Ollama Memory Embeddings

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:49 PM UTC
• Version: 1.0.4

Overview

The skill mostly matches its stated purpose, but review is warranted because preview/check modes can still change state and the optional watchdog can persistently rewrite OpenClaw configuration.

Install only if you are comfortable with a shell skill changing OpenClaw memory configuration. Avoid relying on --dry-run or --check-only as strictly read-only, keep backups of ~/.openclaw/openclaw.json, do not pass real secrets through --api-key-value, and enable the launchd watchdog only if you specifically want ongoing automatic config healing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:280
• Finding: Dry-run mode performs model downloads and imports before exiting<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:280-344` **Vulnerability Type**: Dry-run safety violation and unintended state modification **Risk Level**: Medium ### Vulnerable Code ```bash if [ "$WILL_IMPORT" = "yes" ]; then echo "Importing local GGUF into Ollama as: ${IMPORT_MODEL_NAME}" if import_gguf_to_ollama "$LOCAL_GGUF" "$IMPORT_MODEL_NAME"; then MODEL_TO_USE="$IMPORT_MODEL_NAME" echo "Import succeeded." else echo "WARNING: import failed. Falling back to pulling '${MODEL}'." fi fi # ── Ensure model is available in Ollama ────────────────────────────────────── if ! model_exists_in_ollama "$MODEL_TO_USE"; then echo "Pulling Ollama model: ${MODEL_TO_USE}" ollama pull "$MODEL_TO_USE" fi # Normalize for config and API calls MODEL_TO_USE_CANON="$(normalize_model "$MODEL_TO_USE")" echo "Using model: ${MODEL_TO_USE_CANON}" # ── Dry run plan ───────────────────────────────────────────────────────────── if [ "$DRY_RUN" -eq 1 ]; then echo "" echo "DRY RUN: no files or services will be changed." echo "Would modify:" echo " - ${SKILLS_DIR}/ (skill files)" echo " - ${CONFIG_PATH} (OpenClaw config)" echo "Would set memorySearch keys:" echo " - provider: openai" echo " - model: ${MODEL_TO_USE_CANON}" echo " - remote.baseUrl: http://127.0.0.1:11434/v1/" echo " - remote.apiKey: (set)" echo "Would run:" echo " - ${SKILLS_DIR}/enforce.sh --model ${MODEL_TO_USE_CANON} --openclaw-config ${CONFIG_PATH} --base-url http://127.0.0.1:11434/v1/" if [ "$RESTART_GATEWAY" = "yes" ]; then echo " - gateway restart" else echo " - gateway restart skipped (default)" fi if [ "$INSTALL_WATCHDOG" -eq 1 ]; then echo " - watchdog install via launchd (${WATCHDOG_INTERVAL}s)" else echo " - watchdog install skipped (default)" fi if [ "$IMPORT_LOCAL_GGUF" = "no" ]; then echo " - local GGUF scan/import skipped (default)" else echo " - local GGUF import mode: ${IMPORT_LOCAL_ ...[truncated 1769 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Move dry-run handling before every mutation-capable operation, including `ollama create`, `ollama pull`, directory creation, file copying, configuration writes, service operations, and memory reindexing. Recommended hardening plan: 1. Resolve and validate arguments without changing state. 2. Check whether a model appears to be installed using read-only commands. 3. Calculate whether an import or pull would be required. 4. If `DRY_RUN=1`, print those planned operations and exit. 5. Invoke `ollama create` or `ollama pull` only after the dry-run branch. 6. Add regression tests that compare the Ollama model list and relevant filesystem state before and after a dry run. 7. Clearly distinguish read-only probes from state-changing operations in helper functions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: lib/config.js:44
