Security audit

Clawtext Ingest

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it persists Discord, web, file, and chat-export content into agent memory using several under-scoped URL, file-write, and subprocess patterns that need review before installation.

Install only if you are comfortable giving this skill access to the specific Discord channels, local files, URLs, and memory directory you intend to ingest. Avoid autonomous or scheduled ingestion until URL allowlists, file path containment, secret-safe subprocess use, and privacy/retention rules are added; sanitize chat exports and web content before storing them in agent memory.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: src/index.js:139
Finding: Persistent Agent Memory Poisoning Through Untrusted Ingested Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/index.js:139
Finding: Server-Side Request Forgery Through Unrestricted URL Ingestion
Content: View full analysis
u.trim()); const metadata = { project: parsed.project || parsed.p || 'ingestion', source: parsed.source || parsed.s || `cli:urls`, date: parsed.date || parsed.d, type: 'url' }; if (verbose) console.log(`🌐 Ingesting URLs: ${urls.join(', ')}`); const result = await ingest.fromUrls(urls, metadata); ``` ### Technical Analysis The ingestion engine invokes the runtime’s global `fetch()` on caller-controlled URLs without validating: - URL scheme. - Destination hostname or resolved IP address. - Loopback, private, link-local, multicast, or cloud metadata ranges. - Redirect destinations. - DNS rebinding between validation and connection. - Response status or content type. - Response size. - Request duration. Because the request originates from the machine runnin ...[truncated 2094 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/index.js:219
Finding: Arbitrary File Append Through Unsanitized Memory Filename
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: AGENT_GUIDE.md:171
Finding: Shell Command Injection and Secret Exposure in Documented Agent Subprocess Pattern
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (67)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLI-GUIDE.md (reported line 443)May include surrounding context.
md
### Duplicates still being imported - Verify dedup is enabled (default): check `~/.openclaw/workspace/memory/.ingest_hashes.json` - Reset hashes if needed: `rm ~/.openclaw/workspace/memory/.ingest_hashes.json` ### JSON parsing errors - Ensure input is valid JSON: `cat input.json | jq .` should work

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · DISCORD_BOT_SETUP.md (reported line 77)May include surrounding context.
md
# Option 1: Environment variable export DISCORD_TOKEN="your_token_here" # Option 2: .env file (add to .gitignore) echo "DISCORD_TOKEN=your_token_here" > .env # Option 3: OpenClaw secret vault (recommended)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · DISCORD_BOT_SETUP.md (reported line 78)May include surrounding context.
md
# Option 1: Environment variable export DISCORD_TOKEN="your_token_here" # Option 2: .env file (add to .gitignore) echo "DISCORD_TOKEN=your_token_here" > .env # Option 3: OpenClaw secret vault (recommended)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · ENHANCEMENT_REVIEW.md (reported line 317)May include surrounding context.
md
1. Bump version in package.json 2. Create git tag: `git tag vX.Y.Z` 3. Push: `git push origin vX.Y.Z` 4. Re-submit to ClawhHub with new version ## Cross-Linking

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description overstates the scope of this code chunk. The implementation is narrowly focused on Discord data access: logging into Discord, fetching forum/thread/channel content, extracting metadata, and normalizing messages into a record format. While comments mention integration with a deduplication framework, no actual record-level deduplication logic appears here; the only dedupe present is removing duplicate URLs in extracted links, which is not the same as automatic ingestion deduplication. Likewise, there is no evidence of multi-source support in this chunk, nor any agent-ready orchestration/pattern features. Discord support is accurately represented, but the overall declared purpose does not accurately match this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The description is broader than the supplied code. This chunk is not a general multi-source ingestion component; it is a Discord-specific ingestion runner focused on forum content. While it does support ingestion and can invoke deduplication behavior through the ingest module, deduplication is not implemented here directly and may be skipped depending on configuration. Additionally, the code includes an undeclared capability to write intermediate results to the filesystem when outputPath is provided. 'Agent-ready patterns' is vague, but the code does expose autonomous ingestion modes and progress handling, so that part is not clearly inconsistent. Overall, the description does not accurately match this specific code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code generally matches the core idea of multi-source memory ingestion and includes automatic deduplication for files, JSON, and text. However, the description explicitly claims Discord support, and there is no Discord-specific ingestion path, API integration, parser, or trigger in the code. Instead, the implemented sources are files, URLs, JSON, and text. The code also clearly performs local filesystem reads/writes and URL network fetching, while the declared permissions are empty. Those are meaningful capabilities/resources not reflected in the declaration. 'Agent-ready patterns' is only loosely supported through frontmatter formatting and batching, but not as a distinct feature. Overall, the description is only partially accurate and omits important actual behaviors while claiming an unsupported one.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: The lockfile includes brace-expansion 1.1.12, which is flagged for denial-of-service issues involving pathological brace patterns. In this skill, the package appears only as a transitive dependency used for globbing and development tooling, so the issue is real but only likely exploitable if attacker-controlled glob or brace patterns are processed.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: flatted==3.3.4 — 2 advisory(ies): CVE-2026-32141 (flatted vulnerable to unbounded recursion DoS in parse() revive phase); CVE-2026-33228 (Prototype Pollution via parse() in NodeJS flatted)

