ClawHub
Back to skill

Security audit

LightRAG Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill appears purpose-built rather than malicious, but it needs Review because it can send complete local agent-memory content and an API key to a configurable external endpoint without strong scoping or confirmation.

Install only if you are comfortable with your agent memory files and inserted documents being processed by the configured OpenAI-compatible API. Use a trusted endpoint, avoid putting secrets in memory files, use a limited API key, pin and review dependency versions, and verify the storage path before running the reset command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Changes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/rag.py:26
Finding

Sensitive Memory and API Credentials May Be Sent to an Arbitrary Configured Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/rag.py (reported line 137)May include surrounding context.

python
def main():
    # Load .env from script directory if present
    script_dir = Path(__file__).parent
    env_file = script_dir.parent / ".env"
    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/rag.py (reported line 139)May include surrounding context.

python
def main():
    # Load .env from script directory if present
    script_dir = Path(__file__).parent
    env_file = script_dir.parent / ".env"
    if env_file.exists():
        try:
            from dotenv import load_dotenv

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares installation requirements and documents commands that read workspace memory files and environment variables, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this can lead to overbroad execution or ambiguous trust boundaries, making it easier for the skill to access sensitive files or secrets without clear operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill describes indexing and querying agent memory using an OpenAI-compatible API, but it does not clearly warn that memory contents are transmitted to a third-party model endpoint for embeddings and LLM processing. Because memory files may contain sensitive user data, credentials, or internal notes, this omission can cause unintended data exfiltration during normal use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The troubleshooting section includes a destructive reset command that recursively deletes all files in the storage directory, but it is presented without an explicit warning or confirmation step. Users may copy and run it directly, causing accidental loss of indexed memory data and potentially deleting unintended files if the storage path is misconfigured.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/rag.py (reported line 31)May include surrounding context.

python
api_key = os.getenv("OPENAI_API_KEY")
    if base_url is None:
        base_url = os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1")

    if not base_url.endswith("/v1"):
        base_url = base_url.rstrip("/") + "/v1"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/rag.py (reported line 50)May include surrounding context.

python
api_key = os.getenv("OPENAI_API_KEY")
    if base_url is None:
        base_url = os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1")

    if not base_url.endswith("/v1"):
        base_url = base_url.rstrip("/") + "/v1"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill reads local workspace or user-provided files and sends their contents to an external embedding service via the OpenAI-compatible API. In a memory-management skill, this is expected functionality, but it still creates a real confidentiality risk because sensitive local data may be exfiltrated without an explicit warning, consent gate, or allowlist.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/rag.py (reported line 44)May include surrounding context.

python
def get_rag():
    """Create configured LightRAG instance."""
    api_key = os.getenv("OPENAI_API_KEY")
    if not api_key:
        print("Error: OPENAI_API_KEY not set", file=sys.stderr)

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency lightrag-hku is unpinned, so installations may resolve to different versions over time, including vulnerable or breaking releases. In a memory/retrieval skill that likely processes external data and may run in shared agent environments, supply-chain drift increases exposure to known and future package vulnerabilities.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
lightrag-hku
openai
python-dotenv
numpy

Unverifiable Dependency: lightrag-hku has 10 known advisory(ies) (CVE-2026-61736 (LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests); CVE-2026-39413 (lightrag-hku: JWT Algorithm Confusion Vulnerability ); CVE-2026-61740 (LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET ) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
99% confidence
Finding

lightrag-hku has multiple known advisories, but no version is pinned, so there is no way to determine whether installation will select a safe or affected release. This is more concerning than a generic unpinned dependency because the package is central to the skill's memory, retrieval, and likely network-exposed behavior, making vulnerable versions potentially impactful.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The openai package is unpinned, which makes builds non-reproducible and can silently introduce insecure or incompatible versions. Although this alone is not direct code execution, it is a real supply-chain weakness because the runtime dependency selected at install time is not controlled.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
lightrag-hku
openai
python-dotenv
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

python-dotenv is unpinned, allowing an installer to fetch any current release, including versions with security defects or behavioral changes. Since this package can influence environment loading and secret handling, version drift is undesirable in an agent skill context.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
lightrag-hku
openai
python-dotenv
numpy

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
97% confidence
Finding

python-dotenv has known advisories and the manifest does not specify a version, so deployment may pull an affected release. Because this library may read or write environment-related files, vulnerable versions could affect secret management or local file safety depending on usage.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The numpy dependency is unpinned, which creates a reproducibility and supply-chain risk by permitting uncontrolled version selection. Even for a common library, unpinned installs can unexpectedly pull vulnerable or incompatible builds.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
lightrag-hku
openai
python-dotenv
numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
95% confidence
Finding

numpy has known historical advisories, and without version pinning it is impossible to verify whether the installed release is affected. In this skill, numpy is likely a supporting dependency rather than the primary attack surface, so the contextual danger is lower, but the supply-chain uncertainty is still real.

Content

No source excerpt is available for this finding.