ClawHub
Back to skill

Security audit

memory-tencentdb 安装指南

Security checks for vulnerabilities and agentic risk

Overview

This memory plugin guide is coherent, but it enables automatic storage and profiling of all conversations and uses an under-scoped dependency installation path in the Gateway runtime.

Review this carefully before installing. It is intended to store conversation history and build user profiles locally, so only enable it if you are comfortable with that retention and know how to delete or disable the memory store. Pin and verify npm dependencies rather than installing an unconstrained package directly into the Gateway runtime.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned Third-Party Dependency Installed into the Gateway Runtime

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-55
Vulnerability Type: Unpinned dependency installation and unsafe host-runtime integration
Risk Level: Medium

powershell
npm install --ignore-scripts
powershell
npm install js-tiktoken --ignore-scripts

Technical Analysis

The installation guide directs users to install js-tiktoken without specifying an exact version and provides no lockfile or integrity verification mechanism. Consequently, the package version and transitive dependency graph are resolved from the package registry at installation time and may differ between installations.

The instructions subsequently place the dependency in the Gateway's node_modules environment. Although --ignore-scripts prevents package lifecycle scripts from executing during installation, it does not prevent JavaScript contained in the dependency from executing later when the Gateway or plugin imports it. A compromised package release, compromised maintainer account, registry substitution, or malicious transitive dependency could therefore introduce executable code into the trusted Gateway process.

Attack Path

  1. An attacker compromises the js-tiktoken package, one of its transitive dependencies, or the package publication account.
  2. The attacker publishes a malicious version that satisfies the unconstrained installation request.
  3. An administrator follows the guide and runs npm install js-tiktoken --ignore-scripts.
  4. npm resolves and installs the attacker-controlled version because no exact version, lockfile, or integrity allowlist is enforced.
  5. The dependency is made available in the Gateway runtime.
  6. When the memory plugin imports the dependency, its runtime module code executes inside the Gateway process despite lifecycle scripts having been disabled.

Impact Assessment

Successful exploitation could execute attacker-controlled JavaScript with the operating-sy ...[truncated 746 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin js-tiktoken and every direct dependency to an explicitly reviewed version rather than using an unconstrained package name.
  2. Distribute a reviewed package-lock.json containing npm integrity hashes and require reproducible installation with npm ci --ignore-scripts.
  3. Verify dependency provenance, publisher identity, signatures or attestations, and integrity metadata before installation.
  4. Review and audit the complete transitive dependency graph; use automated vulnerability and package-reputation scanning in the release process.
  5. Avoid manually copying packages into the Gateway's shared node_modules. Package the plugin with an isolated, reviewed dependency tree or use an officially supported dependency-loading mechanism.
  6. Run the Gateway under a dedicated, least-privileged operating-system account and restrict its access to credentials, configuration, and unrelated user files.
  7. Pin approved package versions in organizational policy and use a trusted internal registry or immutable artifact repository where practical.
  8. Retain --ignore-scripts as defense in depth, but do not treat it as protection against malicious runtime module code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly states it automatically captures all conversations and builds structured records and user profiles, but the installation/overview text does not present a clear, prominent privacy warning or informed-consent notice. This is dangerous because users may enable the plugin without understanding that sensitive chats, extracted facts, and long-term profile data will be stored locally, increasing the risk of privacy harm, unintended retention, and secondary exposure if the host is compromised.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

bash
# 查看对话捕获
ls -la ~/.openclaw/memory-tdai/conversations/

# 查看 L1 记录
ls -la ~/.openclaw/memory-tdai/records/

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

bash
# 查看对话捕获
ls -la ~/.openclaw/memory-tdai/conversations/

# 查看 L1 记录
ls -la ~/.openclaw/memory-tdai/records/

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

bash
# 查看对话捕获
ls -la ~/.openclaw/memory-tdai/conversations/

# 查看 L1 记录
ls -la ~/.openclaw/memory-tdai/records/

Static analysis

No suspicious patterns detected.