Back to skill

Security audit

Jasper Recall

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate memory-search purpose, but it can expose private agent memory and includes unsafe server and command execution paths.

Review this before installing. Only use it with memory you are comfortable sending to the SkillBoss embedding API, avoid enabling autoRecall or private server access until the command-injection and authentication issues are fixed, bind the server to localhost only, and prefer pinned package/dependency versions.

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

other

Error
Location
scripts/index-digests.py:31
Finding

Private Agent Memory and Recall Queries Are Transmitted to an External Embedding API

Content
View full analysis
list: """Get text embedding via SkillBoss API Hub.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "embedding", "inputs": {"text": text}}, timeout=60, ) return r.json()["result"]["data"][0]["embedding"] def get_embeddings_batch(texts: list) -> list: """Get embeddings for multiple texts via SkillBoss API Hub.""" return [get_embedding(t) for t in texts] ``` ```python # Default: private return 'private' ``` ```python # Generate embeddings via SkillBoss API Hub embeddings = get_embeddings_batch(chunks) ``` ```python with open(filepath, 'r', encoding='utf-8') as f: content = f.read() ``` Query-time transmission uses the same external service: ```python SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] API_BASE = "https://api.heybossai.com/v1" def get_embedding(text: str) -> list: """Get text embedding via SkillBoss API Hub.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "embedding", "inputs": {"text": text}}, timeout=60, ) return r.json()["result"]["data"][0]["embedding"] ``` ### Technical Analysis The indexer reads Markdown files from the OpenClaw memory workspace, splits their contents into approximately 500-character chunks, and sends each chunk to `https://api.heybossai.com/v1/pilot`. This includes content classified as `private_memories`; collection ...[truncated 1798 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
cli/server.js:20
Finding

Shell Command Injection Through Attacker-Controlled Recall Queries

Content
View full analysis
`"${a}"`).join(' ')}`, { encoding: 'utf8' }); return options.json ? JSON.parse(result) : result; } ``` The installed OpenClaw plugin copy also invokes a shell: ```typescript function runRecall(query: string, options: { limit?: number; json?: boolean; publicOnly?: boolean } = {}): string { const args = [JSON.stringify(query)]; if (options.limit) args.push('-n', String(options.limit)); if (options.json) args.push('--json'); if (options.publicOnly) args.push('--public-only'); const recallPath = path ...[truncated 1941 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
cli/server.js:92
Finding

Unauthenticated Wildcard-CORS HTTP API Exposes Memory Search

Content
View full analysis
{ console.log(`🦊 Jasper Recall Server running on http://${host}:${port}`); ``` ### Technical Analysis The server does not authenticate clients or authorize recall requests. It sets `Access-Control-Allow-Origin: *`, allowing JavaScript from any website to read responses whenever the browser can reach the service. The default loopback binding reduces exposure but does not prevent browser-origin attacks because a malicious website can initiate requests to loopback services. The CLI also explicitly permits binding to `0.0.0.0`. Public-only mode limits the default collection scope but does ...[truncated 1225 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
scripts/write-learning.py:53
Finding

Sandboxed Agents Can Persist Untrusted Content That Is Automatically Injected Into Future Agent Prompts

Content
View full analysis
`- [${r.source || 'memory'}] ${r.content.slice(0, 500)}${r.content.length > 500 ? '...' : ''}`) .join('\n'); api.logger.info(`[jasper-recall] Auto-injecting ${relevant.length} memories into context`); return { prependContext: `\nThe following memories may be relevant to this conversation:\n${memoryContext}\n`, }; ``` ...[truncated 2050 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/digest-sessions.sh:83
Finding

Session Digestion Copies Raw Conversation Excerpts Into Remotely Embedded Memory Without Privacy Enforcement

Content
View full analysis
/dev/null | \ grep -v "^\[message_id:" | \ grep -v "^System:" | \ grep -v "^{" | \ head -10 || echo "") tools=$(jq -r '.message.content[]? | select(.type == "toolCall") | .name' "$session_file" 2>/dev/null | \ sort | uniq -c | sort -rn | head -5 | awk '{print $2 " (" $1 "x)"}' | tr '\n' ', ' | sed 's/, $//' || echo "") # Create digest file for this session digest_file="$DIGEST_DIR/${session_id:0:8}-$date.md" if [[ "$DRY_RUN" == "false" ]]; then cat > "$digest_file" << EOF # Session ${session_id:0:8} — $date **Size:** $size | **Messages:** $msgs **Tools:** ${tools:-none} ## Topics $(echo "$topics" | head -5 | sed 's/^/- /' | grep -v "^- $" || echo "- (no topics extracted)") --- *Full session: $session_file* EOF # Update state jq --arg s "$session_id" '.processed += [$s] | .lastRun = now' "$STATE_FILE" > "${STATE_FILE}.tmp" && mv "${STATE_FILE}.tmp" "$STATE_FILE" echo " ✓ Created: $(basename $digest_file)" else echo " [dry-run] Would create: $(basename $digest_file)" fi ``` The resulting digest directory is indexed: ```python # Session digests if os.path.exists(DIGESTS_DIR): files_to_index.extend(glob.glob(os.path.join(DIGESTS_DIR, "*.md"))) # Daily notes and other memory files (but not subdirs) files_to_index.extend(glob.glob(os.path.join(MEMORY_DIR, "*.md"))) ``` ```python with open(filepath, 'r', encoding='utf-8') as f: content = f.read() ``` ### Technical Analysis The digester extracts user-message text directly from JSONL sessio ...[truncated 1310 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
cli/jasper-recall.js:143
Finding

