ClawHub
Back to skill

Security audit

Self-improving Agent Memory Upgrade (SurrealDB)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent memory skill, but it needs Review because it combines persistent prompt influence, broad memory export, and unauthenticated install/maintenance controls with mutable remote installers.

Install only after reviewing the security notes and treating this as an elevated local integration. Prefer manual SurrealDB installation, avoid the UI/gateway auto-repair and install buttons, bind services to localhost, change root/root credentials, use a limited OpenAI key, and audit memory files for secrets before enabling extraction, cron jobs, or auto-injection.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (7)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.sh:87
Finding

Mutable Remote Installer Is Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh:87-93
Additional Locations: scripts/web-ui.py:255-285; openclaw-integration/gateway/memory.ts:212-228
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

sh
curl -sSf https://install.surrealdb.com | sh
python
if system == "darwin":
    if shutil.which("brew"):
        result = subprocess.run(
            ["brew", "install", "surrealdb/tap/surreal"],
            capture_output=True,
            text=True,
            timeout=300
        )
    else:
        result = subprocess.run(
            ["sh", "-c", "curl -sSf https://install.surrealdb.com | sh"],
            capture_output=True,
            text=True,
            timeout=300
        )
elif system == "linux":
    result = subprocess.run(
        ["sh", "-c", "curl -sSf https://install.surrealdb.com | sh"],
        capture_output=True,
        text=True,
        timeout=300
    )
ts
async function installSurrealDb(): Promise<{
  success: boolean;
  stdout?: string;
  stderr?: string;
  error?: string;
}> {
  try {
    const { stdout, stderr } = await execAsync(
      "curl -sSf https://install.surrealdb.com | sh",
      { timeout: 300000 },
    );
    return { success: true, stdout, stderr };
  } catch (e) {
    return {
      success: false,
      error: e instanceof Error ? e.message : String(e),
    };
  }
}

Technical Analysis

The project downloads a mutable script from an external URL and passes it directly to a shell. There is no pinned version, local inspection step, hardcoded digest, or signature verification. Consequently, the effective executable payload can change after the Skill has been reviewed.

The command-line installer now makes this behavior opt-in and asks for confirmation. However, the standalone web UI and gatewa ...[truncated 1152 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove every curl | sh and sh -c network-installer path.
  • Download a version-pinned release artifact as data rather than executable shell input.
  • Verify it against a hardcoded vendor signing key or an expected SHA-256 digest obtained through a separate trusted channel.
  • Fail closed if signature, digest, version, platform, or expected filename validation fails.
  • Present the verified artifact and version to the user before installation.
  • Remove binary installation from unattended auto-repair and gateway handlers.
  • Prefer documentation that directs users to the operating system's trusted package manager or a manually verified vendor release.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/web-ui.py:782
Finding

Unauthenticated Management API Permits Installation, Process Control, and Destructive Maintenance

Content
View full analysis

Vulnerability Details

File Location: scripts/web-ui.py:782-846
Vulnerability Type: Missing authentication, authorization, and CSRF protection
Risk Level: High

Vulnerable Code

python
def send_json(self, data, status=200):
    """Send JSON response."""
    self.send_response(status)
    self.send_header('Content-Type', 'application/json')
    self.send_header('Access-Control-Allow-Origin', '*')
    self.end_headers()
    self.wfile.write(json.dumps(data).encode())

def do_POST(self):
    parsed = urlparse(self.path)
    path = parsed.path

    if path == '/api/repair':
        self.send_json(auto_repair())

    elif path == '/api/install/binary':
        self.send_json(install_surrealdb())

    elif path == '/api/install/python':
        self.send_json(install_python_deps())

    elif path == '/api/install/start':
        self.send_json(start_surrealdb())

    elif path == '/api/install/schema':
        self.send_json(init_schema())

    elif path.startswith('/api/maintenance/'):
        op = path.split('/')[-1]
        self.send_json(asyncio.run(run_maintenance(op)))

    else:
        self.send_error(404)

def do_OPTIONS(self):
    self.send_response(200)
    self.send_header('Access-Control-Allow-Origin', '*')
    self.send_header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
    self.send_header('Access-Control-Allow-Headers', 'Content-Type')
    self.end_headers()

