ClawHub
Back to skill

Security audit

Memory LanceDB Setup

Security checks for vulnerabilities and agentic risk

Overview

This setup skill is purpose-aligned, but it under-discloses sensitive memory data flow and tells users to modify a global OpenClaw installation with unpinned packages and a direct patch script.

Review before installing. Use only non-secret memory content, do not store tokens or credentials in vector memory, consider a local embedding provider for confidential work, use a dedicated low-quota API key, avoid placing keys in shell history, pin npm package versions where possible, and back up the OpenClaw installation before running the patch script.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding

Unpinned npm dependencies are installed directly into the OpenClaw installation

Content
View full analysis
Remediation
View remediation
npm install --save-exact @lancedb/lancedb-darwin-arm64@ ``` 2. Commit and enforce a lockfile so that transitive dependency versions and integrity values remain reproducible. 3. Prefer `npm ci` against a reviewed lockfile rather than resolving current versions with `npm install`. 4. Review package provenance, publisher history, release signatures, and dependency changes before updating. 5. Disable lifecycle scripts with `--ignore-scripts` when the packages can function without them. If scripts are required, review them before installation. 6. Run installation with the least-privileged account capable of maintaining OpenClaw; do not use administrative elevation unless strictly necessary. 7. Document a tested compatibility matrix of OpenClaw, LanceDB, and architecture-specific binding versions. 8. Apply the same version pins to every command repeated in `references/troubleshooting.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Embedding API key is exposed through a command-line argument and persisted without documented protections

Content
View full analysis
Remediation
View remediation
' # Configure OpenClaw to resolve the key from EMBEDDING_API_KEY. ``` 4. If interactive entry is supported, read the key without terminal echo and pass it over standard input rather than through process arguments. 5. Ensure any configuration file containing the credential is owned by the OpenClaw account and readable only by that account, such as mode `0600` on applicable Unix-like systems. 6. Exclude secrets from logs, crash reports, support bundles, and unencrypted backups. 7. Document credential rotation and revocation procedures. 8. Advise users who already followed the command to remove the command from shell history and rotate the exposed key. 9. Use a dedicated, least-privileged API key with restrictive quotas and provider-side usage monitoring. ]]>

other

Warning
Location
SKILL.md:61
Finding

Sensitive memory content may be disclosed to an external embedding provider

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly configures an external embedding endpoint and encourages storing semantic memory without warning that stored memories will be transmitted to a third-party API for embedding. In this context, memory content may contain sensitive project data, credentials, operational rules, or personal information, so users could unknowingly exfiltrate local memory contents to an external provider.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
### 1. Get a Gemini API Key (free)

Go to [aistudio.google.com](https://aistudio.google.com) → Get API key → Create API key.

### 2. Configure the plugin

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script unconditionally modifies a dependency file under /usr/local, which is typically a privileged/shared installation path, without confirmation, backup, integrity verification, or ownership checks. In an agent/skill context, automatic mutation of globally installed code is risky because it can silently alter runtime behavior, break package integrity, and affect other users or processes on the host.

Content

No source excerpt is available for this finding.

Tainted flow: 'patched' from pathlib.Path.read_text (line 62, file read) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · references/patch_native.py (reported line 63)May include surrounding context.

python
sys.exit(1)

    patched = content.replace(OLD, NEW)
    NATIVE_JS.write_text(patched)
    print("Patched successfully. Run: openclaw gateway restart")

if __name__ == "__main__":

Static analysis

No suspicious patterns detected.