CortexDB Agent Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

This is a coherent local memory skill, but it needs Review because it persists user data and uses a gRPC sidecar with under-specified consent, deletion, dependency, token, and transport controls.

Install only if you are comfortable with a local sidecar durably storing memories and knowledge supplied by the agent. Use pinned dependency versions, replace the sample token with a strong generated secret, keep the endpoint bound to localhost unless TLS is configured, and establish clear rules for what may be remembered and how stored data can be reviewed or deleted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-47
Vulnerability Type: Supply-chain exposure through mutable dependency versions
Risk Level: Medium

Vulnerable Code

bash

# install the binary (or download a prebuilt release)
go install github.com/liliang-cn/cortexdb/v2/cmd/cortexdb-grpc@latest

bash

npm install cortexdb-client

Technical Analysis

The documented installation procedure retrieves the CortexDB gRPC binary using the mutable @latest version and installs the Node.js client without specifying a reviewed version. Consequently, the code installed by users can change after the skill itself has been audited.

This creates a supply-chain trust gap: compromise of an upstream repository, package registry account, release pipeline, or transitive dependency could cause users to install code that was not included in this audit. Because installation and package lifecycle behavior occur with the invoking user's privileges, a compromised release could execute arbitrary code in that user's security context.

No evidence indicates that the current upstream components are malicious. The vulnerability is the absence of immutable version selection and integrity verification.

Attack Path

1. An attacker compromises the upstream repository, npm publishing account, release pipeline, or a relevant dependency.
2. The attacker publishes a malicious version as the latest release.
3. A user follows the documented go install ...@latest or unversioned npm install command.
4. The package manager retrieves the attacker-controlled release rather than the version originally reviewed.
5. Malicious installation or runtime code executes with the privileges of the user running the agent or sidecar.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the installing user's account. Depending on that account's permissions, the attacker could access agen ...[truncated 238 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, immutable CortexDB version or commit hash.
• Pin cortexdb-client to an exact reviewed version rather than relying on the registry's current resolution.
• Add and commit an npm lockfile with integrity metadata in an executable project distribution.
• Provide SHA-256 checksums or verified release signatures for prebuilt sidecar binaries.
• Use automated dependency scanning and controlled update procedures before changing pinned versions.
• Run the sidecar and agent under a dedicated, least-privileged operating-system account to limit the consequences of a dependency compromise.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Predictable Bearer Token in Copy-Ready Configuration Examples

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34-36
Additional Location: SKILL.md:57
Vulnerability Type: Weak hardcoded example credential
Risk Level: Medium

Vulnerable Code

bash

# lexical mode — zero config, no API key:
CORTEXDB_PATH=agent.db CORTEXDB_GRPC_TOKEN=s3cret cortexdb-grpc
# → listening on 127.0.0.1:47821

The corresponding client example reuses the same token:

js

const client = CortexClient.connect('127.0.0.1:47821', { token: 's3cret' });

Technical Analysis

The documentation uses the predictable value s3cret as a bearer token in copy-ready server and client commands. Although this is presented as an example, users may deploy the commands unchanged. Bearer-token security depends on secrecy and sufficient entropy; a publicly documented, reusable value provides neither.

The immediate default exposure is reduced because the example service listens on loopback. However, the token becomes exploitable if the service is later bound, forwarded, proxied, container-published, or otherwise exposed to another user or host.

Attack Path

1. A user copies the documented commands without replacing s3cret.
2. The gRPC endpoint becomes reachable through network binding, container port publication, SSH forwarding, a reverse proxy, or access by another local user.
3. An attacker tries the publicly documented token s3cret.
4. The sidecar accepts the attacker as an authenticated client.
5. The attacker invokes available memory, knowledge, graph, or administrative operations permitted to that token.