The server can also be rebound by the user:

python
parser.add_argument("--host", default="127.0.0.1", help="Host to bind to")
server = HTTPServer((args.host, args.port), MemoryUIHandler)

Technical Analysis

State-changing endpoints have no authentication or per-operation authorization. The service also lacks CSRF tokens and Origin or Host validation, while returning permissive Access-Control-Allow-Origin: * headers.

The default loopback binding reduces dire ...[truncated 1277 chars]

Remediation
View remediation

Remediation Suggestions

  • Generate a high-entropy management token and require it for every API request.
  • Bind only to loopback and reject non-loopback client addresses, even if a broader bind address is requested accidentally.
  • Enforce strict Host and Origin allowlists.
  • Add anti-CSRF tokens and reject state-changing requests without them.
  • Remove wildcard CORS; use no CORS headers unless a specific trusted origin is required.
  • Separate read-only health endpoints from privileged installation and maintenance endpoints.
  • Disable installation and process-control endpoints by default and require explicit local confirmation.
  • Add audit logging, rate limiting, and clear authorization failures.

T01 · Skill Instruction Hijacking

Error
Location
scripts/extract-knowledge.py:203
Finding

Untrusted Memory Content Can Become Persistent System-Prompt Instructions

Content
View full analysis

Vulnerability Details

File Location: scripts/extract-knowledge.py:203-278
Additional Location: scripts/mcp-server-v2.py:557-657
Vulnerability Type: Persistent indirect prompt injection and memory poisoning
Risk Level: High

Vulnerable Code

python
EXTRACTION_PROMPT = """You are extracting structured knowledge from personal notes/memory files.

Given this text, extract discrete facts. For each fact:
1. Write a concise, single-assertion statement
2. Identify entities mentioned (people, projects, concepts, places)
3. Assign confidence (0.0-1.0): 1.0 for definitive statements, lower for uncertain/inferred
4. Mark source: "explicit" if directly stated, "inferred" if derived

Rules:
- Extract only meaningful facts, not meta-commentary
- Keep facts atomic (one assertion per fact)
- Preserve important context in the fact statement
- Skip obvious/trivial information
- If no meaningful facts, return empty array

Text:
---
{content}
---

Return JSON array:
[
  {{
    "content": "fact statement",
    "entities": ["Entity1", "Entity2"],
    "confidence": 0.9,
    "source": "explicit"
  }}
]

Only return the JSON array, no other text."""

response = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[
        {"role": "user", "content": EXTRACTION_PROMPT.format(content=chunk_text)}
    ],
    temperature=0.3,
    max_tokens=2000,
)

Stored content is later inserted into prompt context:

python
facts = sorted(facts, key=lambda f: f.get("similarity", 0), reverse=True)
facts = [
    f for f in facts
    if not is_sensitive_memory_text(f.get("content", ""))
][:max_facts]

if formatted_facts:
    context_parts.append("## Semantic Memory (Relevant Facts)")
    for i, f in enumerate(formatted_facts, 1):
        rel = f.get("relevance", 0)
        conf = f.get("confidence", 0)
        marker = "🎯" if f.get("task_relevan
...[truncated 2042 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat all memory records as untrusted data rather than instructions.
  • Do not append raw memory text to the system prompt.
  • Place retrieved records in a strongly delimited data section with a higher-priority instruction that embedded directives must never be followed.
  • Detect imperative, role-changing, policy-overriding, tool-calling, and data-exfiltration language before storage and injection.
  • Quarantine suspicious records for human review rather than silently injecting them.
  • Validate extraction output against a strict schema, including length and content policies.
  • Preserve source provenance and trust level and permit auto-injection only from explicitly trusted sources.
  • Apply the same filtering to facts, entities, episode goals, learnings, problems, and warnings.
  • Add regression tests using indirect prompt-injection payloads.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/extract-knowledge.py:113
Finding

