ClawHub
Back to skill

Security audit

Kv Embed Store

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent embedding-based key-value store, with privacy risks users should manage when configuring the embedding provider and optional memory indexing.

Install only if you are comfortable sending key names and search queries to your chosen embedding provider. Use a trusted HTTPS base URL, protect the API key, avoid sensitive keys or regulated data, and enable memoryIndex only for content you are comfortable making discoverable through memory search.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Tainted flow: 'BASE_URL' from os.environ.get (line 29, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
def embed(texts: list[str], api_key: str) -> np.ndarray:
    """Get embeddings from SiliconFlow API."""
    resp = requests.post(
        f"{BASE_URL}/embeddings",
        headers={"Authorization": f"Bearer {api_key}"},
        json={"model": MODEL, "input": texts, "encoding_format": "float"},
Confidence
93% confidence
Finding
The code allows the embedding endpoint to be fully overridden by the SILICONFLOW_BASE_URL environment variable while also sending the Bearer API key in the Authorization header and user-provided text in the request body. In an agent or multi-tenant runtime where environment variables can be influenced, this can redirect secrets and sensitive content to an attacker-controlled server, making the external transmission materially dangerous.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill clearly relies on an external embeddings provider for put/search operations, which means user-supplied keys and likely query text are transmitted off-host. The documentation provides provider configuration and usage details but does not prominently warn users that their content will leave the local environment, creating a meaningful privacy and data-handling risk if sensitive material is stored or queried.

Ssd 3

Medium
Confidence
89% confidence
Finding
The memory index feature is described as making aliases and value previews discoverable through memory_search, which broadens access to previously stored content beyond its original storage context. If users place credentials, internal notes, or sensitive records in the store, preview-based discovery can unintentionally surface that data to unrelated prompts or workflows.

Ssd 3

Medium
Confidence
90% confidence
Finding
The documentation explicitly encourages enabling memoryIndex so entries become discoverable via natural-language memory search. That recommendation increases the chance that sensitive stored content will be retrieved outside its original purpose, especially in agent environments where memory search may be broadly accessible across tasks.

External Transmission

Medium
Category
Data Exfiltration
Content
def embed(texts: list[str], api_key: str) -> np.ndarray:
    """Get embeddings from SiliconFlow API."""
    resp = requests.post(
        f"{BASE_URL}/embeddings",
        headers={"Authorization": f"Bearer {api_key}"},
        json={"model": MODEL, "input": texts, "encoding_format": "float"},
Confidence
86% confidence
Finding
The function transmits caller-supplied text to an external embedding service and includes an API credential in the request. In this skill context, keys, queries, and stored values may contain sensitive operational or user data, so external transmission creates a real confidentiality risk that should be treated explicitly.

Static analysis

No suspicious patterns detected.