Yaoyao Memory Homo

• Outcome: Review
• Latest audit: May 29, 2026 · 9:34 PM UTC
• Version: 4.0.1

Overview

The skill is a real memory system, but it bundles sensitive memory storage with remote sync/embeddings, shell execution, an admin API, and updater behavior that are not consistently scoped or disclosed.

Install only after reviewing the high-risk options. Keep shell embedding disabled, do not configure embedding or IMA/Samba credentials unless you accept memory text leaving the machine, avoid exposing the dashboard beyond localhost, set and verify authentication before using admin endpoints, and treat auto-update/update commands as privileged operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (217)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            # 执行 clawhub update
            result = subprocess.run(
                ["clawhub", "update", self.slug, "--force"],
                capture_output=True,
                text=True,

• Confidence: 93% confidence
• Finding: This subprocess call performs a forced remote update of the skill via an external package manager. Even though it avoids shell injection, it still allows code and content in the skill to be replaced from a remote source without explicit trust verification, version pinning, or interactive confirmation, creating a supply-chain and unauthorized code-change risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("   请先运行 memory.py sync-start 初始化")
        return None
    
    result = subprocess.run(
        f'sqlite3 -cmd ".load {VEC_EXT}" "{VECTORS_DB}" '
        f'"SELECT COUNT(*) FROM l1_records; SELECT COUNT(*) FROM l1_vec; '
        f'SELECT COUNT(*) FROM l0_conversations; SELECT COUNT(*) FROM l0_vec;"',

• Confidence: 93% confidence
• Finding: This code invokes a shell with shell=True while interpolating VEC_EXT and VECTORS_DB directly into the command string. If either value is influenced by configuration, environment, or filesystem-controlled input, an attacker could inject shell metacharacters or abuse sqlite3's .load capability to load a malicious extension, leading to arbitrary command execution or native code execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            health_script = self.workspace / "skills" / "yaoyao-memory-v2" / "scripts" / "health_check.py"
            if health_script.exists():
                result = subprocess.run(
                    [sys.executable, str(health_script)],
                    capture_output=True,
                    text=True,

• Confidence: 83% confidence
• Finding: The wizard executes a Python script located under a user-writable workspace path derived from the home directory. If an attacker can place or modify ~/.openclaw/workspace/skills/yaoyao-memory-v2/scripts/health_check.py, running the setup wizard will execute arbitrary local code with the user's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

}
        
        # 简单命令：用列表形式，shell=False 更安全
        result = subprocess.run(
            [command] + args,
            shell=False,
            capture_output=True,

• Confidence: 95% confidence
• Finding: The code executes user-influenced commands via subprocess.run and only restricts the executable name, not the full argument set. Because many whitelisted commands such as cat, curl, grep, find, head, and tail accept arbitrary arguments, an attacker can read local files, probe the environment, or access network resources, which is unsafe for a memory/search skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
        
        try:
            result = subprocess.run(
                f'sqlite3 "{self.db_path}" "{sql}"', shell=False, capture_output=True, text=True, timeout=10
            )  # SECURITY FIX: shell=False removed

• Confidence: 96% confidence
• Finding: This call constructs a sqlite3 command as a single interpolated string and feeds it to subprocess.run while embedding SQL text directly. Even with shell=False, this is unsafe and brittle: attacker-controlled database content or paths can break argument parsing, and the overall pattern enables SQL injection into the sqlite3 CLI because later writes are built from unescaped conversation content.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
        
        try:
            subprocess.run(
                f'sqlite3 "{self.db_path}" "{sql}"', shell=False, capture_output=True, text=True, timeout=10
            )  # SECURITY FIX: shell=False removed
            self.log(f"✅ 升级 L0→L1: {candidate['id'][:16]}... (场景: {scene})")

• Confidence: 99% confidence
• Finding: This subprocess executes sqlite3 with SQL assembled from candidate content, scene, type, and id values inserted directly into the query. Because conversation content can contain quotes and SQL metacharacters, a crafted message can terminate the VALUES clause and inject arbitrary SQL, leading to database corruption, data tampering, or destructive statements.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

for item in self.queue:
            op = item['op']
            if hasattr(executor, op):
                result = getattr(executor, op)(*item['args'], **item['kwargs'])
                results.append(result)
        self.queue.clear()
        return results

• Confidence: 90% confidence
• Finding: `BatchOptimizer.execute_all()` invokes methods on an arbitrary `executor` object using an operation name taken from queued data. If untrusted input can influence `operation`, this becomes a generic method-dispatch primitive that may trigger unintended state changes, destructive methods, or sensitive functionality on the executor. In a memory/automation skill context, that can be more dangerous because executors often expose persistence, search, and maintenance operations.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            health_script = self.workspace / "skills" / "yaoyao-memory-v2" / "scripts" / "health_check.py"
            if health_script.exists():
                result = subprocess.run(
                    [sys.executable, str(health_script)],
                    capture_output=True,
                    text=True,

• Confidence: 87% confidence
• Finding: The wizard executes a Python script from a user-writable workspace path under the current user's interpreter without integrity verification. If an attacker can place or modify health_check.py in that location, running setup triggers arbitrary local code execution.

