Vector Memory Hack

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:55 AM UTC
• Version: 1.0.3

Overview

This skill is a local memory search tool, but it broadly encourages indexing sensitive agent memory and credentials into a persistent plaintext SQLite database before every task.

Review before installing. Use this only for non-secret memory or documentation, or first add redaction, owner-only permissions, and clear opt-in scoping. Do not index credentials, tokens, private keys, session data, or sensitive operational notes unless you are comfortable creating a second persistent local copy in SQLite.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vector_search.py:331

Finding

Agent Memory Persisted in an Unprotected Plaintext SQLite Database

Content

View full analysis

Vulnerability Details

File Location: scripts/vector_search.py:15-17, 50-58, 85, 331-340
Vulnerability Type: Plaintext storage of potentially sensitive agent memory
Risk Level: Medium

Vulnerable Code

python

# Config
MEMORY_PATH = Path("/root/.openclaw/workspace/MEMORY.md")
VECTORS_DIR = Path("/root/.openclaw/workspace/memory/vectors")
DB_PATH = VECTORS_DIR / "vectors.db"

python

cursor.execute("""
    CREATE TABLE IF NOT EXISTS sections (
        id TEXT PRIMARY KEY,
        title TEXT NOT NULL,
        content TEXT NOT NULL,
        hash TEXT NOT NULL,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    )
""")

python

content = MEMORY_PATH.read_text(encoding='utf-8')

python

if update:
    cursor.execute("""
        UPDATE sections 
        SET title = ?, content = ?, hash = ?, updated_at = CURRENT_TIMESTAMP
        WHERE id = ?
    """, (section['title'], section['content'], section['hash'], section['id']))
else:
    cursor.execute("""
        INSERT INTO sections (id, title, content, hash)
        VALUES (?, ?, ?, ?)
    """, (section['id'], section['title'], section['content'], section['hash']))

Technical Analysis

The Skill reads the complete configured MEMORY.md file and duplicates every parsed section into the content column of a persistent SQLite database. The stored text is not encrypted or redacted. The implementation creates the destination directory using the process's default permission behavior and does not explicitly enforce owner-only permissions on either the directory or database.

This is security-sensitive because SKILL.md:103-110 describes memory search as a required step before tasks and explicitly anticipates retrieval of server addresses and credentials. Persisting full section content is not necessary to calculate TF-IDF similarity; th ...[truncated 1945 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the vectors directory with owner-only permissions (0700) and enforce 0600 permissions on the SQLite database after creation.
2. Do not index credentials, private keys, access tokens, session secrets, or other authentication material. Add configurable section and pattern-based exclusions.
3. Redact common secret formats before persistence and reject sections marked as confidential.
4. Minimize stored data by retaining vectors and source offsets or section identifiers rather than duplicating complete plaintext content.
5. If full content must remain searchable, encrypt the database using a securely managed key that is not stored alongside it.
6. Limit printed search excerpts and provide a mode that returns titles or references only. Warn users that standard output may be logged.
7. Add explicit retention and secure-deletion behavior for rebuilds, updates, removed sections, old databases, backups, and temporary SQLite files.
8. Replace the documentation's mandatory “before every task” search instruction with an opt-in, task-scoped workflow that accesses only the minimum relevant memory.
9. Document that the index is a sensitive derivative of MEMORY.md and must receive equivalent or stronger access controls.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 175)May include surrounding context.

md

...

2. [0.245] Security Protocol
   CRITICAL: Never send emails without consent
   ...

3. [0.198] Deployment Checklist

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 310)May include surrounding context.

md

...

2. [0.245] Security Protocol
   CRITICAL: Never send emails without consent
   ...

3. [0.198] Deployment Checklist

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs the agent to read and index MEMORY.md and other markdown documentation, which is a file-reading capability, yet it declares no explicit tool scope or permissions boundaries. Without declared limits, an agent or host system may grant broader file access than intended, increasing the chance of unauthorized reading of sensitive local files if the path is changed or the skill is reused in a different environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill whenever the agent needs context before starting a task, which is broad enough to normalize frequent invocation even when unnecessary. Over-broad activation increases exposure to prompt-injection content inside memory files and can cause unnecessary access to sensitive operational notes, credentials, or internal procedures that are irrelevant to the current task.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Required step before every task' instruction is an especially risky blanket requirement because it forces pre-task retrieval regardless of necessity. In practice this can amplify prompt injection from untrusted memory content, over-collect sensitive data such as server addresses and credentials, and make the agent treat retrieved operational secrets as routine context for all tasks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a general-purpose semantic search capability for MEMORY.md or any markdown documentation. In this implementation, both the source document path and storage location are hard-coded to fixed workspace paths, and there is no mechanism to select or index arbitrary markdown files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The stated purpose centers on fast semantic search using TF-IDF and SQLite, so local indexing is broadly expected; however, the description emphasizes lightweight retrieval from markdown files without making clear that the skill creates and maintains a persistent on-disk database and directory structure. This is a behavior expansion from pure document search into stateful local indexing/storage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.