Rag

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:05 PM UTC
• Version: 1.0.6

Overview

The skill is mostly a local RAG indexer, but it persistently indexes broad private data and includes an under-disclosed external posting feature.

Install only if you are comfortable with your OpenClaw sessions, tool outputs, skill docs, and workspace files being copied into a persistent searchable local database. Avoid indexing secrets, review/delete the database when needed, do not enable scheduled re-indexing unless you want ongoing scans, and treat Moltbook posting as a separate network publishing feature that can post content under your account.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: ingest_docs.py:89

Finding

Unrestricted ingestion and persistent storage of sensitive workspace and session data

Content

View full analysis

4000: text_chunks = chunk_text(content) else: text_chunks = [content] for i, chunk in enumerate(text_chunks): metadata = { "type": "workspace", "source": str(relative_path), "file_path": str(file_path), "file_size": len(content), "chunk_index": i, "total_chunks": len(text_chunks), "file_extension": file_path.suffix.lower(), "ingested_at": datetime.now().isoformat() } doc_id = rag.add_document(chunk, metadata) ``` ```python # ingest_sessions.py elif item_type == 'toolCall': tool_name = item.get('name', 'unknown') args = str(item.get('arguments', ''))[:100] texts.append(f"[Tool: {tool_name}({args})]") elif item_type == 'toolResult': result = str(item.get('text', item.get('result', ''))).strip() if len(result) > 500: result = result[:500] + "..." texts.append(f"[Tool Result: {result}]") ``` ```pyt ...[truncated 2099 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: rag_agent.py:69

Finding

Stored indirect prompt injection and unauthorized cross-session context retrieval

Content

View full analysis

800: text = text[:800] + "..." context_parts.append(f"{header}\n{text}\n") ``` ```python # rag_agent.py context = search_relevant_context(user_query, rag, max_results=5) if not context: return message_content enhanced = f"""[RAG CONTEXT - Retrieved from knowledge base:] {context} --- [CURRENT USER MESSAGE:] {message_content}""" return enhanced ``` ```bash # launch_rag_agent.sh results = rag.search(ORIGINAL_TASK, n_results=3) if results: context = \"\\n=== RELEVANT CONTEXT FROM KNOWLEDGE BASE ===\\n\" for i, r in enumerate(results, 1): meta = r.get(\"metadata\", {}) text = r.get(\"text\", \"\")[:500] doc_type = meta.get(\"type\", \"unknown\") source = meta.get(\"source\", \"unknown\") context += f\"\\n[{doc_type.upper()} - {source}]\\n{text}\\n\" else: context = \"\" print(f\"\"\"{context} === CURRENT TASK === {ORIGINAL_TASK} Use the context above if relevant to help answer the question.\" ``` ### Technical Analysis Workspace files, Skill documents, session messages, and tool output are attacker-influenceable data. Retrieved records are concatenated directly into ...[truncated 1548 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned third-party package installation creates a supply-chain risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:421

Finding

Moltbook API credential instructions may create a locally readable token file

Content

View full analysis

~/.config/moltbook/credentials.json << EOF { "api_key": "moltbook_sk_YOUR_KEY_HERE" } EOF ``` ```python API_BASE = "https://www.moltbook.com/api/v1" CONFIG_PATH = os.path.expanduser("~/.config/moltbook/credentials.json") def load_api_key(): """Load API key from config file or environment variable""" api_key = os.environ.get('MOLTBOOK_API_KEY') if api_key: return api_key if os.path.exists(CONFIG_PATH): with open(CONFIG_PATH, 'r') as f: config = json.load(f) return config.get('api_key') return None ``` ### Technical Analysis The documented setup stores a bearer token in plaintext without setting a restrictive umask or explicit directory and file modes. Under a common `022` umask, the directory may be created as `0755` and the file as `0644`, making the token readable by other local users. The loader accepts the file without checking ownership, regular-file status, symlink behavior, or permissions. The authenticated network request itself is necessary for the optional posting feature and is sent to a fixed, documented HTTPS endpoint. No automatic transmission of RAG records was identified. ### Attack Path 1. A user follows the documented credential-file setup under a permissive umask. 2. The token file is created with group- or world-readable permissions. 3. Another local user or compromised local process reads the file. 4. The attacker submits authenticated requests to Moltbook using the stolen bearer token. 5. The attacker can create posts under the victim's Moltbook identity within the token's authorization scope. ### Impact Assessment The exposed credential can permit unau ...[truncated 228 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rag-auto-update.sh:55

