ClawHub
Back to skill

Security audit

synapcores-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent as a self-hosted memory tool, but it asks users to run mutable external components and use an admin API key with a raw SQL endpoint for persistent memory operations.

Install only if you are comfortable running SynapCores locally and managing its API key. Bind the gateway to localhost, protect and rotate the bootstrapped admin key, prefer a least-privilege key if available, pin the Docker image and plugin version/digest, and avoid storing secrets, payment data, regulated data, or untrusted text without robust SQL escaping.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:87
Finding

SQL Injection Through Direct Interpolation of Memory Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-96
Vulnerability Type: SQL injection caused by manual string escaping
Risk Level: High

Vulnerable Code

bash
sc "SELECT MEMORY_STORE('default', 'Luis prefers dark roast and takes calls after 10am') AS id" \
  | jq -r '.data.rows[0][0]'
# mem_1kzv0fkzy_AK7TUf
text
Note the SQL string quoting: **single quotes are strings, double quotes are
identifiers.** A double-quoted value is read as a column name and will error.
Escape an apostrophe by doubling it — `'Luis''s laptop'`.

Technical Analysis

The skill constructs SQL by inserting memory content directly into a quoted SQL string. Although the sc helper uses jq to encode the resulting SQL as JSON, JSON encoding does not parameterize the SQL statement or make its embedded values safe.

The documented protection consists only of instructing the agent to double apostrophes. This is error-prone because every caller must correctly identify and escape all attacker-controlled values before constructing the statement. If a memory supplied by a user contains an unescaped quote, it can terminate the intended string literal and alter the surrounding SQL syntax.

The same construction pattern applies to recall queries, namespaces, memory identifiers, and metadata if those values are dynamically substituted into the documented templates. The namespace validation rule is described in prose but is not enforced by the helper.

Attack Path

  1. An attacker asks the agent to remember text containing SQL control characters and a quote that closes the MEMORY_STORE content argument.
  2. The agent places the text into the documented SQL template without complete SQL-literal escaping.
  3. jq safely serializes the modified SQL into JSON, but leaves the SQL semantics unchanged.
  4. The helper sends the attacker-influenced statement to /v1/query/execute using the configured bearer credentia ...[truncated 1315 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace SQL string interpolation with a gateway API that supports prepared statements and separately bound parameters.
  2. If parameter binding is unavailable, provide a single audited helper that converts input into a valid SQL literal. Do not require the agent or user to perform manual escaping.
  3. Validate namespaces in code against ^[A-Za-z_][A-Za-z0-9_]*$ before constructing any query.
  4. Treat memory IDs, recall queries, metadata, and all user-provided content as untrusted input.
  5. Configure the query endpoint to reject multiple statements and dangerous administrative operations where they are not required.
  6. Use a least-privilege API key restricted to the necessary memory namespaces and functions.
  7. Add tests covering apostrophes, comment tokens, statement separators, Unicode quote variants, malformed metadata, and attempted nested expressions.
  8. Avoid exposing a general-purpose SQL execution endpoint to the skill when purpose-specific memory endpoints can be used instead.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:42
Finding

Unpinned Container Image and Plugin Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-45 and 153-160
Vulnerability Type: Mutable and unversioned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
docker run -d --name synapcores -p 8080:8080 \
  -v synapcores-data:/var/lib/synapcores \
  -e SYNAPCORES_TELEMETRY=off \
  ghcr.io/synapcores/community:latest
bash
openclaw plugins install clawhub:@synapcores/openclaw-memory

Technical Analysis

The Docker command uses the mutable latest tag rather than an immutable image digest. A future execution can therefore download different code even though the audited skill file has not changed.

The optional plugin installation command similarly omits an exact version or integrity value. It can resolve to a newer package than the one reviewed by the user. The documentation later discusses plugin version v0.7.0, but the installation command does not enforce that or any other reviewed version.

These commands create a review-to-execution gap: the effective code is selected by external registries at installation or pull time. Compromise of an upstream account, registry, release process, or mutable tag could cause users to execute unauthorized code.

Attack Path

  1. An attacker compromises an upstream publisher account, image registry, plugin registry, or release pipeline, or causes a mutable release reference to point to a malicious artifact.
  2. The user follows the documented Docker or plugin installation command.
  3. The package manager or container runtime resolves the unpinned reference to the attacker-controlled artifact.
  4. The container or plugin executes without any digest or checksum comparison against a previously reviewed artifact.
  5. The malicious component accesses resources available in its execution context.

For the container, those resources include the persistent synapcores-data volume and the host-exposed service port. For the pl ...[truncated 990 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the container to a reviewed immutable digest, for example ghcr.io/synapcores/community@sha256:<reviewed-digest>.
  2. Document the corresponding human-readable version while treating the digest as the authoritative installation reference.
  3. Pin the OpenClaw plugin to an exact reviewed version and integrity hash where the package manager supports them.
  4. Verify artifact signatures, provenance attestations, and checksums before installation.
  5. Configure automated dependency monitoring to propose reviewed digest or version updates rather than silently following latest.
  6. Run the container as a non-root user with a read-only root filesystem, dropped Linux capabilities, resource limits, and only the required volume and network access.
  7. Restrict the published gateway port to loopback unless remote access is explicitly required.
  8. Give the plugin a separate least-privilege API key and restrict its access to required namespaces and operations.
  9. Review plugin permissions and source changes before upgrading to a new version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs the user to retrieve admin login material and an API key from container logs, then export the key into the shell, but it does not provide a strong warning about handling, rotating, or scoping that secret. This increases the chance of credential leakage through shell history, terminal scrollback, shared logs, screenshots, or misuse of an admin-level token, especially because the skill is explicitly designed for persistent storage of user data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

3. Check it answers:

bash
curl -s "$SYNAPCORES_URL/health"
# {"status":"ok","timestamp":"…"}

Static analysis

No suspicious patterns detected.