Raw Workspace Memory Is Sent to OpenAI Without Local Secret Redaction

Content
View full analysis

Vulnerability Details

File Location: scripts/extract-knowledge.py:113-139
Additional Location: scripts/extract-knowledge.py:203-257,388-412
Vulnerability Type: Sensitive data exposure to an external API
Risk Level: High

Vulnerable Code

python
def list_memory_files(workspace: Path) -> list[Path]:
    """List all memory files in workspace."""
    files = []

    memory_file = workspace / "MEMORY.md"
    if memory_file.exists():
        files.append(memory_file)

    alt_memory = workspace / "memory.md"
    if alt_memory.exists() and alt_memory not in files:
        files.append(alt_memory)

    memory_dir = workspace / "memory"
    if memory_dir.exists():
        for f in memory_dir.rglob("*.md"):
            if f.is_file():
                files.append(f)

    return files
python
def extract_from_file(db, file_path: Path, verbose: bool = False,
                      file_idx: int = 0, total_files: int = 1,
                      agent_id: str = "main") -> dict:
    """Extract knowledge from a single file, tagging facts with the source agent."""
    content = file_path.read_text(encoding="utf-8", errors="ignore")
    chunks = chunk_content(content)

    for i, chunk in enumerate(chunks):
        facts = extract_facts_from_chunk(chunk["text"], str(file_path))
python
response = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[
        {"role": "user", "content": EXTRACTION_PROMPT.format(content=chunk_text)}
    ],
    temperature=0.3,
    max_tokens=2000,
)

Technical Analysis

The extractor recursively discovers Markdown files under the workspace memory directory, reads their complete contents, divides them into chunks, and sends each chunk to OpenAI. There is no local redaction pass, credential detector, per-file allowlist, exclusion mechanism, or fail-closed handling for secret-like content before t ...[truncated 1093 chars]

Remediation
View remediation

Remediation Suggestions

  • Run local secret and sensitive-data detection before every external API call.
  • Redact detected values while preserving only the minimum context needed for extraction.
  • Fail closed and request user review when high-confidence secrets are found.
  • Use an explicit per-file allowlist rather than recursive discovery by default.
  • Support .memoryignore-style exclusions and maximum file and chunk limits.
  • Display the exact files and data categories that will be transmitted before first use.
  • Require explicit opt-in for scheduled extraction.
  • Minimize retention and document provider-side data-processing controls.
  • Test detection against common API tokens, private keys, authorization headers, connection strings, and structured credential files.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/mcp-server-v2.py:195
Finding

Caller-Controlled Agent Identity and Direct Record Selection Bypass Memory Isolation

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp-server-v2.py:195-245
Additional Locations: scripts/mcp-server-v2.py:143-172,697-723
Vulnerability Type: Broken object-level authorization
Risk Level: High

Vulnerable Code

python
def knowledge_recall(
    fact_id: str = None,
    query: str = None,
    agent_id: str = "main"
) -> dict:
    """Recall a specific fact with its full context, scoped to the given agent."""
    if not DEPS_AVAILABLE:
        return {"error": "Dependencies not available"}

    try:
        db = get_db()

        if query and not fact_id:
            search_result = knowledge_search(query, limit=1, agent_id=agent_id)
            if search_result.get("facts"):
                fact_id = search_result["facts"][0]["id"]
            else:
                return {"error": "No matching fact found", "query": query}

        if not fact_id:
            return {"error": "Either fact_id or query required"}

        fact_result = db.select(fact_id)
        if not fact_result:
            return {"error": f"Fact not found: {fact_id}"}

        fact = (
            fact_result
            if isinstance(fact_result, dict)
            else fact_result[0] if fact_result else {}
        )