• Finding: Malformed configuration is silently treated as empty and overwritten<![CDATA[ ## Vulnerability Details **File Location**: `lib/config.js:44-54` and `lib/config.js:183-192` **Vulnerability Type**: Destructive error handling and unsafe configuration replacement **Risk Level**: High ### Vulnerable Code ```javascript function readConfig(path) { try { return JSON.parse(fs.readFileSync(path, "utf8")); } catch (_) { return {}; } } function writeConfig(path, cfg) { fs.writeFileSync(path, JSON.stringify(cfg, null, 2)); } ``` The empty object returned after any read or parsing failure is subsequently written during enforcement: ```javascript if (cmd === "apply-enforce") { const configPath = process.argv[3]; const model = process.argv[4] || ""; const base = process.argv[5] || ""; const apiKey = process.argv[6] || ""; if (!configPath || !model || !base || !apiKey) throw new Error("missing required args"); const cfg = readConfig(configPath); const plan = planEnforce(cfg, model, base, apiKey); writeConfig(configPath, plan.cfg); process.exit(0); } ``` ### Technical Analysis `readConfig()` catches every exception and returns `{}`. It does not distinguish among: - A configuration file that does not exist. - Invalid or partially written JSON. - Filesystem read failures. - Encoding or I/O errors. The enforcement path then interprets the empty object as a valid configuration, adds the managed memory-search keys, and writes the resulting minimal object over the target file. Consequently, an existing malformed configuration can be replaced rather than rejected and preserved. The write is also performed directly against the destination instead of using a same-directory temporary file and atomic rename. A crash or interruption during the write can leave another malformed or truncated configuration. ### Attack Path 1. The OpenClaw configuration contains a temporary syntax error, partial write, merge artifact, or otherwise malformed JSON. 2. The user runs `enforce.sh`, or the installed watchdog detects drif ...[truncated 1138 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Fail closed on invalid or unreadable existing configuration. Recommended hardening plan: 1. Handle only `ENOENT` as an absent configuration: ```javascript function readConfig(path) { try { return JSON.parse(fs.readFileSync(path, "utf8")); } catch (err) { if (err.code === "ENOENT") { return {}; } throw err; } } ``` 2. Report JSON parsing errors clearly and abort without changing the original file. 3. Separate explicit initialization of a missing configuration from parsing an existing configuration. 4. Validate that the parsed top-level value is a non-array object. 5. Write the new JSON to a securely created temporary file in the same directory. 6. Flush and atomically rename the temporary file over the destination. 7. Preserve the original file mode and ownership where applicable. 8. Validate the newly written JSON before completing the replacement. 9. Ensure the watchdog reports an error rather than attempting to heal malformed configuration. 10. Add tests covering malformed JSON, empty files, permission errors, interrupted writes, and absent files. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: enforce.sh:79
• Finding: Check-only enforcement creates configuration files and directories<![CDATA[ ## Vulnerability Details **File Location**: `enforce.sh:79-82` and `enforce.sh:148-162` **Vulnerability Type**: Unexpected filesystem mutation in a read-only mode **Risk Level**: Low ### Vulnerable Code ```bash require_cmd node mkdir -p "$(dirname "$CONFIG_PATH")" [ -f "$CONFIG_PATH" ] || echo "{}" > "$CONFIG_PATH" ``` These writes occur before the check-only branch: ```bash export CONFIG_PATH MODEL_NORM BASE_URL_NORM API_KEY_VALUE if [ "$CHECK_ONLY" -eq 1 ]; then set +e node "${CONFIG_CLI}" check-drift "${CONFIG_PATH}" "${MODEL_NORM}" "${BASE_URL_NORM}" status=$? set -e if [ "$status" -eq 0 ]; then log_info "No drift detected." exit 0 elif [ "$status" -eq 10 ]; then log_info "Drift detected." exit 10 else log_err "drift check failed." exit 1 fi fi ``` ### Technical Analysis The script creates the parent directory and writes an empty JSON object whenever the target configuration is missing. This happens before it evaluates `CHECK_ONLY`. As a result, `enforce.sh --check-only` is not read-only. The watchdog also invokes this mode during its drift-check cycle, so a periodic watchdog can create a previously absent OpenClaw configuration without entering its explicit healing phase. ### Attack Path 1. The configured OpenClaw JSON path does not exist. 2. A user runs: ```bash enforce.sh --check-only --model embeddinggemma ``` or a watchdog cycle performs the same check. 