Chromadb Memory Pub

• Analyzed: May 12, 2026, 3:13 AM
• Findings: 1
• Version: 1.2.1
• Hash: 0c789dca6dc2c683c9481f19c9f4b1e74ddb12f49ba6aaa90827cf106cc2f370
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle for 'chromadb-memory' is classified as benign. Its primary function is to facilitate long-term memory by integrating with local ChromaDB and Ollama instances, as described. All network interactions are with user-configurable endpoints, which default to localhost (http://localhost:8100 for ChromaDB, http://localhost:11434 for Ollama). The skill retrieves content from user-indexed ChromaDB and injects it into the agent's context. While this creates a potential prompt injection vulnerability if the agent blindly executes untrusted content from ChromaDB, the skill itself does not craft or inject malicious instructions; it acts as a data provider. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation within the provided code or documentation.