Security audit

triple-memory-baidu-embedding

Security checks for vulnerabilities and agentic risk

Overview

This memory skill has a coherent purpose, but it asks agents to silently persist user information and contains unsafe shell/Python handling that can execute attacker-controlled input.

Review this skill carefully before installing. Do not use it with sensitive or regulated conversations unless you first remove silent auto-capture, fix the Python injection and .env sourcing issues, pin dependencies, and make Baidu embedding use explicit opt-in with clear memory review and deletion controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/baidu-memory-tools.sh:38
Finding: Arbitrary Python Code Execution Through Unsafely Interpolated Memory Input
Content: View full analysis
80 else res['content'] print(f' {i}. 相似度: {similarity:.3f} - {content_preview}') else: print('未找到相关记忆') except Exception as e: print(f'搜索失败: {str(e)}') " ``` `scripts/triple-integration.sh:44-61`: ```bash python3 -c " import sys sys.path.append('$SKILL_DIR/skills/memory-baidu-embedding-db') from memory_baidu_embedding_db import MemoryBaiduEmbeddingDB try: db = MemoryBaiduEmbeddingDB() result = db.add_memory( content='$TEXT', tags=['$TAGS', 'semantic'], metadata={'importance': '$IMPORTANCE', 'source': 'triple-memory'} ) print(' ...[truncated 2422 chars]
Remediation: View remediation
&2; exit 1 ;; esac if [ "$LIMIT" -lt 1 ] || [ "$LIMIT" -gt 100 ]; then echo "Limit must be between 1 and 100" >&2 exit 1 fi ``` 6. Restrict importance to the documented values and validate tag length and character sets. 7. Add regression tests containing quotes, newlines, backslashes, command substitutions, and known Python-injection payloads. 8. Run the memory component under a dedicated, unprivileged account with narrowly scoped filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/baidu-memory-tools.sh:10
Finding: Workspace-Controlled .env File Is Executed as Shell Code
Content: View full analysis
/tmp/executed-by-memory-skill ``` The `WORKSPACE` variable can be supplied through the environment: ```bash WORKSPACE="${WORKSPACE:-$SKILL_DIR}" ``` This expands the attack surface beyond a single fixed directory. A malicious or compromised repository can provide its own `.env`, set or influence `WORKSPACE`, and trigger execution when the memory utility is used. Even the `status` operation loads the file before command dispatch. ### Attack Path 1. An attacker gains the ability to create or modify `.env` in the selected workspace, such as through a malicious repository or writable shared workspace. 2. The attacker places shell commands in that file. 3. The Agent invokes `baidu-memory-tools.sh` for storage, search, status, or help. 4. The script resolves `WORKSPACE` and calls `source "$WORKSPACE/.env"`. 5. The attacker's commands execute in the memory tool's shell before the requested operation is processed. ### Impact Assessment The attacker receives command execution with the privileges of the Agent process. The sourced file also runs in the current shell and can: - Read or overwrite workspace files and memories. - Access and change exported credentials. - Replace shell functions or alter `PATH`. - Manipulate ...[truncated 241 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:166
Finding: Skill Instructions Require Concealment of Persistent Memory Operations
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:69
Finding: Mutable Third-Party Skills Are Installed and Executed Without Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The privacy section directly contradicts earlier documentation of Baidu API calls by claiming memories never leave the system. Because this statement appears in the security/privacy section, it can strongly mislead operators into deploying the skill in regulated or sensitive environments where external transmission is prohibited.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill presents itself as a complete triple-memory solution, yet the finding indicates it mainly performs startup/API validation while also accessing an external service with credentials and without declared permissions. This can cause users to grant trust to a component that both sends data externally and lacks the advertised local verification and multi-backend safeguards.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as a complete triple-memory solution, yet the finding indicates it mainly performs startup/API validation while also accessing an external service with credentials and without declared permissions. This can cause users to grant trust to a component that both sends data externally and lacks the advertised local verification and multi-backend safeguards.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill presents itself as a complete triple-memory solution, yet the finding indicates it mainly performs startup/API validation while also accessing an external service with credentials and without declared permissions. This can cause users to grant trust to a component that both sends data externally and lacks the advertised local verification and multi-backend safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to perform memory operations silently, including retention and potentially deletion behavior, without notifying the user. Silent persistence of user information undermines informed consent, obscures data flows, and increases the risk of storing sensitive information across sessions and systems.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: This finding points to the same dangerous behavior as SDI-2: loading .env via source exposes the script to arbitrary code execution and can also expose secrets through attacker-controlled shell logic. In a credential-handling script, executing untrusted configuration is especially risky because it runs in the same context as secret material.
Content: Scanner excerpt · scripts/baidu-memory-tools.sh (reported line 11)May include surrounding context.
sh
WORKSPACE="${WORKSPACE:-$SKILL_DIR}" # Load Baidu API configuration if available if [ -f "$WORKSPACE/.env" ]; then source "$WORKSPACE/.env" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The vulnerability is not merely that a .env file exists, but that the script executes it, allowing command execution and potential secret theft or environment manipulation. Given the file's purpose of handling API credentials, this increases the chance of credential compromise if the workspace is writable by an attacker or shared across tools.
Content: Scanner excerpt · scripts/baidu-memory-tools.sh (reported line 12)May include surrounding context.
sh
# Load Baidu API configuration if available if [ -f "$WORKSPACE/.env" ]; then source "$WORKSPACE/.env" fi CMD="${1:-help}"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide instructs operators to store user information across Git notes, local files, and optionally Baidu Embedding, but it does not warn about persistence, retention, sensitivity classification, consent, or third-party data transfer. In a memory skill, this omission is security-relevant because users may persist sensitive personal or confidential data unintentionally, expanding exposure across multiple backends and potentially to an external API provider.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes automatic capture, recall, and embedding-backed memory handling of user conversations without a clear up-front warning that enabling Baidu credentials can cause conversation-derived content to be sent to an external API. This creates a privacy and consent issue because users may persist or transmit sensitive data automatically without realizing it.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 59)May include surrounding context.
md
### Hook Integration (Recommended) To integrate with Clawdbot's startup hook system, configure the memory-boot-loader hook to use the session initialization script: 1. The hook will automatically run `/root/clawd/session-init-triple-baidu.sh` on gateway startup 2. This initializes all three memory layers simultaneously 3. Ensures memory system is ready when the gateway starts

