memory-pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:18 PM UTC
• Version: 2.5.0

Overview

This local memory-search skill needs Review because it can index more workspace Markdown than documented and can send private memory snippets to external reranking endpoints when that option is enabled.

Install only if you are comfortable with this skill indexing private memory plus additional workspace Markdown directories, or first set MEMORY_PRO_EXTRA_MD_DIRS to an empty value. Keep MEMORY_PRO_ENABLE_RERANK disabled unless you explicitly consent to sending search queries and retrieved memory snippets to the configured provider, and avoid arbitrary rerank endpoints. Treat BM25 pickle artifacts and /tmp benchmark outputs as sensitive local files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

other

Error

• Location: v2/rerank.py:54

Finding

External Disclosure of Private Memory During Reranking

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: v2/preprocess.py:142

Finding

Default Corpus Collection Exceeds the Documented Search Scope

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: v2/retrieval_hybrid.py:212

Finding

Unsafe Deserialization of a Configurable Pickle File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: v2/benchmark.py:39

Finding

Private Search Results Written to Predictable Shared Temporary Files

Content

View full analysis

/tmp/memory_pro_build.log 2>&1 || { tail -n 60 /tmp/memory_pro_build.log || true fail "build_index.py failed" } python3 "$CLIENT" "handover load" --url "$API_URL/search" --mode vector --json >/tmp/memory_pro_vector.json || fail "Vector query failed" python3 "$CLIENT" "handover load" --url "$API_URL/search" --mode hybrid --json >/tmp/memory_pro_hybrid.json || fail "Hybrid query failed" ``` ### Technical Analysis The benchmark stores retrieved memory excerpts in `/tmp/memory_pro_benchmark.json`. The validation script stores complete vector and hybrid search responses in predictable `/tmp` paths. These ...[truncated 1678 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: v2/main.py:54

Finding

Sentence-Transformer Model Loaded Without a Pinned Revision

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (54)

Tainted flow: 'url' from os.getenv (line 27, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request target is controllable via an environment variable and a command-line override, and the script sends the user’s semantic-search query to that endpoint over the network. That creates an exfiltration/SSRF-style risk because sensitive memory queries can be transmitted to an unintended or attacker-controlled service, especially since the skill is described as local memory search.

Content

Scanner excerpt · scripts/search_semantic.py (reported line 40)May include surrounding context.

python

for attempt in range(MAX_RETRIES):
        try:
            # Send POST request
            response = requests.post(url, json=payload, headers=headers, timeout=TIMEOUT)
            response.raise_for_status()
            return response.json()

Tainted flow: 'endpoint' from os.getenv (line 54, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

The code sends the user's query and memory-derived candidate sentences to a network endpoint taken from an environment variable, with no allowlist or validation of the destination. This creates a real exfiltration path for sensitive local memory contents and also allows SSRF-style abuse if an attacker can influence environment configuration.

Content

Scanner excerpt · v2/rerank.py (reported line 68)May include surrounding context.

python

"documents": [c.get("sentence", "") for c in work],
            "top_n": topn,
        }
        r = requests.post(endpoint, json=payload, headers=headers, timeout=timeout_ms / 1000)
        r.raise_for_status()
        data = r.json()
        # jina 常見格式: {results:[{index,relevance_score},...]}

Tainted flow: 'endpoint' from os.getenv (line 76, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

The openai-compatible path posts sensitive query text and candidate memory sentences to an externally configured endpoint from environment variables without destination validation. That is a direct data exfiltration channel and may also permit SSRF or internal network access if the endpoint is attacker-controlled.

Content

Scanner excerpt · v2/rerank.py (reported line 92)May include surrounding context.

python

"documents": [c.get("sentence", "") for c in work],
            "top_n": topn,
        }
        r = requests.post(endpoint, json=payload, headers=headers, timeout=timeout_ms / 1000)
        r.raise_for_status()
        data = r.json()
        rows = data.get("results", data.get("data", []))

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation and environment variables indicate optional third-party reranking, which can transmit user queries and candidate memory snippets to external providers. For a memory-search skill handling potentially private notes, this is a significant confidentiality risk, especially because the top-level description emphasizes a local vector database and may lead users to expect no external data sharing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation and environment variables indicate optional third-party reranking, which can transmit user queries and candidate memory snippets to external providers. For a memory-search skill handling potentially private notes, this is a significant confidentiality risk, especially because the top-level description emphasizes a local vector database and may lead users to expect no external data sharing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documentation and environment variables indicate optional third-party reranking, which can transmit user queries and candidate memory snippets to external providers. For a memory-search skill handling potentially private notes, this is a significant confidentiality risk, especially because the top-level description emphasizes a local vector database and may lead users to expect no external data sharing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documentation and environment variables indicate optional third-party reranking, which can transmit user queries and candidate memory snippets to external providers. For a memory-search skill handling potentially private notes, this is a significant confidentiality risk, especially because the top-level description emphasizes a local vector database and may lead users to expect no external data sharing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation and environment variables indicate optional third-party reranking, which can transmit user queries and candidate memory snippets to external providers. For a memory-search skill handling potentially private notes, this is a significant confidentiality risk, especially because the top-level description emphasizes a local vector database and may lead users to expect no external data sharing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documentation and environment variables indicate optional third-party reranking, which can transmit user queries and candidate memory snippets to external providers. For a memory-search skill handling potentially private notes, this is a significant confidentiality risk, especially because the top-level description emphasizes a local vector database and may lead users to expect no external data sharing.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Declaring .env as a configuration file for a skill that also uses numerous environment variables and may perform network operations creates a meaningful credential-exposure risk. In this context, .env may contain API keys, local service endpoints, or workspace secrets that could be read, copied, or inadvertently indexed or transmitted if handling is not tightly constrained.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- "OPENCLAW_NETWORK_DRIVE"
        - "OPENCLAW_WORKSPACE"
      config:
        - ".env"
        - "/skills/memory-pro/data/INDEX.json"
        - "/skills/memory-pro/data/state.json"
        - "/skills/memory-pro/v2/eval_queries.json"