Related records are also loaded without an agent ownership condition:

python
supporting = db.query("""
    SELECT in.id AS id, in.content AS content, in.confidence AS confidence, strength
    FROM relates_to WHERE out = $fact_id AND relationship = "supports"
""", {"fact_id": fact_id})

contradicting = db.query("""
    SELECT in.id AS id, in.content AS content, in.confidence AS confidence, strength
    FROM relates_to WHERE out = $fact_id AND relationship = "contradicts"
""", {"fact_id": fact_id})

Search tools trust a caller-supplied identity and expose unowned legacy records:

python
WHERE (archived = false OR archived IS NONE)
 
...[truncated 1438 chars]
Remediation
View remediation

Remediation Suggestions

  • Derive agent identity from authenticated transport or session context; never trust a tool argument as identity.
  • Remove caller control over agent_id from public tool schemas.
  • Replace direct db.select(fact_id) with a query enforcing ownership: (agent_id = $authenticated_agent_id OR scope = 'global').
  • Apply the same authorization predicate to supporting facts, contradictions, entities, episodes, and all mutation operations.
  • Return a uniform not-found response for missing and unauthorized records.
  • Migrate legacy agent_id IS NONE records to explicit owners rather than making them globally visible.
  • Add cross-agent authorization tests for direct IDs, searches, relationships, episodes, and writes.

T08 · Insecure Dependencies

Warning
Location
scripts/web-ui.py:297
Finding

Runtime Installation Uses Unpinned Third-Party Packages

Content
View full analysis

Vulnerability Details

File Location: scripts/web-ui.py:297-309
Additional Locations: scripts/install.sh:142-147; openclaw-integration/gateway/memory.ts:231-253
Vulnerability Type: Unsafe and non-reproducible dependency installation
Risk Level: Medium

Vulnerable Code

python
def install_python_deps() -> dict:
    """Install Python dependencies."""
    try:
        result = subprocess.run(
            [
                sys.executable,
                "-m",
                "pip",
                "install",
                "surrealdb",
                "openai",
                "pyyaml"
            ],
            capture_output=True,
            text=True,
            timeout=120
        )
ts
if (skillDir && fs.existsSync(path.join(skillDir, ".venv"))) {
  const { stdout, stderr } = await execAsync(
    `source "${path.join(skillDir, ".venv", "bin", "activate")}" && pip install surrealdb openai pyyaml`,
    { timeout: 120000, shell: "/bin/bash" },
  );
  return { success: true, stdout, stderr };
}

const { stdout, stderr } = await execAsync(
  "pip3 install --user surrealdb openai pyyaml || pip install --user surrealdb openai pyyaml",
  { timeout: 120000, shell: "/bin/bash" },
);

Technical Analysis

Packages are resolved by name without exact versions or hashes. Installation may occur through an unattended repair endpoint and, in the fallback path, modifies the user's package environment with --user. The installed code can therefore differ between runs and can change after project review.

Package installation may execute package-controlled build backends or installation hooks. A compromised upstream release or dependency can consequently execute under the user's account.

Attack Path

  1. An upstream package or transitive dependency is compromised, or a future release introduces malicious behavior.
  2. The user ...[truncated 544 chars]
Remediation
View remediation

Remediation Suggestions

  • Maintain a reviewed lock file with exact versions for direct and transitive dependencies.
  • Require cryptographic hashes with pip --require-hashes.
  • Install only into a dedicated virtual environment with restrictive permissions.
  • Remove the --user fallback.
  • Do not install dependencies through unattended repair or remotely callable handlers.
  • Use a trusted, explicitly configured package index and validate package provenance.
  • Run dependency vulnerability and provenance scanning during release preparation.
  • Rebuild and test lock files deliberately rather than resolving latest versions at user runtime.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/web-ui.py:312
Finding

SurrealDB Is Started with Default Root Credentials and Without an Explicit Bind Address

Content
View full analysis

Vulnerability Details

File Location: scripts/web-ui.py:312-341
Additional Location: scripts/mcp-server-v2.py:25-32
Vulnerability Type: Weak default credentials and unsafe service configuration
Risk Level: Medium

