Security audit

memory_baidu_embedding_db

Security checks for vulnerabilities and agentic risk

Overview

The skill provides semantic memory storage, but it understates privacy impact and includes broad persistent/root-level maintenance behavior that users should review before installing.

Install only after reviewing the privacy boundary and operational scripts. Do not store sensitive personal, business, health, financial, or secret data unless you accept that memory text and search queries may be sent to Baidu. Prefer a pinned packaged embedding client, an explicit local-only mode, unprivileged install paths, dry-run/confirmed maintenance operations, and validated backup/restore before production use.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

other

Error

Location: memory_baidu_embedding_db.py:19
Finding: Undisclosed External Disclosure of Memory Content and Search Queries
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: memory_baidu_embedding_db.py:19
Finding: Execution of an Unpinned and Unaudited Python Module from a Mutable Root Path
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: memory_maintenance.sh:12
Finding: Overbroad Cleanup Recursively Deletes Unrelated Files Under /root/clawd
Content: View full analysis
/dev/null || true find /root/clawd -name "*.temp" -type f -delete 2>/dev/null || true echo "✅ 临时文件清理完成" ;; ``` ### Technical Analysis The cleanup action is not limited to this Skill's database or an application-owned temporary directory. It recursively traverses the entire `/root/clawd` hierarchy and deletes every regular file whose name ends in `.tmp` or `.temp`. Those files may belong to unrelated Skills, active transactions, editors, databases, package operations, or other system components. The script provides no preview, age check, ownership check, exclusion list, or confirmation. Redirecting errors to `/dev/null` and appending `|| true` also conceals partial failures and prevents callers from detecting an incomplete or damaging cleanup. ### Attack Path 1. Another component creates a required state, lock, recovery, or transaction file ending in `.tmp` or `.temp` anywhere under `/root/clawd`. 2. A user follows the documentation and runs `memory_maintenance.sh cleanup`. 3. Both `find` commands recursively traverse the whole Clawdbot tree. 4. Matching files are deleted regardless of which component owns them. 5. The affected component loses state, fails an active operation, or becomes corrupted. An attacker who can influence filenames under `/root/clawd` may also use this predictable cleanup behavior to induce deletion of application state at a chosen time. ### Impact Assessment The operation can cause cross-Skill data loss and denial of service. It may disrupt active database operations, remove recovery data, destroy temporary build artifacts, or corrupt unrelated workflows. The script acts across the complete `/root/clawd` namespace rather ...[truncated 128 chars]
Remediation: View remediation
/dev/null || true`. 9. Add tests proving that cleanup cannot affect files outside the Skill-owned directory. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: memory_health_check.sh:50
Finding: Health Check Silently Grants Execute Permission to Root-Level Scripts and Hooks
Content: View full analysis
/dev/null if [ $? -eq 0 ]; then echo " 📝 权限已修复" PASS_COUNT=$((PASS_COUNT + 1)) fi fi done ``` ### Technical Analysis A health-check operation is expected to inspect state, but this script changes filesystem permissions on scripts and a hook outside the Skill package. It does not verify that each target is a regular file, that it has trusted ownership, that it is not a symlink, or that its contents match an approved integrity value. Granting execute permission can convert previously inert or deliberately disabled content into executable code. The effect is particularly risky for `hook_memory_bootstrap.sh`, which may be invoked automatically by another component. ### Attack Path 1. An attacker replaces one of the listed paths or redirects it through a symlink. 2. The target initially lacks execute permission and may therefore remain dormant. 3. An administrator runs the health-check script. 4. The script invokes `chmod +x` without validating ownership, file type, canonical path, or integrity. 5. A later bootstrap or hook event executes the now-enabled attacker-controlled file. ### Impact Assessment This issue can facilitate execution of attacker-controlled scripts with the privileges of the Clawdbot process. In the hardcoded `/root/clawd` deployment model, that may incl ...[truncated 248 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: integrate.sh:20
Finding: Integration Creates Persistent Skill Activation and Unintentionally Executes the Demo
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: package.json:6
Finding: Declared Test Commands Modify Production Memory and Invoke External Processing
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: memory_maintenance.sh:35
Finding: Unvalidated Restore Source Can Poison Persistent Agent Memory
Content: View full analysis
" exit 1 fi BACKUP_PATH="$2" if [ -d "$BACKUP_PATH" ]; then if [ -d "$BACKUP_PATH/memory" ]; then cp -r "$BACKUP_PATH/memory" /root/clawd/ echo "✅ 记忆数据恢复完成" fi if [ -f "$BACKUP_PATH/MEMORY.md" ]; then cp "$BACKUP_PATH/MEMORY.md" /root/clawd/ echo "✅ 配置文件恢复完成" fi echo "✅ 从 $BACKUP_PATH 恢复完成" else echo "❌ 备份目录不存在: $BACKUP_PATH" fi ;; ``` ### Technical Analysis The restore operation accepts any caller-supplied directory and copies its `memory` subdirectory and `MEMORY.md` file into persistent Agent state. It does not verify that the source was created by this Skill, lies beneath the expected backup directory, has trusted ownership, contains a valid manifest, or matches authenticated hashes. It also does not inspect symlinks or preview which files will be overwritten. If `MEMORY.md` or restored memory files are later interpreted as Agent context, an attacker-controlled backup can introduce false facts, behavioral directives, or instruction-like content that persists across future sessions. ### Attack Path 1. An attacker prepares a directory containing a crafted `MEMORY.md` and/or `memory` directory. 2. The attacker persuades an administrator or automated process to run: `memory_maintenance.sh restore `. 3. The script checks only that the supplied path exists. 4. It copies the crafted content into `/root/clawd`. 5. Future Agent sessions load or search the poisoned persistent memory. 6. The attacker-supplied content influences later outputs or decisions. ...[truncated 426 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (67)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README claims 'Zero Data Leakage' and implies all processing is local, but the documented design relies on Baidu's external Embedding-V1 API. That means memory content or queries must leave the local system for embedding generation, creating a material privacy and trust mismatch that could cause operators to expose sensitive conversation data under false assumptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README omits a clear privacy warning that user content is sent to Baidu's embedding API, while simultaneously asserting 'Zero Data Leakage' and 'No External Sharing.' This omission undermines informed consent, increases the chance of accidental disclosure of personal or confidential data, and is especially risky in a memory component that stores and processes conversation history.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The 'Security Features' section states 'Memories never leave your system' despite earlier documentation requiring Baidu API calls. This misleading security claim can cause users to deploy the skill for sensitive workloads without realizing conversation-derived data is shared with a third-party provider.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SECURITY_CONFIG.md (reported line 24)May include surrounding context.
e.baidu.com/qianfan/) 2. 注册账户并登录 3. 导航到控制台获取API Key和Secret Key 4. 确保您有访问Embedding-V1模型的权限

