Security audit

Ollama Memory Embeddings

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated purpose, but review is warranted because preview/check modes can still change state and the optional watchdog can persistently rewrite OpenClaw configuration.

Install only if you are comfortable with a shell skill changing OpenClaw memory configuration. Avoid relying on --dry-run or --check-only as strictly read-only, keep backups of ~/.openclaw/openclaw.json, do not pass real secrets through --api-key-value, and enable the launchd watchdog only if you specifically want ongoing automatic config healing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: install.sh:280
Finding: Dry-run mode performs model downloads and imports before exiting
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/config.js:44
Finding: Malformed configuration is silently treated as empty and overwritten
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: enforce.sh:79
Finding: Check-only enforcement creates configuration files and directories
Content: View full analysis
"$CONFIG_PATH" ``` These writes occur before the check-only branch: ```bash export CONFIG_PATH MODEL_NORM BASE_URL_NORM API_KEY_VALUE if [ "$CHECK_ONLY" -eq 1 ]; then set +e node "${CONFIG_CLI}" check-drift "${CONFIG_PATH}" "${MODEL_NORM}" "${BASE_URL_NORM}" status=$? set -e if [ "$status" -eq 0 ]; then log_info "No drift detected." exit 0 elif [ "$status" -eq 10 ]; then log_info "Drift detected." exit 10 else log_err "drift check failed." exit 1 fi fi ``` ### Technical Analysis The script creates the parent directory and writes an empty JSON object whenever the target configuration is missing. This happens before it evaluates `CHECK_ONLY`. As a result, `enforce.sh --check-only` is not read-only. The watchdog also invokes this mode during its drift-check cycle, so a periodic watchdog can create a previously absent OpenClaw configuration without entering its explicit healing phase. ### Attack Path 1. The configured OpenClaw JSON path does not exist. 2. A user runs: ```bash enforce.sh --check-only --model embeddinggemma ``` or a watchdog cycle performs the same check. 3. The script creates the parent directory using `mkdir -p`. 4. The script creates the configuration containing `{}`. 5. Only after those changes does it execute the check-only drift logic. 6. The command reports drift even though it has already changed the filesystem. ### Impact Assessment No additional privileges are obtained; writes occur with the caller's existing permissions. The practical impact includes: - Unexpected creation of `~/.openclaw` or an operator-specified directory. - Creation of an empty configuration that ca ...[truncated 236 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: watchdog.sh:62
Finding: Unvalidated watchdog interval permits launchd plist injection
Content: View full analysis
"$PLIST_PATH" < Label ${esc_plist_name} ProgramArguments ${esc_shell_bin} ${esc_skill_dir}/watchdog.sh --once --model ${esc_model} --base-url ${esc_base_url} --openclaw-config ${esc_config_path} ${restart_flag_xml} RunAtLoad StartInterval ${INTERVAL_SEC} StandardOutPath ${esc_stdout_log} StandardErrorPath ${esc_stderr_log} EOF ``` ### Technical Analysis Most values inserted into the plist are checked for newline characters and XML-escaped. `INTERVAL_SEC`, however, is neither restricted to digits nor escaped before being ...[truncated 2180 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill includes persistent drift enforcement and optional installation of a launchd watchdog that periodically checks and rewrites configuration. Persistence and auto-healing materially increase risk because they can override user changes, maintain unwanted state across sessions, and make later remediation harder if the configuration is incorrect or abused.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- Adds an idempotent drift-enforcement command (`enforce.sh`)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · verify.sh (reported line 131)May include surrounding context.
sh
TMP_BODY="$(mktemp)" TMP_ERR="$(mktemp)" set +e HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w "%{http_code}" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" \ "$EMBED_URL" 2>"$TMP_ERR")"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 141)May include surrounding context.
text
3. **Direct endpoint check:** ```bash curl -s -X POST http://127.0.0.1:11434/v1/embeddings \ -H "Content-Type: application/json" \ -d '{"model":"nomic-embed-text:latest","input":"test"}' | head -c 200

