Semantic Memory Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:20 AM UTC
• Version: 1.1.0

Overview

The skill is mostly a local memory-search helper, but its offline privacy claim conflicts with documented automatic Discord reporting for indexed memory results.

Review this carefully before installing. It can index private OpenClaw memory content; do not enable or rely on any cron or Discord integration unless you can confirm exactly what is sent and how to disable it. Prefer installing memsearch in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:38

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 38
Vulnerability Type: Unpinned dependency installation from the default Python package index
Risk Level: Medium

Technical Analysis

The installation instructions direct users to install memsearch[local] without a version constraint, lockfile, hash verification, or trusted-source restriction:

bash

pip3 install "memsearch[local]"

Consequently, the installed memsearch release and all transitive dependencies are determined at installation time. The effective code can change after this skill has been reviewed. A future compromised, malicious, or otherwise unsafe release could therefore be installed without any corresponding change to this repository.

Python source distributions may execute build-backend code during installation. Even when wheels are used, the installed package is subsequently executed by scripts/index.sh and scripts/search.sh, which invoke the memsearch executable.

Attack Path

1. An attacker compromises the upstream memsearch package, one of its transitive dependencies, or a future package release.
2. The attacker publishes a release containing malicious build or runtime code.
3. A user follows the documented command and installs the latest dependency set from the configured Python package index.
4. Malicious code executes either during package build/installation or when the installed memsearch executable is invoked.
5. The code runs with the privileges of the installing or invoking user and can access resources available to that account.

This is a supply-chain exposure rather than evidence that the current upstream package is malicious.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user running pip3 or the shell scripts. The affected scope can include the user's files, OpenClaw workspace, indexed memory documents, environment variables, loc ...[truncated 427 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin memsearch to a reviewed exact version rather than resolving the latest release:

   bash

   python3 -m pip install "memsearch[local]==<reviewed-version>"
   

2. Generate and commit a lock or constraints file that pins every transitive dependency.
3. Require cryptographic hashes, for example by generating a hash-locked requirements file and installing it with:

   bash

   python3 -m pip install --require-hashes -r requirements.lock
   

4. Verify package provenance and review release artifacts before updating the pinned version.
5. Install into an isolated virtual environment instead of the global or user Python environment.
6. Document a controlled dependency-update process that includes vulnerability scanning and review of dependency changes.
7. Avoid running installation commands with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document is written entirely in Chinese, including headings, instructions, and examples, with no indication that other languages are supported or that Chinese is a justified region-specific requirement. This can violate a language/locale policy when a skill implicitly requires a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation makes a strong privacy/security claim that the skill is 'completely offline' while elsewhere stating that cron results are pushed to Discord. This is dangerous because users may trust the offline claim and enable indexing of sensitive memory files without realizing data or metadata could be transmitted externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes automatic indexing and pushing results to Discord without clear user consent or disclosure about what data is sent. Because the indexed sources include memory and user files, even status messages, filenames, snippets, or errors could expose sensitive information to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's natural-language interface is presented in Chinese, including the title, usage text, and examples, with no indication that this is optional or region-specific. This can violate language/locale policy because it imposes a specific language on users without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description and surrounding instructional text are presented in Chinese, which effectively forces a specific language for users reading the skill documentation. There is no indication that the skill is region-specific or that an alternative language option is available.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The package description is written only in Chinese, which can impose a language preference without any visible opt-in, alternative locale, or explanation that the skill is region-specific. Under the policy for natural-language violations, locale or language constraints should either be optional for users or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script includes multiple user-facing Chinese strings such as the title, status messages, and example query text, but provides no option to use another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.