Security audit

Alibabacloud Tablestore Openclaw Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent purpose, but it asks for powerful cloud credentials and can install external code, create cloud resources, and expand Tablestore public access without enough scoping.

Review this skill carefully before installing. Use an ECS RAM role or short-lived, least-privilege credentials, avoid pasting secrets into chat, verify the npm package source and integrity yourself, and do not allow auto-provisioning or public internet access changes unless you explicitly want the cost and exposure tradeoffs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:107
Finding: Unaudited Third-Party Plugin Is Downloaded and Executed
Content: View full analysis
2 && $MIRROR_TIME < $NPMJS_TIME) }"; }; then echo "Using China npm mirror" NPM_CONFIG_REGISTRY=https://registry.npmmirror.com openclaw plugins install @tablestore/openclaw-mem0@0.8.2 else openclaw plugins install @tablestore/openclaw-mem0@0.8.2 fi ``` The documented fallback also downloads and installs an unverified archive: ```bash cd /tmp && npm pack @tablestore/openclaw-mem0@0.8.2 mkdir -p /tmp/openclaw-mem0-install tar xzf /tmp/tablestore-openclaw-mem0-*.tgz -C /tmp/openclaw-mem0-install --strip-components=1 openclaw plugins install /tmp/openclaw-mem0-install ``` ### Technical Analysis The Skill installs executable plugin code dynamically from either the primary npm registry or `registry.npmmirror.com`. Although the package version is pinned to `0.8.2`, the instructions do not verify a cryptographic integrity hash, package signature, provenance attestation, or trusted publisher identity. Version pinning alone does not protect against registry account compromise, mirror compromise, package replacement, or malicious lifecycle and installation behavior already present in the pinned release. The mirror introduces an additional supply-chain trust boundary. The manual fallback similarly extracts and installs whichever matching archive is downloaded without verifying its contents or digest. Because the plugin is su ...[truncated 1322 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/ram-policies.md:1
Finding: Full Tablestore Administrative Policy Exceeds Documented Requirements
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:34
Finding: Cloud Secrets Are Requested Through Chat and Embedded in Shell Commands
Content: View full analysis
To set up Tablestore Mem0, I need: > > **Required:** > 1. Alibaba Cloud **AccessKey ID** > 2. Alibaba Cloud **AccessKey Secret** > 3. **阿里云百炼 API Key** > > **Optional (if you have an existing Tablestore instance):** > 4. Tablestore **endpoint** (e.g. `https://my-instance.cn-hangzhou.ots.aliyuncs.com`) > 5. Tablestore **instance name** ``` The configuration guidance then shows literal secrets inserted into shell commands: ```bash export TABLESTORE_ACCESS_KEY_ID="" export TABLESTORE_ACCESS_KEY_SECRET="" export DASHSCOPE_API_KEY="" ``` ### Technical Analysis Asking users to provide AccessKey secrets and API keys through an agent conversation can place those credentials in chat transcripts, request logs, observability systems, model-provider records, or audit exports. These storage paths may have retention and access controls that differ from a dedicated secret manager. Entering literal secrets in `export` commands can additionally place them in interactive shell history. Environment variables are inherited by child processes and may be readable through debugging facilities, process inspection under applicable operating-system permissions, crash diagnostics, or accidental logging. The configuration template references environment variables rather than directly hardcoding values in JSON, which is preferable to plaintext configuration. However, the prescribed collection and shell-entry process remains unsafe for long-lived credentials. ### Attack Path 1. The agent requests the Alibaba Cloud AccessKey Secret and DashScope API key in conversation. 2. The user p ...[truncated 1031 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:281
Finding: Plugin May Automatically Enable Public Internet Access
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase "remember this" is broad natural-language text that can easily appear in ordinary conversation, causing the skill to activate unexpectedly. In this skill's context, accidental activation is more dangerous than usual because the workflow asks for cloud credentials and can create billable Alibaba Cloud resources, increasing the chance of unintended sensitive operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest states that the skill may auto-provision a new Tablestore instance and enable public internet access when a VPC endpoint is unreachable, but it does so without an explicit warning or mandatory approval flow. In this context, that is dangerous because it can create billable cloud resources and weaken network exposure controls, potentially increasing attack surface and causing unintended data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The instructions require an 阿里云百炼 API key and default auto-provisioning to cn-hangzhou, and later state the provider/base URL must use DashScope-compatible endpoints. This imposes a specific regional/locale ecosystem without an explicit user opt-in or broader choice, which may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Excessive Permissions

Low

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill requests or recommends broad AliyunOTSFullAccess permissions, which likely exceed the minimum required for routine plugin operation. If the provided AccessKey or RAM role is compromised, an attacker could create, modify, expose, or delete Tablestore resources beyond this plugin's narrow needs; this is made more serious by the skill's support for auto-provisioning and network/public-access changes.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
4. Optional: existing Tablestore instance endpoint + instance name (otherwise auto-created) 5. Optional: **region ID** for auto-provisioning (defaults to `cn-hangzhou`) > 📋 **RAM Permissions:** See [references/ram-policies.md](references/ram-policies.md) for the complete list of required API permissions. ---

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The permission declaration includes high-impact capabilities such as instance creation, table creation, and instance updates, but it does not define clear activation constraints or user-confirmation boundaries for when those operations may occur. In an agent skill that can act on cloud resources, this increases the risk of unintended provisioning, configuration drift, and surprise exposure changes because powerful actions could be triggered implicitly from broad user requests.
Content: No source excerpt is available for this finding.