Security audit

Nessie

Security checks for vulnerabilities and agentic risk

Overview

The plugin appears purpose-built for Nessie, but it needs Review because its search/read framing also includes persistent writes, deletions, profile updates, and sharing-grant management over personal and team memory.

Install only if you are comfortable giving OpenClaw access to Nessie-hosted personal and shared context, including past AI conversations and synced sources. Before using write, delete, profile-update, or sharing features, verify the agent previews the exact change and asks for clear confirmation, especially before adding or removing access grants.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest presents this as a read/search skill, but the body authorizes extensive mutation capabilities: creating, editing, moving, sharing, unsharing, and deleting contexts and even deleting synced conversations. That scope mismatch is dangerous because hosts, users, and reviewers may grant or trust the skill under a lower-risk mental model than its actual powers, increasing the chance of unauthorized or surprising data modification.

Memory Manipulation

High

Category: Memory Poisoning
Content: Context operations should be additive whenever possible: - Do not delete contexts to "replace" them. If consolidating multiple contexts into one, create the new context first, verify it captures all information, and only delete originals after explicit user confirmation. - Use targeted edits for corrections and additions. When correcting or updating
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

Category: Memory Poisoning
Content: Context operations should be additive whenever possible: - Do not delete contexts to "replace" them. If consolidating multiple contexts into one, create the new context first, verify it captures all information, and only delete originals after explicit user confirmation. - Use targeted edits for corrections and additions. When correcting or updating
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill includes sharing and access-management operations such as inspecting grants, adding grants, and removing grants, despite being described as a search/read skill. Access-control mutation is materially more sensitive than reading because it can broaden who can see user data or revoke protections, and users may not expect those permissions from this skill.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger condition is extremely broad, covering prior work, notes, conversations, decisions, relationships, and anything previously discussed or researched. Over-broad activation increases the chance the skill is invoked in many ordinary conversations, causing unnecessary access to personal memory/collaborative sources and magnifying the impact of any write, share, or deletion feature present elsewhere in the skill.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to fetch a remote version file from GitHub and potentially guide a plugin update, which is unrelated to the declared task of searching and reading Nessie context. Embedding software update behavior inside a content-access skill expands trust and attack surface, and creates a path for remote content to influence agent behavior outside the core user request.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: openclaw nessie init --email <email> --code <code> ``` Do not ask the user for an existing Nessie API key or tell them to configure one manually. Do not ask the user to run a device-code login flow for this plugin.
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: openclaw nessie init --email <email> --code <code> ``` Do not ask the user for an existing Nessie API key or tell them to configure one manually. Do not ask the user to run a device-code login flow for this plugin.
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: When the user says a result is wrong, outdated, speculative, misattributed, or nonliteral without naming a modality, infer the matching value, show the excerpt and `sliceId`, and proactively offer to apply it; do not call the tool until the user approves. There is intentionally no confirmation field in this tool's input schema. ## Writing
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.