Vulnerable Code

python
def start_surrealdb() -> dict:
    """Start SurrealDB server."""
    try:
        DATA_DIR.mkdir(parents=True, exist_ok=True)

        process = subprocess.Popen(
            [
                "surreal",
                "start",
                "--user",
                "root",
                "--pass",
                "root",
                f"file:{DB_FILE}"
            ],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            start_new_session=True
        )

Database clients use matching defaults:

python
SURREAL_CONFIG = {
    "connection": os.environ.get("SURREAL_URL", "http://localhost:8000"),
    "namespace": "openclaw",
    "database": "memory",
    "user": os.environ.get("SURREAL_USER", "root"),
    "password": os.environ.get("SURREAL_PASS", "root"),
}

Technical Analysis

The standalone dashboard starts a privileged database account with the public default credential root/root. Unlike the TypeScript gateway launcher and documented command, this launcher does not explicitly include --bind 127.0.0.1:8000.

Security therefore depends on the effective default bind behavior of the installed SurrealDB version and surrounding configuration. If the process listens beyond loopback, any reachable attacker can try the known credentials. Even when loopback-only, local processes can authenticate using the predictable password.

Attack Path

  1. A user starts SurrealDB through the standalone management UI.
  2. The effective SurrealDB configuration listens on a reachable interface, or an untrusted local process accesses the loopback port.
  3. The attacker authenticates wi ...[truncated 490 chars]
Remediation
View remediation

Remediation Suggestions

  • Always pass an explicit loopback bind argument such as --bind 127.0.0.1:8000.
  • Generate a high-entropy random database password during setup.
  • Store credentials in a protected secret store with owner-only filesystem permissions.
  • Reject startup when credentials remain root/root or another known default.
  • Avoid placing passwords directly in process arguments where local process listings may expose them.
  • Require TLS and network-level access controls for any non-loopback deployment.
  • Add a startup verification that confirms the actual listening address and fails if it is externally reachable.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (146)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The changelog confirms the project includes a 'curl | sh' network installer path, even if now opt-in by default. Piping remote content directly to a shell is inherently dangerous because a compromised upstream, MITM, or malicious mirror can execute arbitrary code on the user's machine during installation.

Content

Scanner excerpt · CHANGELOG.md (reported line 18)May include surrounding context.

md
### Security (scripts hardened)

- **`scripts/install.sh`** — Inverted default: `SKIP_SURREAL=true` is now the safe default. The `curl | sh` network installer is **opt-in only** via new `--install-surreal` flag. Running `./install.sh` with no flags skips the network installer entirely and guides the user to manual installation. Legacy `--skip-surreal` alias preserved.
- **`scripts/integrate-openclaw.sh`** — Added hard gate at the top: running with **no arguments now exits with a usage error** instead of silently defaulting to dry-run. Must explicitly pass `--dry-run` (preview) or `--apply` (make changes). Added security notice banner. All `cp` and `sed -i` calls routed through `run_cmd()` dry-run wrapper.

### Documentation

External Script Fetching

High
Category
Supply Chain
Confidence
94% confidence
Finding

The changelog states that 'curl | sh' is still supported with confirmation gates and warning banners. Those controls improve usability and consent, but they do not mitigate the core risk of arbitrary code execution from remote content fetched at install time.

Content

Scanner excerpt · CHANGELOG.md (reported line 49)May include surrounding context.

md
- **`SKILL.md`** — Updated all references from `enhanced-loop-hook-agent-isolation.patch` → `.md`

### Security (scripts hardened)
- **`scripts/install.sh`** — Added `⚠️ SECURITY NOTICE` banner explaining the curl|sh risk; added `--skip-surreal` flag to bypass network installer entirely; added explicit `y/N` confirmation gate with abort path before any `curl | sh` runs
- **`scripts/integrate-openclaw.sh`** — Now defaults to **dry-run mode** (no files modified without `--apply`); added `run_cmd()` wrapper that prints `[DRY-RUN] ...` instead of executing; added security banner warning that source patching is high-impact; all `cp` and `sed` calls routed through `run_cmd`

### Removed

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Even as documentation, this confirms the skill supports a network installer behavior based on 'curl | sh.' In the context of a developer skill that modifies local systems and integrates with agent tooling, that pattern remains high risk because users may follow docs that lead to unaudited remote code execution.

