, or share pod archives without understanding the exposure risk.
The README makes strong security claims about a built-in consent layer, explicit permission checks, and audit logging, while also documenting direct pod query commands that appear to bypass that layer. This is dangerous because users may rely on a false access-control boundary for sensitive local data, causing unauthorized agent or local process access if the actual tooling does not enforce consent at the query path.
The skill advertises and instructs use of shell commands plus file read/write behavior, but it declares no explicit tool scope or permissions boundary. That creates a confused-deputy risk where an agent may execute filesystem and shell actions without transparent authorization, especially because the commands operate on user-provided names, content, and paths.
The skill is explicitly designed around persistent local storage of pods, metadata, and possibly embeddings, which creates session persistence and data-retention risk. In context, persistence is core functionality, but without clear retention, consent, and visibility controls it can accumulate sensitive user content and make later unauthorized access more damaging.
---
name: data-pods
description: Create and manage modular portable database pods (SQLite + metadata + embeddings). Includes document ingestion with embeddings for semantic search. Full automation - just ask.
---
# Data Pods
Overly broad trigger text increases the chance that the skill auto-activates during ordinary conversation and performs file or shell operations without a narrowly expressed user intent. Because this skill can create, modify, ingest, and export local data, accidental invocation materially raises the risk of unintended actions on sensitive files.
Trigger phrases such as 'add note,' 'add content,' or 'search pod' overlap with common user requests and can cause the skill to intercept benign conversation. In a skill with shell, file, and persistence behavior, unintended routing can lead to unauthorized file processing, local data writes, or disclosure of stored pod contents.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# List pods
python pod.py list
# Create a pod
python pod.py create my-research --type scholar
# Add a note
The usage guide explicitly encourages exporting pod data for sharing but does not warn that the archive may contain sensitive note content, metadata, and potentially derived embedding data. In a data-management skill, this omission can lead users to disclose private research, notes, or other stored information unintentionally.
The manifest describes a skill for creating and managing portable database pods with ingestion and semantic search. This file instead implements agent consent session management and audit logging in a separate SQLite database under ~/.openclaw/consent, which is a materially different operational scope rather than an obvious implementation detail of pod creation or ingestion.
The functions grant, revoke, check_consent, and log_access implement authorization and auditing features for agents, including session issuance and access logging. Those capabilities are not mentioned in the manifest's stated purpose of managing database pods and document ingestion, so they introduce a governance/control plane unrelated to the declared user-facing scope.
The audit log persists raw query text to a local SQLite database, which can capture sensitive user inputs, secrets, personal data, or proprietary search terms without any disclosure, minimization, or redaction. In a data-pod skill handling document ingestion and semantic search, query contents are especially likely to contain confidential business or personal information, increasing privacy and data-retention risk.
The code passes extracted document text into SentenceTransformer(model_name), which in many environments can trigger model downloads or interaction with external resources, and users are not warned that document-derived text is being processed for embeddings. The file mentions embeddings generically, but it does not disclose this data-processing behavior in a user-facing warning.
The script stores full extracted document contents and chunked text into a local SQLite database without any explicit consent prompt, warning, or data-retention notice. Because this skill is designed for broad document ingestion and automation, users may unintentionally persist sensitive local file contents in a long-lived pod database, increasing confidentiality and privacy risk if the pod is later accessed, copied, or exposed.
The skill description says it includes document ingestion with embeddings for semantic search. In this file, the embeddings functionality is not implemented beyond schema creation, and query behavior is limited to raw SQL or LIKE-based text search rather than semantic retrieval.
The query command executes caller-supplied raw SQL directly against the pod database with no restriction to read-only statements. This enables any user or upstream agent invoking the skill to read, modify, or delete pod contents, and potentially attach other SQLite databases or use dangerous pragmas depending on the runtime environment.
The CLI exposes a raw --sql option without warning that statements may be destructive, and it routes directly into unrestricted execution. In an agent skill context, this is more dangerous because higher-level automation may treat query as informational while a prompt or tool caller can issue DELETE, DROP, UPDATE, or other state-changing commands.
zipf.extractall(pod_path) extracts untrusted archive contents without validating member paths, enabling zip-slip style path traversal if a crafted archive contains filenames such as ../.... An attacker could overwrite arbitrary files writable by the user outside the pod directory during import, which is more severe than merely lacking a warning about disk writes.
The pack_for_llm feature intentionally converts all note contents from a pod into a single markdown file explicitly described as 'Ready to paste into ChatGPT!'. This creates a clear data exfiltration path for potentially sensitive pod contents to external LLM services, and the skill context only partially justifies it because the manifest emphasizes pod management/sync rather than exporting private data to third-party AI systems.
This code adds a capability to prepare pod contents for use with external LLMs, which materially expands the data-sharing surface beyond local pod storage and ordinary sync/export. Even if intended as a convenience feature, bundling full note bodies into a shareable file can expose confidential information to users, other local processes, or third-party services once uploaded.
The LLM pack operation writes complete note contents to a markdown file intended for sharing with ChatGPT, but provides no privacy warning or confirmation despite the high likelihood that pods contain personal or sensitive information. In this skill context, that omission makes accidental disclosure more likely because the feature encourages copying the output into an external service.
The pod layout says embeddings/ is a future component, but later sections advertise v0.2 document ingestion with embeddings, semantic search, and related features as available commands. These statements directly conflict about whether embeddings support is implemented now or only planned.