Security audit

Alibabacloud Tablestore Openclaw Memory

Security checks across malware telemetry and agentic risk

Overview

The skill has a legitimate memory setup purpose, but it asks for broad Alibaba Cloud control and can automatically expose Tablestore to the public internet, so it needs review before install.

Install only if you are comfortable granting cloud-memory infrastructure permissions. Prefer an ECS RAM role or a custom least-privilege RAM policy, avoid pasting long-lived secrets into chat, verify the npm package separately, and require explicit approval before any instance creation or public internet exposure.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill explicitly says to prefer environment variables for secrets, but the provided jq template writes access keys and API keys directly into openclaw.json. Persisting cloud credentials in a config file increases exposure through filesystem reads, backups, logs, shell history, accidental commits, or later disclosure by the agent/application.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The declared permissions include instance lifecycle management and instance configuration actions that exceed a narrowly scoped memory backend's core need to read and write memory records. In particular, pairing provisioning actions with instance update capability increases the chance the skill can modify infrastructure state, including exposure-related settings, without clear necessity or strong constraints.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documentation explicitly states the skill may enable public internet access when a VPC endpoint is unreachable, which is a material security-affecting network exposure change. Allowing an automation skill for memory storage to relax network boundaries creates a clear risk of unintended external exposure of the backing datastore and expands the attack surface.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Auto-provisioning a new Tablestore instance goes beyond a simple install/configure memory plugin role and grants the skill authority to create billable infrastructure resources. This scope expansion is dangerous because it can lead to unintended resource creation, unexpected costs, and deployment of storage infrastructure outside the user's intended governance process.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The permission usage language is broad and underspecified, so sensitive actions such as provisioning, updating instances, and data operations are not tightly bounded by preconditions or approval requirements. Ambiguous documentation around high-impact actions makes misuse and overbroad implementation more likely, especially in agentic contexts where automation may act without sufficient human review.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The file describes sensitive actions including infrastructure creation, instance updates, and data-affecting operations without corresponding user-facing warnings about security, exposure, and cost implications. In a skill that may be invoked through natural-language triggers like 'remember this,' the absence of explicit warnings and consent boundaries makes accidental high-impact changes more dangerous.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.