T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:85- Finding
Unpinned Remote Plugin and Dependency Code Is Retrieved and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Google Vertex AI Memory Bank
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent for setting up cloud-backed memory, but it installs and builds mutable remote code while also enabling persistent cross-agent storage of conversation and workspace data.
Review the remote repository and setup script before running it. Use a dedicated GCP project with least-privilege credentials, expect prompts and synced markdown files to be stored in Vertex AI Memory Bank, disable autoCapture or autoSyncFiles if you do not want automatic memory storage, and prefer a pinned, verified plugin version over the current git clone/git pull plus npm install flow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs users to run shell commands and a setup script, but it does not declare any tool scope or allowed tools. This weakens security review and execution controls because consumers cannot easily tell that the skill requires command execution and networked installation steps.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill prominently advertises auto-recall, auto-capture, file sync, and cross-agent memory, but it does not clearly warn that potentially sensitive prompts, facts, and workspace markdown files may be transmitted to and stored in Vertex AI. In this context, the omission is dangerous because the core feature is persistent third-party storage of user and workspace data across sessions and agents.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The documented curl command sends authenticated requests to a Google Vertex AI endpoint using an access token from gcloud, which is an external transmission of data and credentials in the broad security sense. While expected for legitimate cloud setup, it is still security-relevant because it provisions remote resources and transmits project identifiers and authenticated API calls to a third party.
- Content
md gcloud config set project YOUR_PROJECT_ID # Create a reasoning engine for Memory Bank curl -X POST \ "https://REGION-aiplatform.googleapis.com/v1beta1/projects/YOUR_PROJECT_ID/locations/REGION/reasoningEngines" \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script enables a GCP API and creates a Vertex AI reasoning engine immediately after basic prompts, without an explicit confirmation describing that billable cloud resources and project state will be modified. In an installation/setup context this behavior is expected, but it is still dangerous because a user may run the script assuming it only performs local configuration and unintentionally incur cost or alter the target project.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The script sends an authenticated POST request with the user's access token to the Vertex AI API to create a remote resource. In this skill's context, external transmission is expected, but it remains security-relevant because it uses live cloud credentials and changes remote infrastructure without a strong approval boundary beyond normal script execution.
- Content
sh # Create reasoning engine echo "Creating Memory Bank instance (reasoning engine)..." RESPONSE=$(curl -s -X POST \ "https://${REGION}-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/${REGION}/reasoningEngines" \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script clones code from a remote GitHub repository and then executes
npm installandnpm run build, which can run arbitrary package lifecycle scripts and build steps from untrusted remote content. This creates a supply-chain execution risk: compromise of the repository or dependencies could lead to arbitrary code execution on the user's machine during setup.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script offers to restart the OpenClaw gateway, but it does not explain the operational impact such as interrupting active sessions or changing runtime behavior immediately. Although it asks for confirmation, the lack of context can still surprise operators in multi-agent or shared environments.
- Content
Static analysis
No suspicious patterns detected.