High

Category: Supply Chain
Confidence: 84% confidence
Finding: The lockfile contains flatted 3.3.4, which is reported as vulnerable to parse-time denial of service and prototype pollution. However, it is a dev-only transitive dependency here, so the vulnerability is real in the dependency but unlikely to affect the shipped runtime unless development tooling parses attacker-supplied serialized data.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 91% confidence
Finding: brace-expansion 2.0.2 is present and reportedly vulnerable to resource-exhaustion conditions from crafted expansion inputs. In this lockfile it is nested under glob, so the main risk is denial of service when processing attacker-controlled glob or brace syntax rather than direct code execution.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 89% confidence
Finding: js-yaml 4.1.1 is listed with CPU-consumption issues tied to malicious YAML structures. In this file it is only a dev dependency through eslint, so the finding is valid at the dependency level but the operational risk to the skill runtime is limited unless development workflows parse untrusted YAML.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High

Category: Supply Chain
Confidence: 88% confidence
Finding: lodash 4.17.23 is present via @sapphire/shapeshift and is associated with prototype pollution and template-related code injection advisories. The code-injection path often depends on direct use of _.template, which is not demonstrated here, but prototype-pollution risks can become relevant if untrusted structured input is merged or transformed by dependent libraries.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==6.21.3 — 13 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +10 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: undici 6.21.3 is a runtime network library used by discord.js and is reported with multiple HTTP parsing and smuggling class issues. Because this skill supports Discord ingestion and likely performs network communication in production, a vulnerable HTTP client stack materially increases exposure to request smuggling, header injection, or connection-poisoning scenarios.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 93% confidence
Finding: ws 8.19.0 is a runtime websocket dependency used by the Discord stack and is flagged for memory disclosure and memory exhaustion issues. Given this skill's Discord support, websocket handling is part of the live attack surface, so malformed or adversarial traffic could plausibly affect availability or confidentiality depending on exploitability of the upstream bug.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide encourages autonomous Discord ingestion using a bot token and forum ID, but does not warn that Discord messages may contain personal, confidential, or regulated data that will be collected and stored in memory. In an agent-facing guide, this omission is meaningful because it normalizes bulk collection of user content without consent, minimization, or retention guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example offers an outputPath to save fetched forum data to disk but does not warn that this creates a persistent local copy of potentially sensitive conversations. This increases risk of unintended disclosure through insecure storage, backups, logs, or later reuse by other tools and agents.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · AGENT_GUIDE.md (reported line 309)May include surrounding context.
md
{ type: 'urls', data: [ 'https://api.example.com/docs', 'https://api.example.com/guide' ], metadata: {

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · AGENT_GUIDE.md (reported line 310)May include surrounding context.
md
{ type: 'urls', data: [ 'https://api.example.com/docs', 'https://api.example.com/guide' ], metadata: {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Slack export ingestion example treats team discussions as ordinary input without warning that chat exports often include sensitive business decisions, employee information, secrets, and private conversations. In a memory-ingestion skill, that omission can lead operators to ingest high-sensitivity internal communications into broader agent-accessible storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents autonomous ingestion of Discord forum content, including message text, usernames, IDs, mentions, links, and an optional outputPath for saving results, but it does not warn users that the operation may collect and persist potentially sensitive conversation data. Under the markdown-file criteria for missing user warnings, behaviours affecting user data and privacy should be disclosed explicitly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide explicitly encourages ingesting data sources such as Discord, Slack, GitHub, local notes, and URLs into memory, but it does not warn that these inputs may contain credentials, personal data, proprietary discussions, or other sensitive content that could later be surfaced by retrieval. In an agent-memory context, silent persistence and later automatic recall meaningfully increases the risk of unintentional disclosure across future prompts and workflows.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · CLI-GUIDE.md (reported line 438)May include surrounding context.
md
### No output after ingestion - Run with verbose: `clawtext-ingest ... -v` - Check memory directory: `ls -la ~/.openclaw/workspace/memory/` - Verify ClawText clusters rebuilt: `clawtext-ingest rebuild` ### Duplicates still being imported

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The examples present programmatic Discord ingestion, including use of forum/thread access tokens, without user-facing guidance on secure token handling or the sensitivity of transmitted content. In practice, agents and developers may copy these patterns into logs, config files, or subprocess calls that expose credentials and ingest private community data without adequate safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly promotes scheduled ingestion and recurring Discord monitoring but does not warn users about continuous collection of third-party data, retention implications, rate limits, or the need for authorization from the monitored service/community. In an agent-focused skill, omission of these guardrails increases the chance that autonomous workflows will be deployed in ways that over-collect data or violate user expectations and platform policies.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · ENHANCEMENT_REVIEW.md (reported line 45)May include surrounding context.
md
### 2. **Agent Autonomy Guide Missing** **Status:** No documentation for agents to use this autonomously **Impact:** Agents won't know how to ingest data programmatically **Fix:** Create AGENT_GUIDE.md with examples ### 3. **ClawhHub Integration Not Documented** **Status:** No instructions on how to submit to ClawhHub

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test-discord-cli.mjs:14

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/adapters/discord.js:15

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/index.js:14

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: test-discord-integration.mjs:30