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SECURITY.md (reported line 18)May include surrounding context.
md
- `install.sh` - install and configure memory embeddings provider - `verify.sh` - endpoint and model verification only - `enforce.sh` - idempotent config enforcement with lock protection - `watchdog.sh` - optional drift healing and optional launchd install - `audit.sh` - read-only report (no mutation) - `uninstall.sh` - best-effort revert using latest config backup

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 43)May include surrounding context.
sh
- `install.sh` - install and configure memory embeddings provider - `verify.sh` - endpoint and model verification only - `enforce.sh` - idempotent config enforcement with lock protection - `watchdog.sh` - optional drift healing and optional launchd install - `audit.sh` - read-only report (no mutation) - `uninstall.sh` - best-effort revert using latest config backup

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises shell-driven installation, verification, enforcement, watchdog, and restart behavior but does not declare any tool scope or permissions metadata. In a system that relies on manifest-declared capabilities for user review or policy enforcement, this creates an authorization transparency gap and can cause users or orchestrators to grant shell access implicitly to a skill that modifies config, restarts services, and installs persistence mechanisms.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill intentionally writes persistent configuration under OpenClaw defaults, can restart the gateway, and can install ongoing drift enforcement/watchdog behavior. Even without obvious malicious intent, this establishes durable session-affecting state and optional background persistence, which can outlive the install action and continue influencing agent behavior or service operation.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- `model = <selected model>:latest` - `remote.baseUrl = "http://127.0.0.1:11434/v1/"` - `remote.apiKey = "ollama"` (required by client, ignored by Ollama) - Performs a post-write config sanity check (reads back and validates JSON) - Optionally restarts the OpenClaw gateway (with detection of available restart methods: `openclaw gateway restart`, systemd, launchd) - Optional memory reindex during install (`openclaw memory index --force --verbose`)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 47)May include surrounding context.
sh
--model <id> embeddinggemma | nomic-embed-text | all-minilm | mxbai-embed-large --import-local-gguf <mode> auto | yes | no (default: no) Use yes to explicitly scan/import a local GGUF. --import-model-name <name> model name to create in Ollama (default: embeddinggemma-local) --openclaw-config <path> OpenClaw config path (default: ~/.openclaw/openclaw.json) --non-interactive do not prompt; use supplied/default values --restart-gateway <mode> yes | no (default: no)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · install.sh (reported line 117)May include surrounding context.
sh
} ollama_running() { curl -fsS "http://127.0.0.1:11434/api/tags" >/dev/null 2>&1 } # Search for any embedding GGUF (embeddinggemma, nomic-embed, all-minilm, mxbai-embed).

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 240)May include surrounding context.
sh
uid="$(id -u)" echo " macOS (launchd): launchctl kickstart -k gui/${uid}/bot.molt.gateway" fi # Linux systemd if command -v systemctl >/dev/null 2>&1 && systemctl --user is-enabled openclaw-gateway 2>/dev/null; then echo " Linux (systemd): systemctl --user restart openclaw-gateway" fi

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script accepts an API key as a positional command-line argument and persists it into the JSON config file if one is not already set. Passing secrets on the command line can expose them through shell history, process listings, logs, or job runners, and storing them in plaintext config increases the chance of accidental disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The apply-enforce command performs a file write to the supplied config path via writeConfig(), modifying persisted configuration and potentially inserting credentials, but this code path provides no confirmation prompt and no user-facing disclosure at the time of the write. Aside from the generic usage text, there is no explicit warning in this file that apply-enforce will overwrite the configuration file.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · verify.sh (reported line 131)May include surrounding context.
sh
TMP_BODY="$(mktemp)" TMP_ERR="$(mktemp)" set +e HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w "%{http_code}" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" \ "$EMBED_URL" 2>"$TMP_ERR")"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 29)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 30)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 152)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 160)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 164)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 176)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 178)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · watchdog.sh (reported line 208)May include surrounding context.
sh
UNINSTALL_LAUNCHD=0 QUIET=0 PLIST_NAME="bot.molt.openclaw.embedding-guard" PLIST_PATH="${HOME}/Library/LaunchAgents/${PLIST_NAME}.plist" LOG_DIR="${HOME}/.openclaw/logs" STDOUT_LOG="${LOG_DIR}/embedding-guard.out.log"

Static analysis

No suspicious patterns detected.