Finding

Environment-derived paths are interpolated into executable Python source

Content

View full analysis

/dev/null || echo "0") ``` ```bash python3 << EOF import json state = { "lastSessionIndex": $LATEST_SESSION, "lastWorkspaceIndex": $(date +%s), "lastSkillsIndex": $(date +%s), "updatedAt": "$TIMESTAMP", "totalDocuments": $DOC_COUNT, "sessionCount": $SESSION_COUNT } with open('$STATE_FILE', 'w') as f: json.dump(state, f, indent=2) EOF ``` The affected path is derived from environment-controlled values: ```bash HOME="${HOME:-$(cd ~ && pwd)}" OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}" WORKSPACE_DIR="${OPENCLAW_DIR}/workspace" STATE_FILE="$WORKSPACE_DIR/memory/rag-auto-state.json" ``` ### Technical Analysis `STATE_FILE` is inserted directly into Python source enclosed by single quotes. Because `OPENCLAW_DIR` can be supplied through the environment, an attacker able to control the update script's environment can include a quote, newline, or Python expression in the path and thereby alter the generated program. Shell quoting does not make this safe because the dangerous transition occurs when the expanded value is embedded into Python syntax. The unquoted heredoc also performs shell expansion before Python receives the program. ### Attack Path 1. An attacker gains control over the environment used to launch `rag-auto-update.sh`, such as through a compromised scheduler configuration, wrapper, or automation system. 2. The attacker sets `OPENCLAW_DIR` to a value containing Python syntax that terminates the quoted path and appends an expression. 3. The shell expands `STATE_FILE` into the `python3 -c` command or heredoc. 4. Python parses the injected expression as ...[truncated 446 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (47)

Intent-Code Divergence

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation explicitly says there are no custom network calls or external uploads, but later documents Moltbook API posting. This is a severe trust-boundary violation because it can cause users to ingest sensitive transcripts and workspace data believing the system is strictly local, when the same skill bundle also supports external transmission.

Content

No source excerpt is available for this finding.

Tainted flow: 'headers' from os.environ.get (line 47, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/moltbook_post.py (reported line 62)May include surrounding context.

python

data["url"] = url

    try:
        response = requests.post(
            f"{API_BASE}/posts",
            headers=headers,
            json=data,

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is described as a local-only RAG system, yet the same documentation includes a Moltbook posting feature that uses credentials and sends content to an external service. That discrepancy materially changes the trust boundary: users may expose local content externally under a false assumption that the skill never transmits data off-host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is described as a local-only RAG system, yet the same documentation includes a Moltbook posting feature that uses credentials and sends content to an external service. That discrepancy materially changes the trust boundary: users may expose local content externally under a false assumption that the skill never transmits data off-host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is described as a local-only RAG system, yet the same documentation includes a Moltbook posting feature that uses credentials and sends content to an external service. That discrepancy materially changes the trust boundary: users may expose local content externally under a false assumption that the skill never transmits data off-host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is described as a local-only RAG system, yet the same documentation includes a Moltbook posting feature that uses credentials and sends content to an external service. That discrepancy materially changes the trust boundary: users may expose local content externally under a false assumption that the skill never transmits data off-host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a local-only RAG system, yet the same documentation includes a Moltbook posting feature that uses credentials and sends content to an external service. That discrepancy materially changes the trust boundary: users may expose local content externally under a false assumption that the skill never transmits data off-host.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

- Indexes all `SKILL.md` files

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Expanding a RAG skill into an unrelated social-posting capability introduces scope creep and a new exfiltration path for data from a skill that primarily processes sensitive local sessions and workspace files. The unrelated feature weakens least-privilege expectations and makes security review harder because users may not expect publication tooling inside a local knowledge system.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documentation instructs users to store an API key in a plaintext credentials file under the home directory. Plaintext long-lived secrets increase the risk of credential theft through local compromise, accidental indexing by the same RAG system, backups, or unintended file exposure.

