T08 · Insecure Dependencies
Warning
- Location
package.json:37- Finding
Unpinned Runtime Dependencies and Missing Lockfile
- Content
View full analysis
- Remediation
View remediation
Security audit
Smart Memory System
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible memory/search skill, but it needs Review because it can persist and automatically reuse private memory or document content with weak privacy and install disclosures.
Install only if you are comfortable with conversation history or selected documents being indexed under ~/.openclaw and potentially processed by configured embedding/reranker providers. Avoid secrets, credentials, regulated data, or confidential business documents unless retention, deletion, provider privacy, and backup behavior are clarified. Prefer a release with exact pinned dependencies, a committed lockfile, present and reviewable install hooks, and explicit controls for auto-enhancement, cleanup, export, and deletion.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
.github/workflows/test.yml:16- Finding
GitHub Actions Referenced Through Mutable Version Tags
- Content
View full analysis
- Remediation
View remediation
``` 2. Add comments beside each SHA documenting the corresponding release version for maintainability. 3. Use Dependabot or an equivalent update process to propose and review action SHA changes. 4. Explicitly declare minimal workflow permissions, for example: ```yaml permissions: contents: read ``` 5. Grant elevated permissions only to jobs that require them. 6. Avoid exposing repository secrets to workflows triggered from untrusted pull requests. 7. Review action release notes and source changes before updating pinned revisions. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises automatic retrieval of historical memories and automatic context injection, but it does not warn users that prior conversation content, preferences, or potentially sensitive data may be stored and surfaced later. In a memory skill, this omission is security-relevant because users may unknowingly enable persistent collection and reuse of sensitive information across sessions or contexts.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
clawhub install smart-memory-system
或手动安装
mkdir -p ~/.openclaw/skills/ cp -r smart-memory-skill ~/.openclaw/skills/
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill promotes expired-memory cleanup and later exposes aggressive optimization, cleanup, reindex, backup, and restore workflows without warning that pruning or optimization may delete, merge, or irreversibly alter stored memory. In a system intended to preserve conversational or knowledge history, silent destructive behavior can lead to data loss, corruption of audit trails, and unsafe reliance on incomplete memory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises automatic context expansion, related-history injection, and personalized response generation without clearly warning that conversation history and memory data may be automatically collected, processed, and reused. In a memory/RAG skill, this can cause users to expose sensitive personal or organizational information without informed consent, increasing privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation instructs users to configure Edgefn-hosted embedding and reranker models but does not warn that memory content, documents, or conversation excerpts may be transmitted to an external provider for processing. Because this skill is specifically designed to handle long-term memory and semantic retrieval, omitted disclosure materially increases the chance of unintentional exfiltration of sensitive data to third parties.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description contains Chinese text ("检索增强智能记忆系统") as a user-facing label, but the manifest does not state that the skill is Chinese-only, region-specific, or that users can select their preferred language. This can violate language/locale policy by implicitly forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing banner, command descriptions, usage text, errors, and examples are all presented in Chinese throughout the file. This creates a language/locale policy concern because the skill does not offer an opt-in language choice or explain that it is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The package description is written in Chinese ("检索增强智能记忆系统") with no indication that the skill supports multiple languages or that the locale is intentionally region-specific. This can violate language/locale policy expectations when users are not offered a choice or informed of the constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code presents initialization status, success/failure messages, and generated example content entirely in Chinese, starting with the spinner text and continuing throughout the created markdown content and console output. The file does not provide any language selection, opt-in, or justification that the skill is intended only for a Chinese-language environment, which conflicts with the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains most feature descriptions and documentation notes in Chinese, while no surrounding text indicates that the skill is intentionally region-specific or that users can opt into this language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documentation is effectively presented in a single language, Chinese, with no indication that users can choose another language or that the locale restriction is intentional. This can constitute a language/locale policy issue when the skill forces one language without user opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language instructions throughout the file are presented in Chinese without indicating that users may choose another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy issue.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 79% confidence
- Finding
Using a caret range for fs-extra allows new upstream releases within the major version to be installed, which weakens build reproducibility and increases supply-chain exposure. While not an immediate exploit in itself, it can cause the installed package to drift to a vulnerable or compromised release over time.
- Content
json }, "homepage": "https://github.com/openclaw-community/smart-memory-system#readme", "dependencies": { "fs-extra": "^11.2.0", "chalk": "^5.3.0", "ora": "^7.0.1", "yargs": "^17.7.2",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The unpinned chalk dependency permits automatic uptake of later matching versions, which is risky here because the package name is already associated in the findings with a malicious advisory. In a skill that includes install and uninstall hooks, supply-chain compromise can translate into code execution during lifecycle events.
