Security audit

Oclaw Hermes

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent multi-agent memory bridge, but it needs Review because it broadly stores and syncs conversation data and gives containers writable access to agent state and credentials.

Install only after reviewing the memory and Docker behavior. Use least-privilege test credentials, avoid putting secrets or private data in prompts, bind services to localhost, pin container images, narrow or make mounts read-only, and enable sync only to trusted HTTPS endpoints with clear retention and deletion procedures.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T02 · Agent Memory Poisoning

Error

Location: scripts/unified_core.py:116
Finding: Persistent Untrusted Memory Poisoning
Content: View full analysis
= 3 or row['importance'] >= 7: conn.execute( "UPDATE memories SET layer = 'long' WHERE id = ?", (row['id'],) ) consolidated.append(row['id']) ``` The CLI also permits the caller to select the importance value: ```python parser.add_argument( "--importance", type=float, default=5.0, help="Importance score (1-10)" ) ``` ### Technical Analysis User-controlled task content is automatically recorded and later retrieved as agent context. There is no separa ...[truncated 1900 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mflow.py:325
Finding: Disclosure of Stored Memory to a Caller-Controlled HTTP Endpoint
Content: View full analysis
Dict[str, Any]: try: import requests with sqlite3.connect(self.db_path) as conn: cursor = conn.execute( "SELECT * FROM memories WHERE synced = 0 AND source != 'deerflow'" ) rows = cursor.fetchall() synced_count = 0 for row in rows: entry = { "id": row[0], "layer": row[1], "content": row[2], "source": row[3], "timestamp": row[4], "metadata": json.loads(row[5]) if row[5] else {} } try: response = requests.post( f"{deerflow_url}/api/memory", json=entry, timeout=5 ) ``` The destination is exposed directly through the command line: ```python parser.add_argument( "--deerflow-url", default="http://localhost:2026" ) ``` ```python result = engine.full_sync(args.deerflow_url) ``` ### Technical Analysis The synchronization destination is accepted without validating its scheme, hostname, port, resolved address, or trust relationship. The endpoint may use cleartext HTTP, including by default. Every unsynchronized memory record not marked as originating from DeerFlow is serialized and transmitted. Records contain the full `content` and metadata fields. No redaction, consent check, destination authentication, payload encryption, or data classification is applied. A malicious or mistaken command-line value can therefore ...[truncated 1191 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auto_memory.py:45
Finding: Automatic Plaintext Retention of Sensitive Conversation and Task Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/distill.py:223
Finding: Arbitrary Filesystem Write Through Unsanitized Expert Name
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: docker-compose.yml:62
Finding: Excessive Container Access to Credentials and Persistent Agent State
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: docker-compose.yml:4
Finding: Mutable Unverified Third-Party Container Images
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (49)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 42)May include surrounding context.
2. 配置

bash
cp .env.example .env # 编辑 .env 填入 API Keys

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 43)May include surrounding context.
bash
cp .env.example .env # 编辑 .env 填入 API Keys

3. 启动

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
bash
cp .env.example .env # 编辑 .env 填入 API Keys

3. 启动

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
bash
cp .env.example .env # 编辑 .env 填入 API Keys