Impact Assessment

Successful exploitation could permit unauthorized reading, insertion, or modification of durable agent memories, knowledge documents, and graph relationships. This could expose private user information and corrupt future agent retrieval results. The precise scope depends on the permissions implemented by the CortexDB sidecar, but the helper us ...[truncated 111 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the fixed token with a generated value in the setup instructions, for example a cryptographically random token of at least 256 bits.
• Show token generation and protected loading rather than embedding a literal credential in commands.
• Clearly label all sample credentials as unsafe for production use.
• Store the token in a secret manager or a protected environment file readable only by the service account.
• Rotate any token that was deployed using the documented example.
• Keep the service bound to loopback unless authenticated TLS and network access controls are enabled.
• Where supported, use separate credentials and least-privilege authorization scopes for different clients.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/memory-tools.js:20

Finding

Remote CortexDB Connections Can Transmit Tokens and Memory Data in Plaintext

Content

View full analysis

Vulnerability Details

File Location: scripts/memory-tools.js:20-24
Related Documentation: SKILL.md:146
Vulnerability Type: Missing transport-security enforcement
Risk Level: High

Vulnerable Code

js

let _client = null;
function client() {
  if (!_client) {
    const endpoint = process.env.CORTEXDB_GRPC_ENDPOINT || '127.0.0.1:47821';
    const token = process.env.CORTEXDB_GRPC_TOKEN;
    _client = CortexClient.connect(endpoint, token ? { token } : {});
  }
  return _client;
}

The documentation confirms the transport characteristic:

md

- **Plaintext localhost**: the bearer token rides plain gRPC; fine on localhost,
  add TLS / a reverse proxy for cross-machine use.

Technical Analysis

The helper permits CORTEXDB_GRPC_ENDPOINT to reference an arbitrary remote host but does not require or configure TLS for non-loopback connections. The bearer token is therefore transmitted over plaintext gRPC, along with memory contents, search queries, knowledge documents, RDF triples, and SPARQL results.

The documentation warns users about this limitation, but the implementation does not fail closed when a remote endpoint is selected. A warning alone does not prevent accidental insecure deployment. On an untrusted network, a passive observer can capture sensitive traffic, while an active man-in-the-middle may intercept credentials, impersonate the server, or alter responses.

Attack Path

1. An operator sets CORTEXDB_GRPC_ENDPOINT to a non-loopback host or routes the connection across an untrusted network.
2. The helper calls CortexClient.connect without TLS credentials or remote-endpoint validation.
3. An attacker with network visibility captures the plaintext bearer token and memory traffic, or positions a malicious service between the client and sidecar.
4. The attacker reuses the captured token against the legitimate sidecar.
5. The attacker reads or modifi ...[truncated 751 chars]

Remediation

View remediation

Remediation Suggestions

• Reject non-loopback endpoints unless TLS is explicitly configured.
• Extend the client configuration to accept trusted CA certificates, client certificates where applicable, and strict server-name verification.
• Prefer mutually authenticated TLS for cross-machine deployments.
• Do not treat a generic plaintext reverse proxy as sufficient; ensure encryption covers the entire untrusted network path.
• Fail closed when TLS configuration is absent or invalid rather than silently falling back to plaintext.
• Keep the default sidecar bound to 127.0.0.1 and enforce firewall restrictions.
• Rotate any bearer token that may have traversed an untrusted plaintext connection.
• Add automated tests verifying that remote plaintext endpoints are refused.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

- `scripts/memory-tools.js` — import these and register them as OpenClaw tools,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill exposes operational capabilities involving environment-dependent configuration and runtime sidecar access, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, that omission can let the model invoke or recommend actions with broader access than users expect, reducing transparency and making misuse of local resources or secrets more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation cues are overly broad, including generic phrases like "RAG" and "remember this," which can cause the skill to trigger in many unrelated contexts. That increases the chance an agent will persist sensitive user content or route tasks through this memory system without clear user intent or necessity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly promotes durable storage of user facts across turns and sessions but provides no warning about persistence, retention, or privacy risks. In practice, this can lead agents to store personal or sensitive information indefinitely in local databases or knowledge graphs without informed consent, deletion controls, or data minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module sends user memory and knowledge content to a separate CortexDB gRPC sidecar for storage and retrieval, but provides no consent flow, notice, or controls around persistence. Even though the sidecar is described as local-first, it is still an external service boundary from the agent process and may store sensitive user data durably, creating privacy and compliance risk if users are unaware.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.