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README makes a materially misleading privacy claim by stating that memories never leave the system while the skill also documents Baidu API use for embeddings. Even if only embeddings or selected text are sent, user conversation content may still be transmitted to an external provider, so users could enable the feature under false assumptions about data locality.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents shell commands, environment-variable use, and external API interaction but does not declare any tool scope or permissions. This creates a transparency and policy-enforcement gap: an agent may execute shell or access secrets without users or the platform having an explicit authorization boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation claims 'full privacy protection' and 'local privacy' while stating that embeddings are processed by the Baidu API. This is a material privacy misrepresentation: users may disclose sensitive information believing data stays local when it is actually transmitted to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes use of Baidu API credentials and external embedding processing but does not pair this with a clear privacy/security warning at the point of use. Users may not understand that conversation content can be sent off-device to a third-party provider, increasing accidental exposure of confidential data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases for automatic capture are broad enough to match ordinary conversation such as casual preferences or factual statements. This can cause unintentional collection and long-term retention of user data, including sensitive personal or operational details, without meaningful user intent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions direct the agent to retain and use user-provided information across sessions without notifying the user. In the context of a memory skill, this is especially risky because the entire feature is centered on persistence, making undisclosed long-term profiling and accidental sensitive-data retention more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples instruct users to store and search memory content through Baidu Embedding, which implies transmitting potentially sensitive user, project, or decision data to an external service, but they do not clearly warn about that data flow or its privacy implications. In a memory skill whose purpose is persistent context retention, users are especially likely to submit confidential material, so omission of an explicit data-transmission warning meaningfully increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script executes source "$WORKSPACE/.env", which treats the .env file as shell code rather than parsing key-value pairs safely. If an attacker can modify .env or influence WORKSPACE, arbitrary commands will run with the script's privileges, which is broader and more dangerous than simple configuration loading.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Nearly all user-facing messages in the script are hard-coded in Chinese, with no option for the user to select another language and no justification that the tool is intentionally region-specific. This is a natural-language locale policy issue because the skill enforces a specific language without explicit opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The store operation transmits arbitrary text to an external embedding service without explicit privacy disclosure. Because this skill is designed to persist memory across sessions, users may store highly sensitive context, making undisclosed exfiltration to a third-party service more dangerous in this context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The search flow sends user-supplied query content to an external Baidu-backed embedding service without an explicit warning or consent step. In a memory tool, queries may contain sensitive personal, organizational, or proprietary information, so silent transmission creates a real privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends test content to the external Baidu embedding API as part of verification but does not clearly disclose that network transmission will occur. In a privacy-oriented memory skill, undisclosed outbound data flow is especially risky because users may assume local-only validation while credentials and content are being used against a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The verification flow writes a persistent test memory entry during a health check without warning the user or requesting confirmation. In a memory skill, even benign test content can pollute long-term storage, affect later retrieval behavior, and violate user expectations about when persistent state is modified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script prints that the memory system is 'safe to use' after running checks that include persistent writes and limited functional validation. Declaring safety based on incomplete tests can create dangerous operator overconfidence, especially because the script does not validate all security, privacy, or cleanup properties of the memory system.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script reports that file-system search is healthy after only checking whether /root/clawd/memory/ exists and is writable. This can mislead operators into trusting search functionality that was never actually exercised, causing false assurance about system readiness and potentially masking broken recall behavior in a security-sensitive memory workflow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.