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata promises local semantic search, but this code transmits both user queries and memory content to third-party reranking services. That mismatch is security-relevant because users may reasonably trust that private memory data never leaves the device when in fact it can be exported remotely.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This is a stronger variant of the same issue: the deserialization sink is not only unsafe, but the file path is environment-controlled and lacks validation or trust boundaries. In an agent skill context, environment variables are often deployment-configurable, so this expands the attack surface from local artifact tampering to configuration injection leading to arbitrary code execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares broad capabilities through required environment variables, local file access, index rewriting, and optional remote API configuration, but does not declare an explicit tool scope or permission boundary. That makes the effective privileges opaque to users and reviewers, increasing the chance that sensitive memory content or credentials are accessed in ways the user did not anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to restart the service without prominently warning that this rebuilds and rewrites the local memory index from workspace content. In a memory-focused skill, rewriting derived artifacts can unexpectedly ingest new sensitive files, overwrite prior state, or create a false expectation that restart is a harmless read-only troubleshooting step.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

md

### "Index size mismatch"
- This means `memory.index` and `sentences.txt` are out of sync.
- **Fix**: Restart the service. The startup script `start.sh` automatically runs `build_index.py` to fix this consistency issue before starting the API.

### "Address already in use"
- Port 8001 is taken by a zombie process.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The troubleshooting advice recommends killing whatever process holds port 8001, but does not warn that the process may not belong to this skill. This can terminate unrelated local services and, if copied blindly, encourages unsafe operator behavior that may cause denial of service or data loss.

Content

No source excerpt is available for this finding.

Tainted flow: 'STATE_FILE' from os.getenv (line 24, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/index.py (reported line 69)May include surrounding context.

python

def save_state(state):
    """Save processing state"""
    STATE_FILE.parent.mkdir(parents=True, exist_ok=True)
    with open(STATE_FILE, 'w', encoding='utf-8') as f:
        json.dump(state, f, ensure_ascii=False, indent=2)

def load_index():

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes the skill as providing semantic search over memory files using a local vector database. In this file, the index is loaded from and saved to a JSON file, and the rest of the logic extracts regex-based keywords and contexts rather than embeddings or vector-based retrieval, which is a materially different implementation and behavior.

Content

No source excerpt is available for this finding.

Tainted flow: 'INDEX_FILE' from os.getenv (line 20, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/index.py (reported line 82)May include surrounding context.

python

def save_index(index):
    """Save index to file"""
    INDEX_FILE.parent.mkdir(parents=True, exist_ok=True)
    with open(INDEX_FILE, 'w', encoding='utf-8') as f:
        json.dump(index, f, ensure_ascii=False, indent=2)

def process_file(filepath, incremental=False, state=None):

Tainted flow: 'INDEX_FILE' from os.getenv (line 17, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 92% confidence

Finding

The script derives INDEX_FILE from an environment variable and then writes to that path without validation. An attacker who can influence the environment could redirect writes to an unintended file location, causing arbitrary file overwrite within the privileges of the running process and potentially corrupting other workspace data.

Content

Scanner excerpt · scripts/search.py (reported line 25)May include surrounding context.

python

def save_index(index):
    INDEX_FILE.parent.mkdir(parents=True, exist_ok=True)
    with open(INDEX_FILE, 'w', encoding='utf-8') as f:
        json.dump(index, f, ensure_ascii=False, indent=2)

def search(query):

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a semantic-search skill backed by a local vector database, which implies embedding/vector similarity behavior. In this file, the search implementation lowercases the query and checks for substring matches against JSON keys loaded from INDEX.json, with no vector database or semantic retrieval logic present.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The implementation does not directly search local memory files as the manifest suggests; instead it depends on an HTTP service. This mismatch is dangerous because users may trust the skill as purely local while their queries are actually sent to another process or service, weakening transparency and informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Allowing the API endpoint to be overridden through both environment variables and CLI arguments means any caller or surrounding environment can redirect search traffic to an arbitrary host. In the context of memory search, that can expose highly sensitive queries to external systems unrelated to the stated local-search purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

This is a genuine external transmission sink: the script sends query data in a POST request to another service. External transmission is not automatically malicious, but in this context it is security-relevant because the skill handles memory-search inputs that may be sensitive and the manifest does not make this behavior obvious.

Content

Scanner excerpt · scripts/search_semantic.py (reported line 40)May include surrounding context.

python

for attempt in range(MAX_RETRIES):
        try:
            # Send POST request
            response = requests.post(url, json=payload, headers=headers, timeout=TIMEOUT)
            response.raise_for_status()
            return response.json()

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script has direct network transmission capability via HTTP POST, which expands the trust boundary beyond a local file-search utility. In this skill context, that is more dangerous because users would reasonably expect local processing of memory contents and queries, not outbound requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.