3. The script creates the parent directory using `mkdir -p`. 4. The script creates the configuration containing `{}`. 5. Only after those changes does it execute the check-only drift logic. 6. The command reports drift even though it has already changed the filesystem. ### Impact Assessment No additional privileges are obtained; writes occur with the caller's existing permissions. The practical impact includes: - Unexpected creation of `~/.openclaw` or an operator-specified directory. - Creation of an empty configuration that ca ...[truncated 236 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Process check-only mode before any directory or file creation. Recommended structure: 1. Resolve and validate the model and base URL. 2. If `CHECK_ONLY=1`: - If the target file is absent, report drift and exit with status 10. - If the target exists, parse and compare it without writing anything. 3. Only execute `mkdir -p` and initialize a missing configuration in the mutation branch. 4. Document and test a strict invariant that check-only mode does not change filesystem metadata or contents. 5. Add tests using a nonexistent temporary path and confirm that neither the directory nor file exists after execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: watchdog.sh:62
• Finding: Unvalidated watchdog interval permits launchd plist injection<![CDATA[ ## Vulnerability Details **File Location**: `watchdog.sh:62-72` and `watchdog.sh:176-211` **Vulnerability Type**: Structured configuration injection into a persistent launchd job **Risk Level**: Medium ### Vulnerable Code The command-line value is accepted without numeric validation: ```bash while [ $# -gt 0 ]; do case "$1" in --model) MODEL="$2"; shift 2 ;; --base-url) BASE_URL="$2"; shift 2 ;; --openclaw-config) CONFIG_PATH="$2"; shift 2 ;; --interval-sec) INTERVAL_SEC="$2"; shift 2 ;; --once) ONCE=1; shift ;; --restart-on-heal) RESTART_ON_HEAL=1; shift ;; --install-launchd) INSTALL_LAUNCHD=1; shift ;; --uninstall-launchd) UNINSTALL_LAUNCHD=1; shift ;; --quiet) QUIET=1; shift ;; --help|-h) usage; exit 0 ;; *) echo "Unknown option: $1"; usage; exit 1 ;; esac done ``` It is then interpolated directly into XML: ```bash cat > "$PLIST_PATH" <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>${esc_plist_name}</string> <key>ProgramArguments</key> <array> <string>${esc_shell_bin}</string> <string>${esc_skill_dir}/watchdog.sh</string> <string>--once</string> <string>--model</string> <string>${esc_model}</string> <string>--base-url</string> <string>${esc_base_url}</string> <string>--openclaw-config</string> <string>${esc_config_path}</string> ${restart_flag_xml} </array> <key>RunAtLoad</key> <true/> <key>StartInterval</key> <integer>${INTERVAL_SEC}</integer> <key>StandardOutPath</key> <string>${esc_stdout_log}</string> <key>StandardErrorPath</key> <string>${esc_stderr_log}</string> </dict> </plist> EOF ``` ### Technical Analysis Most values inserted into the plist are checked for newline characters and XML-escaped. `INTERVAL_SEC`, however, is neither restricted to digits nor escaped before being ...[truncated 2180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Strictly validate the interval as an integer before generating the plist: ```bash if [[ ! "$INTERVAL_SEC" =~ ^[0-9]+$ ]]; then log_err "--interval-sec must be a positive integer." exit 1 fi if [ "$INTERVAL_SEC" -lt 10 ] || [ "$INTERVAL_SEC" -gt 86400 ]; then log_err "--interval-sec must be between 10 and 86400." exit 1 fi ``` Additional hardening measures: 1. Apply validation immediately after argument parsing. 2. Validate `WATCHDOG_INTERVAL` in `install.sh` as well as `INTERVAL_SEC` in `watchdog.sh`. 3. Prefer generating the plist through a structured plist API or tool rather than textual interpolation. 4. After generation, inspect the parsed plist and verify an allowlist of expected keys and value types. 5. Reject duplicate keys and unexpected dictionaries. 6. Create the plist with restrictive user-only permissions. 7. Add tests using XML metacharacters, negative values, decimals, whitespace, excessively small intervals, and excessively large intervals. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.