Content

Scanner excerpt · CHANGELOG.md (reported line 186)May include surrounding context.

md
- Fixed schema filename reference in `memory.ts` (`schema.surql` → `schema.sql`)

### Security
- Documented network installer behavior (`curl | sh`) with mitigation
- Documented source patching behavior with mitigation
- Documented default credential usage (root/root) with warning
- Documented API key scope requirements

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The installation flow explicitly references an automatic path that runs a shell installer obtained from an external source. External script fetching for direct execution is dangerous because it transfers full code-execution trust to a remote endpoint outside the repository and bypasses review.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 9)May include surrounding context.

1. Install SurrealDB

Option A: Automatic (runs curl | sh)

bash
./scripts/install.sh

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The command fetches a script from install.surrealdb.com and pipes it to sh, allowing immediate execution of whatever content is served at that URL. In a setup guide for an agent skill, this is especially risky because users may copy-paste it verbatim with elevated trust.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 17)May include surrounding context.

Option B: Manual (recommended)

bash
# Linux/macOS
curl -sSf https://install.surrealdb.com | sh

# Or download from https://surrealdb.com/install

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | sh pipeline is a classic command-chaining pattern that turns a network fetch directly into code execution, removing any opportunity for validation between retrieval and execution. If the fetched content is malicious or tampered with, the user executes attacker-controlled shell commands immediately.

Content

Scanner excerpt · INSTRUCTIONS.md (reported line 17)May include surrounding context.

Option B: Manual (recommended)

bash
# Linux/macOS
curl -sSf https://install.surrealdb.com | sh

# Or download from https://surrealdb.com/install

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill documentation explicitly states that its installer can use a curl | sh pattern to fetch and execute a remote script. Even though the document warns against this path and marks it as optional, the capability still exists in the skill and represents a real supply-chain risk because remote content is executed immediately with shell privileges and could change over time or be tampered with.

Content

Scanner excerpt · SECURITY.md (reported line 16)May include surrounding context.

md
| Injects facts into the agent system prompt on each turn | ✅ Yes — the core memory feature | Toggle in Mode UI → Memory section |
| Registers 2 cron jobs in the main agent session | ⚠️ Expected but elevated | Disable via OpenClaw cron manager |
| Patches OpenClaw source files via sed | ❌ Optional / not default | Only runs with `--apply` flag |
| Runs `curl \| sh` to install SurrealDB | ❌ Not recommended | Use `--skip-surreal` and install manually |
| Uses default credentials `root/root` | ⚠️ Dev only | Change before any networked deployment |

---

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

This is a concrete instance of the same issue: scripts/install.sh can execute curl -sSf https://install.surrealdb.com | sh, which directly pipes network-retrieved code into the shell. In the context of an agent skill installer, this is especially dangerous because users may run setup scripts without fully reviewing them, enabling arbitrary code execution if the remote endpoint or delivery path is compromised.

Content

Scanner excerpt · SECURITY.md (reported line 84)May include surrounding context.

md
### 5. SurrealDB Network Installer

`scripts/install.sh` can run `curl -sSf https://install.surrealdb.com | sh`. This is a network script piped to your shell.

**Recommendation:** Do NOT use this path. Install SurrealDB manually from the official releases: https://surrealdb.com/install

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Running a management web server, installing dependencies, managing processes, and performing repair actions significantly broadens the attack surface compared to a simple memory skill. Even if intended, bundling these administrative capabilities into one skill increases blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
openclaw-integration/gateway/memory.ts:273

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
openclaw-integration/gateway/memory.ts:32

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/enhanced-loop-hook-agent-isolation.md:64