Super Taizi Knowledge Base

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

This knowledge-base skill is purpose-aligned, but it relies on an unbundled local Python script and can automatically persist user content, files, and extracted entities with weak scoping and consent controls.

Review this before installing. It appears intended to manage a personal knowledge base, but you should only use it if you trust the local vector_kb.py script at the documented path and understand that text, files, and extracted relationships may be retained in local OpenClaw knowledge, memory, and notes directories. Prefer a version that bundles the script, verifies its integrity, asks before writing, and documents how to inspect or delete stored data.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:25

Finding

Execution of an Unverified External Knowledge-Base Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-40
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: Medium

The skill delegates all knowledge-base operations to a fixed Python script located outside the reviewed package. The referenced vector_kb.py file is not included in the project, so its implementation and integrity cannot be verified by this audit.

markdown

### 存入知识库
```bash
python C:\Users\Administrator\.openclaw\scripts\vector_kb.py add --text "内容" --source "来源"

搜索知识库

bash

python C:\Users\Administrator\.openclaw\scripts\vector_kb.py search --query "关键词" --top 5

查看统计

bash

python C:\Users\Administrator\.openclaw\scripts\vector_kb.py stats

添加笔记文件

bash

python C:\Users\Administrator\.openclaw\scripts\vector_kb.py add-file --path "C:\path\to\file.md"

text

### Technical Analysis

Each documented operation invokes `C:\Users\Administrator\.openclaw\scripts\vector_kb.py` using the local Python interpreter. Because this absolute-path script is external to the audited skill package, the behavior presented to users as a legitimate knowledge-base operation depends on mutable, unaudited local code.

An attacker who can create or replace the referenced script can make ordinary skill invocations execute arbitrary Python code. The fixed path also appears to reside under an administrator profile, which could increase impact if the agent process executes with elevated privileges. The project itself does not demonstrate that the script has been replaced or that it contains malicious code; exploitation requires an attacker to obtain write access to the referenced file or its parent directory.

### Attack Path

1. An attacker obtains write access to `C:\Users\Administrator\.openclaw\scripts\` or otherwise controls `vector_kb.py`.
2. The attacker creates or replaces `vector_kb.py` with malicious Python code while preserving the expected c
...[truncated 878 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the required Python implementation inside the skill package so that it can be reviewed and versioned with the documentation.
2. Resolve the script relative to a trusted, immutable skill installation directory rather than an external user-profile path.
3. Verify the script using a cryptographic hash or digital signature before execution.
4. Restrict write permissions on the script and its parent directory to trusted administrators or the package-management process.
5. Run the script under a dedicated least-privileged account with access limited to the required knowledge-base directories.
6. Validate and safely pass all user-controlled text, query, source, and file-path arguments in the bundled implementation.
7. Fail closed when the expected script is missing, has unexpected ownership or permissions, or fails integrity verification.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase set includes very common everyday expressions such as “记一笔” and “帮我记住,” which can cause the skill to activate during ordinary conversation without clear user intent. In this skill, unintended activation is more dangerous because activation can persistently store user content into local knowledge, notes, and ontology directories, creating privacy and data-retention risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documents persistent storage locations for vectors, ontology data, and notes, but does not warn users that their content and files will be written to local directories and retained. This creates a meaningful privacy and consent issue because users may provide sensitive text or file paths without understanding that the information will be indexed, extracted, and stored for later retrieval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The skill documentation and trigger phrases are entirely in Chinese, with no indication that users may interact in other languages or opt into this locale. This can constitute a language/locale policy issue when no choice or justification is provided.

Content

No source excerpt is available for this finding.