obsidian-memory-system

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 3.0.40

Overview

The skill does not show clear malware, but its payment and local-data handling are too loosely scoped and under-disclosed for automatic installation.

Review before installing. Use this only if you are comfortable with a payment-gated skill that writes your question and payment metadata under ~/.openclaw/skills/orders, invokes external clawtip tooling, and declares broad credential/filesystem permissions. Avoid putting secrets in the question text, and prefer a version that narrows permissions, fixes payment verification, uses restrictive file permissions, and accurately documents stored data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/service.py:51

Finding

Payment Authorization Can Be Forged Through Local Order Data

Content

View full analysis

bool: credential = order_data.get("payCredential") if not credential: return False credential_ts = order_data.get("credentialTimestamp") if credential_ts and time.time() - credential_ts > CREDENTIAL_TTL: return False return True ``` ```python pay_status = order_data.get("payStatus", "SUCCESS") print(f"PAY_STATUS: {pay_status}") if pay_status != "SUCCESS": print(f"ERROR_INFO: Payment status is '{pay_status}', cannot proceed") sys.exit(1) ``` ### Technical Analysis The service treats any non-empty `payCredential` value as valid. It does not cryptographically verify the credential's signature, issuer, order number, amount, recipient, or integrity. Expiration also fails open: if `credentialTimestamp` is absent, the credential is accepted indefinitely. Similarly, an absent `payStatus` defaults to `SUCCESS`. Consequently, local JSON fields controlled by the user are treated as authoritative payment evidence. ### Attack Path 1. Run `create_order.py` to create an order file or manually create one under the expected order directory. 2. Edit the order JSON and add a non-empty value such as `"payCredential": "x"`. 3. Omit `credentialTimestamp` so that expiration is not enforced. 4. Omit `payStatus`, causing it to default to `SUCCESS`. 5. Run `python3 scripts/service.py ""`. 6. The script prints `AUTHORIZATION_RESULT=verified` without validating a genuine payment. ### Impact Assessment Any user or process able to modify the local order file can bypass the payment gate. This permits unauthorized service activation and undermines the integrity of the payment workflow. The issue does not, by itself, grant operating-system privileges or remote access. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_order.py:49

Finding

Order Files Are Created Without Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_order.py:156

Finding

Payment Metadata Encryption Fails Open to Plaintext Storage

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

External Packages Are Installed and Executed Without Artifact Integrity Verification

Content

View full analysis

-i -v 1.0.12 ``` ### Technical Analysis The prerequisite installs the `clawtip` Skill without specifying a reviewed version or artifact digest. The sandbox command uses `npx --yes`, which can automatically download and execute registry-delivered JavaScript code. Although the sandbox CLI is version-pinned to `1.0.0`, version pinning alone does not verify that the retrieved artifact is the reviewed artifact, and it does not necessarily lock transitive dependencies. The project provides no checksum, signature, lockfile, or vendored dependency for either installation path. ### Attack Path 1. A user follows the installation or sandbox-payment instructions. 2. The package manager contacts an external registry and downloads the named package and its dependencies. 3. If the package, registry account, distribution artifact, or a transitive dependency has been compromised, malicious installation or runtime code executes locally. 4. That code runs with the privileges available to the user or Agent invoking the command. ### Impact Assessment A compromised dependency could access files, environment variables, network resources, and credentials available to the invoking process. The reviewed project does not itself contain such a payload; the risk arises from automatically retrieving and executing unverified third-party code. ]]>

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Declared Credential and Filesystem Permissions Exceed Demonstrated Requirements

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to always interact in Chinese removes user choice and can impair informed consent, comprehension, and safe use for non-Chinese-speaking users. In a payment-related skill, language forcing can increase the chance that users misunderstand billing, permissions, or data-handling details, even though it does not by itself create code execution or data exfiltration risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring claims the order file contains only a narrow set of fields, but the implementation stores more data than advertised. Security-relevant misdocumentation is dangerous because users may provide sensitive consultation content under false assumptions about local persistence and what payment metadata is retained.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The script explicitly accepts a free-form 'question' from the command line and writes it to a persistent file under the user's home directory. In the context of a memory/persistence skill, this creates a real privacy and data-retention risk because users may include sensitive project, personal, or credential-adjacent content that remains on disk without minimization, access restriction, or expiry.

Content

Scanner excerpt · scripts/create_order.py (reported line 181)May include surrounding context.

python

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create obsidian-memory-system order for clawtip payment"
    )
    parser.add_argument("question", help="User question / consultation content")
    args = parser.parse_args()

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The console notice says the saved order contains only 'orderNo, amount, question only', but the code actually persists additional fields including payTo, encrypted_data, description, resource_url, and slug. This mismatch can mislead users and downstream tooling about what is being stored locally, causing accidental exposure of more metadata or payment-related information than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code loads a per-user JSON order file from the home directory and the module docstring states it reads payCredential. Although error/status messages are printed, there is no explicit disclosure to the user that the script accesses local payment-related credential data before doing so.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.