Huo15 Openclaw Openai Knowledge Base

• Outcome: Review
• Latest audit: May 28, 2026, 2:37 AM
• Version:
  2.8.0

Overview

This appears to be a real knowledge-base skill, but it needs review because it can send local knowledge-base content to an external LLM and includes helpers that can persistently rewrite agent/workspace files.

Install only after reviewing the scripts. Use agent scope for private material, verify the configured LLM provider before compiling documents, and avoid running bootstrap-from-questionnaire.sh or install-all-agents.sh unless you specifically want those broader persistent workspace/all-agent changes. Do not compile untrusted documents until filename path containment is fixed in kb-llm.py.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Overly broad trigger phrases like general 'query' or 'ask' terms can cause accidental invocation during ordinary conversation. In a skill with file, network, and shared-scope write behaviors, misfires are more dangerous because they may ingest content, query private data sources, or modify persistent knowledge stores when the user did not intend to activate the skill.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes ambiguous standalone terms such as 'broken link', 'stub', 'knowledge graph', and 'database view', which are likely to appear in normal discussion unrelated to this skill. Because the skill can touch local vaults, shared KB state, and network-backed ingestion, accidental activation meaningfully increases the chance of unintended reads/writes and privacy-impacting operations.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script unconditionally overwrites several well-known workspace files using shell redirection. In an agent/workspace context, these files can contain security-relevant instructions, identity settings, and user-specific data, so silent replacement can destroy safeguards or replace trusted prompts/configuration with questionnaire-derived content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script reads a local prompt file and transmits its full contents to a remote LLM endpoint, but it does not provide any explicit user warning, consent step, redaction, or sensitivity check before network transmission. In a knowledge-base compiler, prompts may embed local documents, notes, URLs, or other sensitive material, so silent exfiltration to a third-party model provider creates a real confidentiality risk.

VirusTotal

VirusTotal findings are pending for this skill version.