2. 配置环境变量

使用以下命令设置环境变量：

bash
# 临时设置（当前会话有效） export BAIDU_API_STRING='${BAIDU_API_STRING}' export BAIDU_SECRET_KEY='${BAIDU_SECRET_KEY}' # 永久设置（添加到shell配置文件） echo 'export BAIDU_API_STRING="${BAIDU_API_STRING}"' >> ~/.bashrc echo 'export BAIDU_SECRET_KEY="${BAIDU_SECRET_KEY}"' >> ~/.bashrc source ~/.bashrc

3. 验证配置

启动应用前，请验证环境变量是否正确设置：

bash
# 检查环境变量 echo $BAIDU_API_STRING echo $BAIDU_SECRET_KEY

安全最佳实践

环境变量管理

不要在代码中硬编码API密钥

使用环境变量或安全的密钥管理系统

定期轮换API密钥

不要在日志中输出敏感信息

权限控制

确保配置文件只有授权用户可读

使用最小权限�

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · TUTORIAL.md (reported line 56)May include surrounding context.
e.baidu.com/qianfan/) 2. 注册账户并登录 3. 导航到控制台获取API Key和Secret Key 4. 确保您有访问Embedding-V1模型的权限

2. 配置环境变量

使用以下命令设置环境变量：

bash
# 临时设置（当前会话有效） export BAIDU_API_STRING='${BAIDU_API_STRING}' export BAIDU_SECRET_KEY='${BAIDU_SECRET_KEY}' # 永久设置（添加到shell配置文件） echo 'export BAIDU_API_STRING="${BAIDU_API_STRING}"' >> ~/.bashrc echo 'export BAIDU_SECRET_KEY="${BAIDU_SECRET_KEY}"' >> ~/.bashrc source ~/.bashrc

