Security audit

claw-local-knowledge

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local knowledge-base tool, but it asks to persistently change agent behavior and lacks safeguards around stored document content and source-file deletion.

Install only if you are comfortable with a workspace-local knowledge base that can influence future answers. Avoid adding untrusted documents unless the skill is updated to treat retrieved content strictly as data, and do not modify SOUL.md or delete source uploads unless you intentionally want that persistent behavior and cleanup.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: README.md:58
Finding: Persistent Agent Behavior Modification Through SOUL.md
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:66
Finding: Retrieved Documents Are Integrated Without an Untrusted-Content Boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The skill includes a destructive shell command using rm on uploaded files, which is dangerous in an agent context because file names may be variable and command construction can drift into unsafe patterns. Even though the example shows a fixed path, normalizing use of direct shell deletion for user-supplied files increases the risk of accidental deletion, path manipulation, or over-broad cleanup if later implemented with interpolation or wildcards.
Content: Scanner excerpt · references/add_knowledge.md (reported line 75)May include surrounding context.
bash
# 删除原始文件（以 docx 为例） rm .openclaw/workspace/temp_file/文件.docx

注意：仅在转换成功且已更新索引后才删除原始文件。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions require semantic Chinese filenames and Chinese summaries, which imposes a specific language policy on all outputs. Because the file does not provide opt-in, alternatives, or a documented region-specific justification, this is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to delete original uploaded files after processing, but it does not require explicit user confirmation, a retention window, or a backup/rollback mechanism. This creates a real risk of unintended data loss if conversion is incomplete, incorrect, or later needs verification, especially because the source files may be the only authoritative copy in the workspace.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill guidance is written only in Chinese, and there is no indication that language choice is optional or that this is a region-specific skill. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 这是一个 markdown 文件，适用 SQP-2 的文档检查标准。L026-L028 明确说明会把上传文档写入临时目录、转换后写入知识库目录，并更新 JSON 索引，但周边说明未对这些会影响本地数据/文件系统的行为给出显式用户提醒或注意事项。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: SQP-3 适用于所有文件类型，包括自然语言内容。该文件整体为中文，但在 L060-L074 要求注入固定英文指令，没有说明这是可选语言、可本地化，或由用户自行选择，存在语言/locale 约束未获用户明确选择的问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.