3. 启动

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: record_user_intent stores raw user messages, inferred intent, confidence, and session identifiers without any visible notice, consent, minimization, or retention control. This creates privacy risk because sensitive user content may be persistently captured and later retrieved or repurposed without the user's knowledge.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: extract_and_store_facts persists up to 1000 characters of arbitrary content plus extracted entities into memory layers including long-lived ones, without any user-facing disclosure or approval. Because the input is broad free-form content, it can capture credentials, personal data, proprietary text, or other sensitive material and retain it beyond the immediate interaction.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function is documented as '同步记忆到 OpenClaw' and comments describe implementing actual OpenClaw sync logic, but no API call, file write, or other OpenClaw transfer occurs. Instead, the code simply updates the local database to set synced=1, which contradicts the stated behavior and can falsely indicate successful export.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code sends memory contents and metadata to DeerFlow over plain HTTP by default, which exposes potentially sensitive session and long-term memory data to interception or tampering by local network attackers, proxies, or malware on the host. Because this component is explicitly designed to synchronize stored memories across platforms, the transmitted data may contain high-value secrets, making the context more dangerous than ordinary telemetry.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file is written entirely in Chinese and presents the agent collaboration standard as a mandatory operating document, but it does not provide any language selection, fallback, or opt-in for other locales. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The markdown states the Lead Agent trigger condition as "所有请求" (all requests), which is maximally broad and does not define any boundary for when the skill should or should not activate. This creates ambiguity around invocation scope and increases the risk of unintended activation from ordinary conversation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Phrases like "研究类任务、需要外部信息" are descriptive but not operationally specific, and similar ambiguity appears in other trigger lines such as programming tasks, external webpage needs, professional skills, context/history needs, and expert perspective needs. Without concrete trigger phrases or exclusions, the skill routing rules are open-ended and may overlap with common requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README instructs users to place API keys in a .env file and advertises memory synchronization across multiple agent systems, but provides no privacy, retention, or data-sharing warning. In a multi-agent bridge with cross-platform memory sync, secrets and sensitive prompts may be propagated or exposed more broadly than users expect, increasing the chance of accidental disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly promotes cross-platform memory synchronization and a 'complete closed loop' for retaining agent state, but it does not clearly warn users that their prompts, task context, and potentially sensitive data may be stored and propagated across multiple systems. This creates a real privacy and data-retention risk because users may reasonably assume ordinary session-scoped processing rather than persistent multi-system storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation states that conversation content is automatically extracted into facts and stored in layered memory, including persistent long-term layers, without any explicit consent flow or warning. Automatic extraction and retention of user-provided information increases the risk of storing secrets, personal data, or regulated content beyond the user's expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The deployment instructions tell users to populate API keys and tokens, but do not clearly disclose that the skill connects to several third-party/local services and may transmit prompts, memory data, and operational metadata to them. This omission can lead to unintentional disclosure of sensitive information to external providers under the user's credentials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module description and all user-facing strings are exclusively in Chinese, indicating a fixed language/locale experience with no opt-in or alternative. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module description explicitly frames the system as automatically listening, extracting, integrating, and recommending based on conversation content. In context, this increases concern because later code implements persistent storage of user interactions and inferred data, indicating broad retention by design rather than incidental logging.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script prepends a hard-coded user-specific local path to sys.path and then imports mflow_v2 from outside the skill directory. This expands the trust boundary to arbitrary local code at that path, enabling dependency hijacking, unexpected code execution, or hidden behavior that is not visible in the skill itself.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: User-intent logging stores the raw message text together with an inferred intent label and confidence, creating a durable behavioral profile of the user. This is especially risky because intent inference can reveal sensitive attributes or goals beyond the original text and may be reused in later contexts.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The fact extraction routine stores substantial arbitrary content, derived entities, session metadata, and routes some categories to longer-lived memory layers such as long, skill, or expert. In a skill context, this can silently turn ordinary conversation or supplied documents into persistent knowledge records, increasing exposure of confidential or regulated data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Session finalization stores summaries, record counts, timestamps, and the entire buffered activity list into memory, further broadening retained context beyond the immediate session. This compounds privacy and data-minimization risks because even derived summaries and activity metadata can expose user behavior and sensitive topics over time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring and operational messages are written exclusively in Chinese, including the service description and command output text. For a general bridge controller, this imposes a specific language on users without opt-in or any documented region-specific justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/bridge.py (reported line 39)May include surrounding context.
python
def check_openclaw(self) -> PlatformStatus: """检查 OpenClaw 连接""" try: result = subprocess.run( ["openclawmp", "list"], capture_output=True, text=True, timeout=10 )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/bridge.py (reported line 60)May include surrounding context.
python
def check_hermes(self) -> PlatformStatus: """检查 Hermes 连接""" try: result = subprocess.run( ["pgrep", "-f", "hermes"], capture_output=True, text=True )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains user-facing natural language almost entirely in Chinese, including the module description and later generated usage instructions. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T02 · Agent Memory Poisoning

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T08 · Insecure Dependencies

SkillSpector

Credential Access

2. 配置

Credential Access

3. 启动

Credential Access

3. 启动

Credential Access

3. 启动

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Natural-Language Policy Violations

Vague Triggers

Vague Triggers

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Ssd 3

Context-Inappropriate Capability

Ssd 3

Ssd 3

Ssd 3

Natural-Language Policy Violations

subprocess module call

subprocess module call

Natural-Language Policy Violations

Static analysis