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

Or create credentials file:

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << EOF
{
  "api_key": "moltbook_sk_YOUR_KEY_HERE"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 299)May include surrounding context.

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << EOF
{
  "api_key": "moltbook_sk_YOUR_KEY_HERE"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/MOLTBOOK_POST.md (reported line 25)May include surrounding context.

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << EOF
{
  "api_key": "moltbook_sk_YOUR_KEY_HERE"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/MOLTBOOK_POST.md (reported line 78)May include surrounding context.

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << EOF
{
  "api_key": "moltbook_sk_YOUR_KEY_HERE"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/MOLTBOOK_POST.md (reported line 92)May include surrounding context.

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << EOF
{
  "api_key": "moltbook_sk_YOUR_KEY_HERE"
}

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements an external social-posting capability even though the skill is described as a local RAG/indexing system. That mismatch is dangerous because users may install or trust the skill expecting only local retrieval while the package also contains code that can publish data to a remote service, expanding the attack surface and creating a risk of covert data disclosure.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The code accesses a credentials file under the user's home directory to obtain an API key. Credential access is sensitive in general, and in this case it is more concerning because it appears in a skill marketed as local/no-API-key, creating an undisclosed trust boundary and enabling authenticated remote actions if the tool is used.

Content

Scanner excerpt · scripts/moltbook_post.py (reported line 18)May include surrounding context.

python

# Configuration
API_BASE = "https://www.moltbook.com/api/v1"
CONFIG_PATH = os.path.expanduser("~/.config/moltbook/credentials.json")


def load_api_key():

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code adds unjustified outbound publishing functionality unrelated to semantic search or local indexing. In the context of a skill advertised as local and API-key-free, this is especially risky because it normalizes unexpected network transmission and could be repurposed to send sensitive workspace or session-derived content to an external endpoint.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/rag-auto-update.sh (reported line 92)May include surrounding context.

sh

exit 1
fi

# Update skills
log "Re-indexing skills..."
cd "$RAG_DIR"
python3 ingest_docs.py skills >> "$LOG_FILE" 2>&1

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Lines L024-L029 claim the system is 'fully local' and that all operations run offline with no external dependencies besides the initial download. Later sections document Moltbook posting via API keys and a published external repository URL, which are networked capabilities beyond a purely local/offline system. Even though posting is described as optional, the README's broad claim about the system's operations is materially overstated relative to the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README encourages indexing chat sessions, workspace files, and skills without warning that these sources may contain secrets, tokens, proprietary code, or personal data that will be persisted in the local vector store. Users may unknowingly centralize sensitive material into a searchable database, increasing the blast radius of local compromise or accidental reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Describing automatic knowledge-base consultation as transparent behavior without warning means users may not realize prior chats, code, and documentation can be surfaced into future responses. This creates a confidentiality risk because sensitive historical content may be reintroduced into unrelated prompts or shared outputs without deliberate user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic daily re-indexing of chats and workspace files, plus logging, is a genuine privacy and security concern when users are not clearly warned that scanning happens on a schedule. Scheduled ingestion can capture newly added secrets or sensitive documents and preserve them in logs/state files, increasing persistence and discoverability of sensitive data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README introduces community-posting functionality inside a skill whose stated purpose is local knowledge indexing and search. Mixing data-ingestion tooling with publishing capability increases the chance that indexed internal content, decisions, or excerpts could be intentionally or accidentally pushed to a public service, expanding the exposure surface beyond what users expect from a local RAG system.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 297)May include surrounding context.

md

# Set environment variable
export MOLTBOOK_API_KEY="your-key-here"

# Or create credentials file
mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << EOF
{

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises and documents capabilities that read local files, write persistent data, access environment-based credentials, and perform network operations, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, undocumented capability surface increases the risk of overbroad execution and makes it harder for operators to evaluate whether sensitive local data or credentials may be accessed.

Content

No source excerpt is available for this finding.