- Content
json "homepage": "https://github.com/openclaw-community/smart-memory-system#readme", "dependencies": { "fs-extra": "^11.2.0", "chalk": "^5.3.0", "ora": "^7.0.1", "yargs": "^17.7.2", "moment": "^2.29.4",
Unverifiable Dependency: chalk has 1 known advisory(ies) (MAL-2025-46969 (Malicious code in chalk (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
The manifest references chalk with a non-exact version, and the findings indicate a known malicious-package advisory affecting chalk releases. Because the version is not pinned, reviewers cannot verify whether installs will avoid the affected release set, making this a concrete supply-chain verification gap.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 78% confidence
- Finding
The ora dependency is specified with a caret range, so future compatible releases may be installed without review. This creates a general supply-chain risk and reduces reproducibility, though no specific exploit is evident from this file alone.
- Content
json "dependencies": { "fs-extra": "^11.2.0", "chalk": "^5.3.0", "ora": "^7.0.1", "yargs": "^17.7.2", "moment": "^2.29.4", "crypto-js": "^4.2.0",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 78% confidence
- Finding
An unpinned yargs version allows dependency drift and expands exposure to future vulnerable releases or compromised publishes. In package manifests, this is a recognized supply-chain weakness even when no immediate misuse is visible.
- Content
json "fs-extra": "^11.2.0", "chalk": "^5.3.0", "ora": "^7.0.1", "yargs": "^17.7.2", "moment": "^2.29.4", "crypto-js": "^4.2.0", "lodash": "^4.17.21"
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
The moment dependency is not pinned, and the findings note multiple known advisories affecting that package family. Because the manifest permits version drift, consumers may resolve to a vulnerable build, making this a realistic supply-chain and downstream vulnerability risk.
- Content
json "chalk": "^5.3.0", "ora": "^7.0.1", "yargs": "^17.7.2", "moment": "^2.29.4", "crypto-js": "^4.2.0", "lodash": "^4.17.21" },
Unverifiable Dependency: moment has 4 known advisory(ies) (CVE-2017-18214 (Regular Expression Denial of Service in moment); CVE-2016-4055 (Regular Expression Denial of Service in moment); CVE-2022-24785 (Path Traversal: 'dir/../../filename' in moment.locale) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
moment is associated with several historical advisories, and the current version range does not let auditors confirm that only unaffected releases will be installed. This is dangerous because downstream consumers may resolve different package versions over time, including vulnerable ones.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
crypto-js is version-ranged with a caret and is additionally associated with multiple cryptographic advisories in the findings. In a system described as a smart memory/RAG component, weak or compromised cryptographic behavior could affect stored data confidentiality or integrity if the library is used for secrets or encryption.
- Content
json "ora": "^7.0.1", "yargs": "^17.7.2", "moment": "^2.29.4", "crypto-js": "^4.2.0", "lodash": "^4.17.21" }, "devDependencies": {
Unverifiable Dependency: crypto-js has 3 known advisory(ies) (CVE-2020-36732 (crypto-js uses insecure random numbers); CVE-2026-71851 (crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerabl); CVE-2023-46233 (crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
crypto-js has multiple listed cryptographic weaknesses, and the manifest does not pin an exact version, so the actual resolved release may still be vulnerable. In a memory or backup-oriented skill, cryptographic flaws can directly undermine confidentiality, integrity, and trust in stored or restored data if the library is used for secret generation, key derivation, or encryption.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The lodash dependency is unpinned and has a long history of advisories, including serious classes like command injection and prototype pollution. In a skill that processes retrieval and integration tasks, broad utility libraries often sit on high-traffic code paths, so accidental resolution to a bad version can meaningfully increase exploitability.
- Content
json "yargs": "^17.7.2", "moment": "^2.29.4", "crypto-js": "^4.2.0", "lodash": "^4.17.21" }, "devDependencies": { "@types/node": "^20.10.0",
Unverifiable Dependency: lodash has 10 known advisory(ies) (CVE-2020-28500 (Regular Expression Denial of Service (ReDoS) in lodash); CVE-2021-23337 (Command Injection in lodash); CVE-2018-16487 (Prototype Pollution in lodash) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
lodash has numerous advisories, including classes that can become serious depending on how inputs are processed, and the loose version range prevents verification of safety. In a data-processing skill, utility-library flaws may be reachable through parsing, merging, or object-manipulation paths.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "lodash": "^4.17.21" }, "devDependencies": { "@types/node": "^20.10.0", "jest": "^29.7.0" }, "engines": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json }, "devDependencies": { "@types/node": "^20.10.0", "jest": "^29.7.0" }, "engines": { "node": ">=18.0.0",