Security audit

本地 Embedding 记忆系统部署指南

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent deployment guide, but it tells users to bypass centralized OpenClaw configuration and modify installed OpenClaw files.

Install only if you are authorized to change this OpenClaw environment. Do not follow the steps that clear centralized config tokens or edit OpenClaw files under Program Files unless an administrator has approved that policy change. Prefer pinned, verified downloads and use local embedding for sensitive memory data unless the remote endpoint's privacy and retention rules are understood.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:143
Finding: OpenClaw Configuration Enforcement Can Be Bypassed by Modifying Local Tooling
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Third-Party Models and Packages Are Installed Without Version or Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The remote embedding configuration directs memorySearch traffic to an external service endpoint but does not warn users that memory content, queries, or derived embeddings may leave the local system. In a memory system, this can expose sensitive internal knowledge, user prompts, or proprietary data to a remote API, especially in an enterprise intranet setting where users may assume the feature is local-only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 整个技能文档以中文撰写，未说明这是面向特定中文用户群体的限定文档，也未提供其他语言选项或用户可选的语言入口。按规则，若技能在语言/locale 上形成默认强制且无 opt-in 或明确地域性说明，可视为自然语言政策问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The package description is written entirely in Chinese and gives no indication that alternative languages are supported. This can violate a language/locale policy when a skill implicitly requires a specific language without offering user choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.