Security audit

Launchthatbot Convex Backend

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Convex-backed memory and secrets, but it exposes persistent memory/log functions without evident authorization checks and relies on mutable npm tooling around deploy credentials.

Review before installing. Use only with a Convex project you control, avoid shared or public deployments until the memory/log functions enforce authentication and per-agent ownership, pin the Convex and mcporter package versions, and do not migrate local secrets unless you understand that they will be centralized in Convex env storage.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: convex/memory.js:6
Finding: Missing Authorization Allows Cross-Agent Memory Access, Poisoning, and Deletion
Content: View full analysis
{ return await ctx.runMutation(components.openclawBackend.memory.addMemory, args); }, }); export const searchMemory = query({ args: { agentId: v.string(), type: v.optional( v.union( v.literal("fact"), v.literal("preference"), v.literal("decision"), v.literal("note"), ), ), limit: v.optional(v.number()), }, returns: v.array( v.object({ _id: v.string(), type: v.union( v.literal("fact"), v.literal("preference"), v.literal("decision"), v.literal("note"), ), content: v.string(), tags: v.optional(v.array(v.string())), createdAt: v.number(), }), ), handler: async (ctx, args) => { return await ctx.runQuery(components.openclawBackend.memory.searchMemory, args); }, }); export const deleteMemory = mutation({ args: { memoryId: v.string(), }, returns: v.boolean(), handler: async (ctx, args) => { return await ctx.runMutation(components.openclawBackend.memory.deleteMemory, args); }, }); ``` The component trusts the supplied `agentId` and deletes records without checking ownership: ```js export const searchMemory = query({ args: { agentId: v.string(), type: v.optional( v. ...[truncated 3976 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:75
Finding: Mutable and Unpinned npm Packages Are Executed with Deployment Credentials
Content: View full analysis
", "type": "fact", "content": "User prefers TypeScript over JavaScript for all new projects", "tags": ["preferences", "coding"] } }' ``` ### Technical Analysis `npx -y` can download and execute npm packages without an interactive confirmation. The `convex@latest` selector is mutable, and the `mcporter` commands do not specify any version. Therefore, the code executed by these instructions can differ from the code reviewed during this audit. The deployment command is particularly sensitive because `CONVEX_DEPLOY_KEY` is present in the child process environment. npm packages and their transitive dependencies execute locally and may access inherited environment variables, files available to the process, and network resources. No malicious behavior was found in the supplied repository. The risk arises from the documented future execution of mutable third-party artifacts. ### Attack Path 1 ...[truncated 1106 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: convex/components/openclawBackend/memory.js:30
Finding: Caller-Controlled Query Limits Are Not Bounded
Content: View full analysis
{ const maxResults = args.limit ?? 50; if (args.type) { const entries = await ctx.db .query("agentMemory") .withIndex("by_agentId_and_type", (q) => q.eq("agentId", args.agentId).eq("type", args.type), ) .order("desc") .take(maxResults); return entries.map((entry) => ({ _id: entry._id, type: entry.type, content: entry.content, tags: entry.tags, createdAt: entry.createdAt, })); } const entries = await ctx.db .query("agentMemory") .withIndex("by_agentId", (q) => q.eq("agentId", args.agentId)) .order("desc") .take(maxResults); return entries.map((entry) => ({ _id: entry._id, type: entry.type, content: entry.content, tags: entry.tags, createdAt: entry.createdAt, })); }, }); ``` The daily-log listing function has the same weakness: ```js export const listDailyLogs = query({ args: { agentId: v.string(), limit: v.optional(v.number()) ...[truncated 2100 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description promises a functional backend capability for storing various kinds of data in Convex. However, the provided code chunk is merely a minimal component definition/configuration file and contains no logic for reading, writing, persisting, or managing data. This is a material mismatch in primary purpose and implemented capabilities.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The README instructs users to execute npx convex without pinning a specific package version, which means the code fetched and run at install time can change unexpectedly. In a security-sensitive skill that manages secrets and backend persistence, a compromised upstream package, typosquatted dependency path, or malicious future release could result in arbitrary code execution in the user's environment and exposure of local credentials such as CONVEX_DEPLOY_KEY.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The command npx -y convex@latest mcp start explicitly tracks the latest release, guaranteeing unreviewed code updates will be executed over time. Because this MCP server is central to secret handling and persistent memory operations, a malicious or compromised release could directly access sensitive data and execute arbitrary logic under the user's permissions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx -y mcporter --version without a pinned version causes the package manager to download and execute whatever version is current at runtime. Even though this specific command appears to be a version check, it still executes remote package code and can therefore be abused if the upstream package or dependency chain is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The unpinned npx -y mcporter list command executes code from the latest resolved package version, creating a supply-chain risk. In this skill context, the tool is used to enumerate MCP integrations and could be a foothold for malicious code execution before secret-management workflows even begin.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README directs users to run npx -y mcporter list convex --schema without pinning the package version, allowing execution of mutable upstream code. Because this command probes the Convex integration schema in a workflow involving deployment keys and backend access, compromise of the package could misrepresent capabilities or exfiltrate environment data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The example npx -y mcporter call convex.run --args ... executes an unpinned CLI in a context that performs backend function calls and processes sensitive operational data. If the package source is compromised, the attacker could tamper with requests, intercept arguments, or run arbitrary code on the host while the user believes they are only calling Convex functions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The deployment instruction CONVEX_DEPLOY_KEY=... npx -y convex@latest deploy combines an unreviewed latest package fetch with a highly sensitive credential in the same process environment. This materially increases risk because a malicious or compromised package release could read the deploy key, alter deployment contents, or exfiltrate credentials while performing the documented deploy step.