LanceDB Hybrid Search Memory Plugin

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:49 PM UTC
• Version: 1.2.1

Overview

The skill is a coherent memory plugin, but it can automatically send prompts to an embedding provider and persist conversation details, so users should review its privacy impact before installing.

Install only if you are comfortable with long-term memory for your conversations and with prompts or remembered text being sent to the configured embedding provider. Use a local embedding endpoint or disable auto-recall/auto-capture for sensitive work, and review or delete stored memories regularly.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description frames the skill as a search enhancement, but the documented behavior includes automatic recall/capture, memory injection into agent context, plugin override of the built-in memory-lancedb, and use of an external embeddings API. That mismatch is security-relevant because users may install what appears to be a retrieval improvement while actually enabling persistent data capture, context manipulation, and third-party data transfer, which materially changes confidentiality and integrity risk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

- `plugin/index.ts` – plugin implementation (hybrid search)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · plugin/index.ts (reported line 442)May include surrounding context.

ts

if (!normalized) {
		return false;
	}
	return PROMPT_INJECTION_PATTERNS.some((pattern) => pattern.test(normalized));
}

export function escapeMemoryForPrompt(text: string): string {

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest requests an embedding API key and references OpenAI-compatible embedding endpoints, but it does not clearly warn users that conversation-derived content may be transmitted to an external provider for embedding generation. In a memory system, this can expose sensitive text outside the local environment and materially changes the trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents auto-capture as a convenience feature without clearly warning that it may store conversation data in long-term memory. Users may enable it without understanding that potentially sensitive prompts, responses, or personal information can be retained, creating confidentiality and privacy exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises a plugin that uses environment-derived secrets such as ${OPENAI_API_KEY} and overrides a built-in memory plugin, but the skill manifest declares no explicit tool scope or permissions boundaries. In a plugin that can access memory, embeddings, and runtime configuration, missing scope disclosure reduces transparency and can cause operators to enable code with broader capabilities than they realize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The plugin exposes auto-capture and auto-recall features for conversation data without any explicit privacy or data-handling warning in the UI hints. In a long-term memory plugin, this can cause users to unknowingly persist sensitive conversational content and later re-inject it into context, increasing confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The memory_store and memory_forget tools perform persistent storage and deletion actions immediately once invoked, without an in-tool confirmation step or user-facing warning in this file. In an agent setting, that can lead to unintended retention or erasure of user data if the model calls the tool mistakenly or under prompt manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

In before_agent_start, the plugin sends the full prompt to the embeddings API for recall, which can disclose sensitive user input to a third-party model provider without any warning or minimization shown in this file. This expands data exposure from local memory search to external processing, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auto-capture hook persists user message content to long-term storage automatically after successful agent runs, with no consent check, notice, or per-message confirmation visible in this file. Because the plugin is specifically a memory component, this can silently retain sensitive personal data, secrets, or regulated information beyond the user's immediate interaction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · plugin/config.ts (reported line 180)May include surrounding context.

ts

},
    "embedding.baseUrl": {
      "label": "Base URL",
      "placeholder": "https://api.openai.com/v1",
      "help": "Base URL for compatible providers (e.g. http://localhost:11434/v1)",
      "advanced": true
    },

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · plugin/openclaw.plugin.json (reported line 18)May include surrounding context.

json

},
    "embedding.baseUrl": {
      "label": "Base URL",
      "placeholder": "https://api.openai.com/v1",
      "help": "Base URL for compatible providers (e.g. http://localhost:11434/v1)",
      "advanced": true
    },

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest exposes an 'Auto-Capture' capability that broadly states it will automatically capture important conversation information, but it does not define trigger conditions, exclusions, or consent boundaries. In a memory plugin, this can lead to over-collection of sensitive user data and unexpected retention of conversations, which is a real privacy and security risk even if the behavior is not overtly malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest enables automatic recall of stored memories into future context but does not clearly warn that prior conversation data may be injected into later prompts. This can unintentionally surface sensitive historical information in unrelated sessions, increasing the risk of privacy leakage and overexposure to downstream models or tools.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The description at L05 frames the skill as a LanceDB-backed long-term memory plugin with recall/capture behavior. However, the dependency list includes the OpenAI SDK at L10, which suggests the skill may perform external API/model interactions not mentioned in the description; that is broader than a purely LanceDB-backed memory component.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · plugin/package.json (reported line 8)May include surrounding context.

json

"description": "OpenClaw LanceDB-backed long-term memory plugin with auto-recall/capture",
  "type": "module",
  "dependencies": {
    "@lancedb/lancedb": "^0.26.2",
    "@sinclair/typebox": "0.34.48",
    "openai": "^6.27.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · plugin/package.json (reported line 10)May include surrounding context.

json

"dependencies": {
    "@lancedb/lancedb": "^0.26.2",
    "@sinclair/typebox": "0.34.48",
    "openai": "^6.27.0"
  },
  "openclaw": {
    "extensions": [

Static analysis

No suspicious patterns detected.