ClawHub
Back to skill

Security audit

Knowledge Base

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local knowledge-base skill, but it needs review because it can automatically ingest and persist private documents while also changing the Python environment during setup and vector-search use.

Install only if you are comfortable with imported documents being converted, stored, indexed, and searched locally under the OpenClaw workspace. Use an isolated Python environment, review files before enabling Feishu or cron auto-ingest, avoid shared /tmp ingestion where possible, and manually verify dependency versions and vector-index deletion behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
except ImportError:
        print("正在安装 chromadb...")
        import subprocess
        subprocess.check_call([
            sys.executable, "-m", "pip", "install", "--break-system-packages",
            "chromadb"
        ])
Confidence
94% confidence
Finding
subprocess.check_call([ sys.executable, "-m", "pip", "install", "--break-system-packages", "chromadb" ])

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The file presents itself as a vector retrieval module, but it also installs packages and changes the Python environment as a side effect. This mismatch is security-relevant because operators may trust the file as a local indexing helper while overlooking that running it can trigger networked dependency installation and system modification.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Installing packages via pip is not necessary for core search logic at runtime and expands the module's capabilities beyond its apparent purpose. In a skill/agent setting, hidden installation behavior is especially risky because it can introduce unreviewed code, alter reproducibility, and violate least-privilege expectations.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
Automatically monitoring `/tmp/openclaw/` and ingesting files from Feishu can silently collect sensitive documents without adequate user notice, consent boundaries, or retention guidance. In a knowledge-base skill, this is more dangerous because the feature is designed to persist and index content, increasing the chance of accidental long-term storage and later disclosure of private data.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script automatically scans a world-writable temporary directory and ingests matching files into the knowledge base without any approval, ownership verification, or trust boundary checks. Because /tmp is commonly writable by other local processes/users, an attacker or unintended process could drop crafted or sensitive files there and cause unauthorized ingestion, potentially poisoning the KB or importing private data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The module installs a package automatically without any prior warning, consent, or dedicated setup phase. In environments where this skill may run with elevated privileges or broad network access, silent package installation can lead to unintended system changes and increased exposure to dependency compromise.

Unpinned Dependencies

Low
Category
Supply Chain
Content
markitdown[all]
jieba
scikit-learn
Confidence
90% confidence
Finding
jieba

Unpinned Dependencies

Low
Category
Supply Chain
Content
markitdown[all]
jieba
scikit-learn
Confidence
98% confidence
Finding
scikit-learn

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical
Category
Supply Chain
Confidence
95% confidence
Finding
scikit-learn

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.