Ae1

High

• Category: analysis-evasion

Content

- Adds an idempotent drift-enforcement command (`enforce.sh`)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

TMP_BODY="$(mktemp)"
TMP_ERR="$(mktemp)"
set +e
HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w "%{http_code}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \
  "$EMBED_URL" 2>"$TMP_ERR")"

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Transmission

Medium

• Category: Data Exfiltration

Content

```
3. **Direct endpoint check:**
   ```bash
   curl -s -X POST http://127.0.0.1:11434/v1/embeddings \
     -H "Content-Type: application/json" \
     -d '{"model":"nomic-embed-text:latest","input":"test"}' | head -c 200
   ```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `install.sh` - install and configure memory embeddings provider
- `verify.sh` - endpoint and model verification only
- `enforce.sh` - idempotent config enforcement with lock protection
- `watchdog.sh` - optional drift healing and optional launchd install
- `audit.sh` - read-only report (no mutation)
- `uninstall.sh` - best-effort revert using latest config backup

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `install.sh` - install and configure memory embeddings provider
- `verify.sh` - endpoint and model verification only
- `enforce.sh` - idempotent config enforcement with lock protection
- `watchdog.sh` - optional drift healing and optional launchd install
- `audit.sh` - read-only report (no mutation)
- `uninstall.sh` - best-effort revert using latest config backup

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises shell-driven installation, verification, enforcement, watchdog, and restart behavior but does not declare any tool scope or permissions metadata. In a system that relies on manifest-declared capabilities for user review or policy enforcement, this creates an authorization transparency gap and can cause users or orchestrators to grant shell access implicitly to a skill that modifies config, restarts services, and installs persistence mechanisms.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `model = <selected model>:latest`
  - `remote.baseUrl = "http://127.0.0.1:11434/v1/"`
  - `remote.apiKey = "ollama"` (required by client, ignored by Ollama)
- Performs a post-write config sanity check (reads back and validates JSON)
- Optionally restarts the OpenClaw gateway (with detection of available
  restart methods: `openclaw gateway restart`, systemd, launchd)
- Optional memory reindex during install (`openclaw memory index --force --verbose`)

• Confidence: 90% confidence
• Finding: The skill intentionally writes persistent configuration under OpenClaw defaults, can restart the gateway, and can install ongoing drift enforcement/watchdog behavior. Even without obvious malicious intent, this establishes durable session-affecting state and optional background persistence, which can outlive the install action and continue influencing agent behavior or service operation.

Session Persistence

Medium

• Category: Rogue Agent

Content

--model <id>                embeddinggemma | nomic-embed-text | all-minilm | mxbai-embed-large
  --import-local-gguf <mode>  auto | yes | no   (default: no)
                              Use yes to explicitly scan/import a local GGUF.
  --import-model-name <name>  model name to create in Ollama (default: embeddinggemma-local)
  --openclaw-config <path>    OpenClaw config path (default: ~/.openclaw/openclaw.json)
  --non-interactive           do not prompt; use supplied/default values
  --restart-gateway <mode>    yes | no (default: no)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

ollama_running() {
  curl -fsS "http://127.0.0.1:11434/api/tags" >/dev/null 2>&1
}

# Search for any embedding GGUF (embeddinggemma, nomic-embed, all-minilm, mxbai-embed).

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

uid="$(id -u)"
    echo "  macOS (launchd):  launchctl kickstart -k gui/${uid}/bot.molt.gateway"
  fi
  # Linux systemd
  if command -v systemctl >/dev/null 2>&1 && systemctl --user is-enabled openclaw-gateway 2>/dev/null; then
    echo "  Linux (systemd):  systemctl --user restart openclaw-gateway"
  fi

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script accepts an API key as a positional command-line argument and persists it into the JSON config file if one is not already set. Passing secrets on the command line can expose them through shell history, process listings, logs, or job runners, and storing them in plaintext config increases the chance of accidental disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The apply-enforce command performs a file write to the supplied config path via writeConfig(), modifying persisted configuration and potentially inserting credentials, but this code path provides no confirmation prompt and no user-facing disclosure at the time of the write. Aside from the generic usage text, there is no explicit warning in this file that apply-enforce will overwrite the configuration file.

External Transmission

Medium

• Category: Data Exfiltration

Content

TMP_BODY="$(mktemp)"
TMP_ERR="$(mktemp)"
set +e
HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w "%{http_code}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \
  "$EMBED_URL" 2>"$TMP_ERR")"

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

UNINSTALL_LAUNCHD=0
QUIET=0

PLIST_NAME="bot.molt.openclaw.embedding-guard"
PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist"
LOG_DIR="${HOME}/.openclaw/logs"
STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.