Neural Memory CN

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:03 AM UTC
• Version: 1.0.1

Overview

This is a coherent neural-memory skill, but it needs Review because it can persist sensitive memory/profile data and may send memory/query text to external LLM or embedding services with under-disclosed controls.

Review before installing if your memories, profile, or queries may contain private or business-sensitive information. Use a dedicated storage path with restrictive permissions, avoid passing API keys on the command line, prefer environment or secret-manager handling, and keep LLM/embedding features disabled unless you explicitly accept sending memory/query text to the configured provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.py:167
• Finding: LLM API Key Exposed Through Command-Line Arguments and Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.py:167-181`; related insecure usage is documented in `SKILL.md:103-105` and `SKILL.md:111-118` **Vulnerability Type**: Plaintext secret handling and command-line credential exposure **Risk Level**: Medium ### Vulnerable Code ```python # Configure LLM if provided if llm_api_key and llm_base_url and llm_model: config["thinking"]["enhanced"]["use_llm_analysis"] = True config["thinking"]["intent"]["use_llm"] = True config["thinking"]["intent"]["llm_api_key"] = llm_api_key config["thinking"]["intent"]["llm_base_url"] = llm_base_url config["thinking"]["intent"]["llm_model"] = llm_model print(f"[OK] LLM configured / LLM 配置完成: {llm_model}") else: print(f"[INFO] LLM not configured / LLM 未配置 (using local mode)") # Write config config_path = base_path / "config.yaml" try: import yaml with open(config_path, "w", encoding="utf-8") as f: yaml.dump(config, f, default_flow_style=False, allow_unicode=True) ``` The setup interface accepts the credential directly as a command-line argument: ```python parser.add_argument("--api-key", default=None, help="LLM API key / LLM API 密钥") ``` The documented invocation encourages this behavior: ```bash python ~/.openclaw/skills/neural-memory-cn/scripts/setup.py \ --api-key "your-key" \ --base-url "https://openrouter.ai/api/v1" \ --model "openai/gpt-3.5-turbo" ``` ### Technical Analysis Command-line arguments are commonly visible in shell history and may temporarily be visible through operating-system process inspection facilities. Passing a live API key through `--api-key` therefore exposes it beyond the intended process. The setup script subsequently stores the key directly in `config.yaml`. The file is opened using the process's ordinary default permissions, without explicitly enforcing owner-only access. Its effective permissions consequently depend on the user's `umask`, existing file permissions, directo ...[truncated 1499 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove or deprecate the `--api-key` command-line option. 2. Accept credentials through a protected environment variable or an interactive prompt using `getpass.getpass()`. 3. Prefer storing a secret reference rather than the secret itself, using an operating-system keychain or dedicated secret manager. 4. If file-based storage is unavoidable: - Create the file atomically. - Enforce owner-only permissions such as `0600`. - Verify and correct permissions on existing files before writing. - Ensure the parent directory is accessible only to the owning user. 5. Remove examples that embed API keys in command lines or YAML files. 6. Warn users that rotating the key is necessary if it has previously appeared in shell history. 7. Redact credentials from errors, logs, diagnostics, and configuration displays. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Unpinned Package Execution in the Documented Installation Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-36` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```markdown ### 1. Install / 安装 ```bash npx clawhub install neural-memory-cn ``` ``` ### Technical Analysis The documented installation procedure invokes `npx` without specifying a version or integrity value for the resolved CLI package. Depending on the local environment, `npx` may download and execute the currently published package from a configured npm registry. Because the executable dependency is not pinned, the code run by future users can differ from the code reviewed during this audit. A compromised registry account, package takeover, malicious release, or altered registry configuration could cause attacker-controlled code to run during installation. The project does not include a lockfile, integrity hash, signature verification procedure, or explicit trusted registry in this installation command. ### Attack Path 1. An attacker compromises the package publishing account, registry entry, dependency resolution path, or configured package registry. 2. The attacker publishes or serves a malicious version of the package resolved as `clawhub`. 3. A user follows the documented `npx clawhub install neural-memory-cn` command. 4. `npx` retrieves the attacker-controlled release because no audited version or integrity value is specified. 5. The package executes with the permissions of the user running the installation command. This is a supply-chain attack path and depends on compromise or manipulation of the external package source; the audited repository itself does not contain the remote payload. ### Impact Assessment Malicious installation code would execute with the invoking user's privileges and could potentially: - Read or modify files accessible to that user - Access environment variables and local credentials - Alter the installed Skill or other user-owned tools - Make ...[truncated 310 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer CLI to a reviewed version, for example by using an exact package version. 2. Publish and verify package integrity hashes or cryptographic signatures. 3. Use a lockfile where the installation architecture permits it. 4. Explicitly document the trusted registry and discourage installation through untrusted registry mirrors. 5. Prefer a preinstalled, independently verified CLI over transient `npx` execution. 6. Establish a release-review process and document how users can verify package provenance before installation. 7. Periodically review the pinned package and update it through controlled, audited releases. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (45)