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The redeploy instruction again uses npx -y convex@latest deploy, reintroducing mutable-code execution during an authenticated deployment workflow. Since this skill's purpose is persistent storage of secrets and memory in Convex, compromise here could affect both host execution and the integrity/confidentiality of the backend state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description says to use the skill whenever the user wants durable memory, daily logs, or safer secret handling, but it does not define concrete trigger phrases, boundaries, or exclusion cases. In a markdown skill description, this can cause unintended activation because these needs overlap with many ordinary agent interactions involving memory or secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill instructs users to launch an MCP server with an unpinned package reference (npx convex/effectively latest), which allows supply-chain drift and potentially execution of a compromised or incompatible package version. Because this server is used for secrets, memory, and backend access, a malicious update could gain broad access to sensitive data and agent workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The guidance invokes mcporter via unpinned npx -y mcporter, which can fetch and execute whatever version is current at runtime. This creates a supply-chain risk and makes behavior non-deterministic, especially dangerous in a workflow that mediates access to Convex functions and secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This line repeats unpinned execution of mcporter, exposing users to silent package changes or compromise at install time. Since the tool is part of the trust boundary for backend calls, an attacker controlling the package or dependency chain could influence or exfiltrate data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Another unpinned mcporter invocation introduces the same runtime package-substitution risk. Repetition across preflight steps increases the chance users will execute unsafe commands verbatim.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Telling users they need npx mcporter without a version keeps the execution path open to unreviewed upstream changes. In a secrets-management skill, that expands the blast radius of any package compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command again uses unpinned mcporter to perform backend calls, combining package-execution risk with direct access to storage and environment variable operations. If the fetched package were malicious, it could tamper with or leak secrets and memory records.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The preflight re-run command still uses unpinned mcporter, so the same supply-chain risk remains in the bootstrap path. Because users may run this while configuring deploy credentials, compromise could coincide with sensitive setup steps.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The deployment command uses npx -y convex@latest deploy, explicitly opting into the newest published version at execution time. That makes deployments non-reproducible and exposes a high-value action—shipping backend code using deploy credentials—to supply-chain compromise or breaking changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Referencing npx convex deploy without version pinning leaves the deployed backend behavior dependent on whatever package version is resolved at runtime. This undermines reproducibility and can introduce compromised code into the deployment process.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill encourages bulk migration of local .env secrets into a remote backend and subsequent deletion from local storage, but the privacy and operational risks are not prominently surfaced before the procedure. Even with some safety notes, this can lead users to centralize highly sensitive secrets in a cloud service and remove local recovery paths without fully understanding consequences such as broader backend exposure, retention, access control, or outage impact.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to persist broad user preferences, decisions, observations, and daily session summaries into long-term storage, creating a natural-language data leakage risk. Free-form memory and logs often capture sensitive information incidentally, and the startup checklist normalizes repeated retrieval of that data, increasing exposure if backend permissions, logging, or downstream tools are compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The example for convex.run is mediated through another unpinned mcporter invocation, preserving the same package execution risk inside normal operational use. Because it is part of memory persistence, compromise could affect stored user context and logs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx -y convex@latest deploy, which fetches and executes the latest published CLI version at runtime rather than a pinned, reviewed version. If the upstream package is compromised or a breaking/malicious release is published, users could execute untrusted code during deployment, and this skill context makes that meaningful because the command is presented as a required operational step and includes a deployment key in the environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The deleteMemory mutation deletes any agentMemory record by raw memoryId without verifying that the caller is authorized to delete it or that the record belongs to a specific agent context. In a backend intended to store long-term memory and secrets, this enables cross-agent or unauthorized destructive access if an attacker can obtain or guess a valid document ID, causing loss or tampering of stored state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The deleteMemory mutation deletes stored agent memory via ctx.db.delete without any visible confirmation prompt, logging, or inline documentation warning that data will be removed. For a code file, deletions are safety-relevant operations and this file does not provide any disclosure around that action.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.