3. 验证配置

启动应用前，请验证环境变量是否正确设置：

bash
# 检查环境变量 echo $BAIDU_API_STRING echo $BAIDU_SECRET_KEY

安全最佳实践

环境变量管理

不要在代码中硬编码API密钥

使用环境变量或安全的密钥管理系统

定期轮换API密钥

不要在日志中输出敏感信息

权限控制

确保配置文件只有授权用户可读

使用最小权限�

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The 'Zero Data Leakage' feature claim is incompatible with the documented requirement for internet access and Baidu API credentials. This misrepresentation can cause operators to use the skill for confidential memory storage without realizing sensitive content may be disclosed to an external provider.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill omits a clear disclosure that memory contents are sent to Baidu's embedding API, despite making privacy-preserving claims. In a memory skill, the context increases risk because stored data is likely to include personal preferences, conversation history, and other sensitive material that users would reasonably expect to remain local.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation claims that 'memories never leave your system' while the skill explicitly depends on Baidu's remote embedding API. This is a dangerous contradiction because users may store sensitive conversation history or personal data under the false assumption that it remains local, when in reality memory contents or queries may be transmitted to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The API reference documents storing arbitrary user memories and relies on Baidu-hosted embeddings, which implies user content may be transmitted to an external provider. Because the documentation does not clearly warn about third-party processing, consent requirements, retention, or sensitive-data restrictions, integrators may unknowingly send personal or confidential data off-device, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The sample memories include personal profile and behavioral data such as job background, preferences, and daily habits, normalizing storage of user profiling data without any privacy notice or consent guidance. In this skill context, the examples are especially risky because developers often copy sample code directly, which can lead to unnecessary collection and external transmission of personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language policy violations include forcing a specific language without user opt-in. This file presents all instructions in Chinese and does not indicate that the skill is region-specific or provide an option for another language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide documents external API usage and destructive memory operations, but it does not give user-facing warnings about privacy implications, third-party data transfer, retention, or the effects of deletion. In a memory system, users are likely to store sensitive personal or operational data, so missing warnings can lead to unintended disclosure to external services or accidental data loss.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document makes a strong security claim that all data is stored locally and that there is no external data leakage risk, but the same guide explicitly requires Baidu API credentials and describes use of Baidu embedding services. This creates a misleading trust boundary: users may input sensitive memory content assuming it never leaves the host, when queries or content may be transmitted to an external provider for embedding or related processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide encourages storing user preferences and conversation context, which can easily include personal or sensitive data, but provides no privacy, consent, retention, or minimization guidance. In a memory/persistence skill, this omission increases the likelihood that developers will collect and retain user data insecurely or beyond what is necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The startup instructions require external Baidu API configuration but do not warn that memory content, prompts, or embeddings may be sent to a third-party service. Because this is a memory system likely to process sensitive user data, omission of a privacy notice materially increases the chance of unintended disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The maintenance section documents commands such as cleanup, backup, optimize, and refresh without any warning about side effects, required permissions, or data-loss potential. In operational use, users may run destructive commands on trust, causing accidental deletion, overwrite, or service disruption.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 64)May include surrounding context.
md
### 1. Get Baidu Qianfan API Credentials 1. Sign up at [Baidu Qianfan Console](https://console.bce.baidu.com/qianfan/) 2. Create an API Key and Secret Key 3. Ensure you have access to the Embedding-V1 model ### 2. Set Environment Variables

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README presents a user-facing error message entirely in Chinese, while the rest of the document is in English and there is no indication that the skill is intentionally China-only or that users can choose their language. This is a natural-language locale policy issue because it imposes a specific language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document provides a privileged command that disables an installed extension by renaming a directory under /root using sudo, but it does so without any warning about operational risk, rollback, verification, or change-control review. In a skill context, users may copy-paste this directly, causing service disruption or disabling a legitimate component without understanding the consequences.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill includes a sudo command operating on a root-owned path, which normalizes privileged execution and can directly alter production components. Even if intended for administration, embedding such a command in a skill increases the chance of unsafe execution by users or automation without adequate validation or safeguards.
Content: Scanner excerpt · SECURITY_BLACKLIST_POLICY.md (reported line 31)May include surrounding context.
1. 立即禁用（临时）

bash
# 重命名扩展目录以立即禁用 sudo mv /root/.nvm/versions/node/v22.22.0/lib/node_modules/clawdbot/extensions/memory-lancedb \ /root/.nvm/versions/node/v22.22.0/lib/node_modules/clawdbot/extensions/memory-lancedb.BLOCKED

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell users to export API credentials directly in the shell without any guidance on secret handling, storage, shell history exposure, least-privilege use, or rotation. In an agent skill or shared admin environment, this can lead to credential leakage through logs, history files, process inspection, or accidental reuse in insecure contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide tells users to print API credentials with echo for verification, which exposes secrets on screen and may leak them through terminal logging, screen recording, shared sessions, or support transcripts. Even if not stored in shell history directly, displaying raw secrets is an avoidable credential exposure risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document states that no data is uploaded to external services, yet the same guide requires Baidu API credentials for embedding operations. That is a security-relevant contradiction because users may make trust decisions based on a false assumption about data flow and could unintentionally send sensitive content to a third-party provider.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The tutorial repeatedly demonstrates storing and retrieving user preferences, location, habits, job information, and other personal data, and it sends memory content to an external embedding provider, but it does not provide a meaningful privacy notice, consent guidance, data minimization advice, or retention/deletion policy. In a memory skill, this omission materially increases the risk of collecting sensitive personal data without users understanding that it may be persisted locally and processed by a third-party API.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · TUTORIAL.md (reported line 41)May include surrounding context.
md
### Step 1: Get Baidu API Credentials 1. Go to the [Baidu Qianfan Console](https://console.bce.baidu.com/qianfan/) 2. Create an account or sign in 3. Navigate to the API management section 4. Create an API Key and Secret Key 5. Ensure you have access to the Embedding-V1 model

Static analysis

No suspicious patterns detected.

Overview

A.I.G

other

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T02 · Agent Memory Poisoning

SkillSpector

Intent-Code Divergence

Missing User Warnings

Intent-Code Divergence

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

2. 配置环境变量

3. 验证配置

安全最佳实践

环境变量管理

权限控制

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

2. 配置环境变量

3. 验证配置

安全最佳实践

环境变量管理

权限控制

Intent-Code Divergence

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Session Persistence

Natural-Language Policy Violations

Missing User Warnings

Sudo/Root Execution

1. 立即禁用（临时）

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Session Persistence

Static analysis