Hidden Instructions

High

• Category: Prompt Injection

Content

# 神经记忆系统增强版使用说明

## 新增组件

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation and examples show capabilities to read environment variables, read and write files under the user's home directory, and optionally send data to a remote LLM endpoint, but the manifest does not declare any tool scope or permissions. This creates a transparency and consent problem: users and hosting platforms cannot accurately assess the skill's effective access before installation or use.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The installation instructions use an unpinned `npx clawhub install neural-memory-cn` flow, which can fetch whatever package version is current at install time. This exposes users to supply-chain risk, including accidental breaking changes or a malicious package update being installed without review.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill encourages enabling an external LLM provider and configuring an API base URL and key, but it does not warn that user queries, learned content, or memory-derived context may be transmitted to a third-party service. In a memory system, that omission is more serious because the data involved can be sensitive, long-lived, and highly revealing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API reference describes optional LLM-based concept extraction and includes configuration for base URL, model, and API key, but it does not warn that user queries or learned content may be transmitted to an external model service. Because this skill processes memory content, external analysis could expose sensitive data to third-party providers or self-hosted endpoints without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly states that memory data is persisted to disk via file storage and save operations, but it does not warn users that their inputs and learned content will be retained locally. In a memory-oriented skill, users may provide sensitive personal or operational data, so silent persistence increases privacy and data exposure risk, especially on shared systems or unmanaged hosts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup script accepts an LLM API key from environment variables or CLI arguments and persists it into a local YAML/JSON config file. This creates credential exposure risk through world-readable files, backups, accidental commits, or local disclosure to other users/processes, especially because the script does not clearly warn that the secret will be stored on disk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file forces a specific language/locale for all user-facing instructions. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; no such opt-in or justification appears here.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README states that heartbeat processing will automatically record thinking results into long-term memory, but it does not clearly warn users that this persistence happens automatically or describe retention, review, and deletion controls. In a memory-oriented agent, silent persistence can capture sensitive prompts, inferred interests, and derived personal data without meaningful user awareness, creating privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes storage of protected personal attributes and daily activation query history, but does not provide a clear privacy warning, minimization guidance, or safeguards around sensitive profile data. Even if labeled as 'protected' from deletion, preserving identity and preference data indefinitely can increase harm from local compromise, unintended disclosure, or overcollection of user behavioral history.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file's human-readable comments and docstrings are predominantly in Chinese, including the primary module description, without indicating that language is configurable or user-selected. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes broad events such as user_query and heartbeat without any visible scoping, authorization, rate-limiting, or guard conditions. In a memory system, this can cause unintended background activation, excessive processing, or retrieval/linking of sensitive memory content in contexts where the user did not explicitly request it.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: Nearly all human-readable comments and docstrings in the file are written in Chinese, with no indication that language choice is optional or justified by a region-specific requirement. This can constitute a language/locale policy issue when a skill effectively assumes a single language without offering user choice or documenting the constraint.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The file’s human-facing comments, docstrings, and operational text are predominantly in Chinese, which effectively constrains maintainers or users to a specific language with no opt-in or alternative. Under the policy, forcing a language/locale without offering a choice can be a natural-language policy violation.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code enables external LLM use by default via `use_llm=True` and automatically pulls an API key from the `OPENROUTER_API_KEY` environment variable. That means a locally described memory component can silently expand into sending user queries to a remote service whenever credentials are present, creating an unexpected data disclosure path for potentially sensitive prompts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `_extract_concepts_with_llm` method sends raw user query text to an external API without any warning, masking, or consent check at the transmission point. In a memory-oriented skill, user queries may contain personal, proprietary, or safety-sensitive information, so forwarding them off-device can violate privacy expectations and leak sensitive data.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This code file contains user-facing natural-language comments and docstrings in Chinese, including the class and method descriptions, but does not indicate that Chinese is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy rule, forcing a specific language without user opt-in or justification is a policy concern.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The engine automatically switches from local mode to remote embedding mode whenever an OpenAI library and API key are present, causing memory and query text to be transmitted to an external service. In a memory system, those texts may contain sensitive user notes, recalled content, or private context, so the behavior conflicts with the expected 'local by default' privacy boundary and can lead to unintended data disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code sends raw input text to an external embedding API without any user-facing notice, consent flow, or policy gate in the implementation. Because this component processes memory and intent-related text, the transmitted content may include sensitive personal or operational data, creating a meaningful privacy and compliance risk.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code comments and flow in compute_text_similarity state that local mode uses keyword similarity as a fallback. However, search_similar_neurons delegates to _local_search_similar in local mode, and that function explicitly returns an empty list, contradicting the documented expectation of local similarity behavior for neuron search.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This code file includes natural-language comments and class docstrings in Chinese, such as the header comment and object descriptions. Under the stated policy, forcing a specific language without user choice or a documented region-specific justification is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code ingests sensitive personal data from UserProfile.md and Preferences.md and persists it as neurons, including identity, interests, and preferences, without any visible consent check, minimization, retention control, or access control in this file. In a memory system skill, centralizing protected user attributes into a searchable associative store increases the chance of unintended exposure, over-collection, or later reuse by other components.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The file's comments, docstrings, and user-facing print messages are written in Chinese, including warning/output text, with no indication that the skill supports other languages or that Chinese is a justified locale requirement. This can violate a language/locale policy when the skill effectively forces a specific language on users without opt-in.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The decay routine deletes synapses when their weight falls below 0.1, which is a destructive operation affecting stored data. Although there is a summary print after processing, there is no per-operation confirmation, warning comment near the deletion, or user disclosure tied to this irreversible pruning behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This function removes stored synapses based on a confidence threshold, which is a destructive data operation. The function prints only an aggregate count after deletions occur, but it does not provide advance disclosure, confirmation, or a clear warning in the function documentation that records will be permanently removed.

Static analysis

No suspicious patterns detected.