Setup and Repair Install Unpinned Python Dependencies

Content
View full analysis
/dev/null || pip3 show chromadb 2>/dev/null`); ``` ```javascript const result = exec(`${pipPath} install chromadb`, { silent: false }); ``` ```javascript const transformersResult = exec(`${pipPath} show sentence-transformers 2>/dev/null || pip3 show sentence-transformers 2>/dev/null`); ``` ```javascript const result = exec(`${pipPath} install sentence-transformers`, { silent: false }); ``` ### Technical Analysis The setup and automatic repair paths install the latest versions resolved by PyPI at execution time. No exact versions, hashes, constraints file, or lockfile are supplied. Python packages can execute installation-related and runtime code, and their transitive dependency graph may change independently of this audited package. The source does not establish that these packages are malicious. The vulnerability is the lack of reproducibility and integrity controls, which allows future compromised or incompatible upstream releases to enter the execution environment without a corresponding Jasper Recall code change. ### Attack Path 1. A user runs `npx jasper-recall setup` or uses `doctor --fix`. 2. The program invokes pip without pinned versions or hashes. 3. Pip resolves whichever matching releases and transitive dependencies are current at that time. 4. Downloaded package code is installed into t ...[truncated 425 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (91)

Tainted flow: 'SKILLBOSS_API_KEY' from os.environ (line 31, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/index-digests.py (reported line 37)May include surrounding context.

python
def get_embedding(text: str) -> list:
    """Get text embedding via SkillBoss API Hub."""
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json={"type": "embedding", "inputs": {"text": text}},

Tainted flow: 'SKILLBOSS_API_KEY' from os.environ (line 23, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/recall.py (reported line 29)May include surrounding context.

python
def get_embedding(text: str) -> list:
    """Get text embedding via SkillBoss API Hub."""
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json={"type": "embedding", "inputs": {"text": text}},

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.

"Collection not found"

bash
rm -rf ~/.openclaw/chroma-db  # Clear and rebuild
index-digests

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.

"Collection not found"

bash
rm -rf ~/.openclaw/chroma-db  # Clear and rebuild
index-digests

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx jasper-recall setup without pinning an exact package version. That causes execution of whatever version is current at install time, creating a supply-chain risk where a compromised or unexpected future release could run arbitrary code on the host during setup.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation states the system runs entirely locally or offline, but elsewhere it requires a remote SkillBoss API Hub embedding service and an API key. This mismatch can mislead users into indexing sensitive memory under the false assumption that content never leaves the machine, increasing data exposure risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill intentionally persists session digests and indexes memory across restarts, which creates a real confidentiality risk if conversations contain secrets, tokens, or private operational context. In this skill's context, persistence is the core feature, so the danger depends on whether users understand and constrain what gets stored and shared.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

index-digests # Index memory files into ChromaDB

text

**Create session digests:**
```bash
digest-sessions          # Process new sessions
digest-sessions --dry-run  # Preview what would be processed

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The documentation tells users to run npx jasper-recall moltbook-setup without a pinned version. This allows unreviewed package updates to alter setup behavior for sandboxed agents and could introduce malicious code or weaken isolation guarantees.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The command npx jasper-recall moltbook-verify is invoked without version pinning, which still trusts the latest published package at runtime. Even verification steps can become an attack path if the package is replaced or compromised upstream.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Starting the server with npx jasper-recall serve without pinning a version exposes users to execution of whatever package version is latest when the command is run. Because this launches a network service that can access memory data, a compromised package could exfiltrate data or open unsafe listeners.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 420)May include surrounding context.

"No index found"

bash
index-digests  # Create the index first

"Collection not found"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document describes bidirectional memory sharing, shared directories, symlinks, logging, and scheduled sync across agents, but does not present any explicit user-facing consent, warning, or boundary statement about what data may be propagated. In a memory/agent context, this increases the risk of unintentional disclosure of sensitive prompts, notes, or cross-agent data, especially because the design explicitly enables persistence and sharing across workspaces.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The header markets the tool as a 'Local RAG system' while the CLI immediately imports and triggers a background update check, creating undisclosed network activity. This mismatch weakens user trust and can expose metadata such as IP address, usage timing, and installed version in environments expecting strictly local-only behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · cli/jasper-recall.js (reported line 7)May include surrounding context.

js
* Local RAG system for AI agent memory
 * 
 * Usage:
 *   npx jasper-recall setup     # Install dependencies and create scripts
 *   npx jasper-recall recall    # Run a query (alias)
 *   npx jasper-recall index     # Index files (alias)
 *   npx jasper-recall digest    # Digest sessions (alias)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
cli/doctor.js:15

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
cli/jasper-recall.js:43

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
cli/server.js:33

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
extensions/jasper-recall/index.ts:58

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
extensions/openclaw-plugin/index.ts:58

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
src/index.js:28

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:425