Tainted flow: 'req' from os.environ.get (line 182, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)
        
        try:
            with urllib.request.urlopen(req, timeout=30) as resp:
                result = json.loads(resp.read().decode('utf-8'))
                return result['data'][0]['embedding']
        except Exception as e:

• Confidence: 97% confidence
• Finding: The script sends `content` from local memory records to `https://ai.gitee.com/v1/embeddings` using a bearer token sourced from the environment. Because this skill is described as a local SQLite/FTS5 memory system, transmitting potentially sensitive conversation memory to a third-party service creates a real confidentiality and scope-expansion risk, even if the endpoint itself is legitimate.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and documents capabilities implying file access, shell execution, networking, and environment interaction, but declares no permissions. This creates a transparency and consent failure: users or hosting platforms cannot accurately assess the risk surface before installation, while the documented commands include API serving, sync, and maintenance actions that materially expand what the skill can do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is a local memory system, but the documentation also exposes a much broader operational scope including API server startup, cloud/NAS sync, automated maintenance, governance, and external bridge integrations. This mismatch is dangerous because users may trust the skill as a simple local memory tool while it can handle networked services, synchronization, and administrative behaviors that increase attack surface and privacy risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The advanced guide documents network/cloud synchronization and an external embeddings API even though the skill metadata emphasizes local SQLite-based memory. This creates a documentation-to-behavior mismatch that can mislead users into sending memory content or metadata off-host without realizing the privacy implications.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The architecture document presents the skill as using local SQLite/FTS storage, but later describes cloud sync and cloud backup workflows via `sync_ima.py`. That discrepancy can mislead users and integrators about data boundaries, causing sensitive conversation memory to be transmitted off-device without clear expectation or consent.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documented feature set materially exceeds the stated purpose of a local SQLite/FTS5 memory system by including operational, remote-access, sync, and execution-related capabilities. This is dangerous because capability creep obscures the true trust boundary of the skill and can cause users or host agents to grant permissions inappropriate for what appears to be a simple memory component.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: A shell embedding capability is high risk in a memory skill because it creates an execution surface unrelated to core memory storage and retrieval. If reachable by prompts, plugins, or automation paths, it could enable arbitrary command execution, data exfiltration, host modification, or abuse of the agent runtime.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: Automatic update functionality expands the skill from data management into code or configuration mutation, which is a materially different and riskier capability. Without strong provenance checks and explicit disclosure, auto-update can become a supply-chain or integrity risk and may alter behavior outside user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Cloud sync features conflict with a 'local storage' positioning and introduce outbound data transfer risk that changes the privacy and threat model of the skill. Memory systems often contain sensitive conversational context, so undocumented synchronization can expose user data to external systems or broader network surfaces.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: Documented API server, unified API, and web UI components indicate the skill may expose network-accessible or browser-accessible interfaces beyond a local memory backend. This increases attack surface through authentication, request handling, and remote access pathways that are not apparent from the core description.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The maintenance guide documents cloud backup (IMA同步) and network-dependent synchronization even though the skill metadata presents the system as local SQLite/FTS5 storage. This discrepancy can mislead users and operators about where memory data is sent, creating an undocumented data exfiltration and privacy risk if sensitive cross-session memory is synchronized externally.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The documented IMA cloud synchronization capability is not clearly necessary for a skill described as a local memory system, so it expands the trust boundary without justification. For a memory skill that may store sensitive conversation context, adding remote sync introduces privacy, compliance, and unauthorized disclosure risks if users assume data remains local.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document makes strong privacy assurances that data is stored locally and not sent to third-party servers, while also advertising optional cloud synchronization to IMA. Even if cloud sync is optional, this wording can mislead users about actual data flows and cause them to disclose sensitive information under false assumptions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The FAQ says data is local and does not pass through third-party servers, but earlier sections describe cloud backup to IMA. Contradictory privacy statements are dangerous because users may rely on the more reassuring statement and unknowingly expose personal memory data to an external provider.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The documented feature flag `shell.enabled` indicates the skill can expose shell execution capability, which is high-risk and not necessary for a memory system's core function. In an agent skill context, any shell access can become a command-execution path if coupled with prompt injection, unsafe tooling, or weak authorization, making the surrounding context more dangerous rather than less.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The API exposes powerful administrative actions such as backup creation, cleanup, feature toggling, configuration changes, password management, and snapshot creation through a local HTTP server without any authentication or authorization checks. Even if intended for a local dashboard, this materially expands the skill's privilege surface beyond memory retrieval/storage and allows any local process, browser page, or cross-origin script to invoke sensitive operations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code exposes password administration endpoints for setting, verifying, and removing a secondary password, but those endpoints themselves are not protected by any existing authenticated session or trust boundary. This can let an attacker with local or browser-mediated access manipulate the protection mechanism directly, undermining the intended safeguard and introducing a new sensitive secret-management surface.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: governance.py:84

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: install_modules.py:186

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/governance.py:84

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/install_modules.py:186

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/push_helper.py:120

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/virustotal_scan.py:28

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/backfill_l0_vectors.py:64

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sync_ima.py:36