qdrant-db

• Outcome: Review
• Latest audit: Sep 3, 2026 · 3:43 PM UTC
• Version: 1.0.2

Overview

This Qdrant knowledge-base skill is mostly purpose-aligned, but it can bulk-copy local OpenClaw memory and delete persistent vector entries without built-in confirmation.

Review the configured Qdrant and embedding endpoints before installing, because searched or stored text may be sent there. Avoid running migrate-sqlite unless you intend to copy local OpenClaw memory into Qdrant, and verify collection names and point IDs before using delete.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 配置文件随 skill 走：<skill根>/.env（scripts/ 的上一级），shell 风格 KEY=VALUE
# 代码不内置默认值：配置统一从 真实环境变量 > .env 读取，模板见 env.example
ENV_FILE = Path(__file__).resolve().parent.parent / ".env"


def eprint(*args: Any) -> None:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents capabilities that involve reading environment variables, accessing local files, and making network requests to a Qdrant and embedding service, but it does not declare an explicit tool/permission scope. That weakens least-privilege controls and makes it harder for the host to constrain what the skill is allowed to access if the helper script is invoked in broader contexts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill exposes upsert, migrate, ensure, and delete operations against a shared knowledge base but does not warn about destructive or persistent side effects before those commands are used. In an agent setting, this can lead to accidental data corruption, unauthorized persistence of sensitive content, or deletion of points without adequate user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）
# 语法: shell 风格 KEY=VALUE

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# ============================================================
# qdrant-db 配置示例 —— 复制为 .env 后按实际环境填写
#   cp env.example .env && chmod 600 .env
#
# 读取优先级: 真实环境变量 > 本 .env（代码不内置默认值，缺必填项会报错）
# 语法: shell 风格 KEY=VALUE

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

# ---------- Embedding 服务 ----------
# OpenAI 兼容的 embeddings 接口地址(必填)
#   例: http://127.0.0.1:8000/v1 或 https://api.openai.com/v1
EMBEDDING_BASE_URL=http://127.0.0.1:8000/v1

# embeddings 接口的 API key(服务无需鉴权可留空)

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: embed_texts sends provided text content to an external embedding endpoint using an Authorization bearer token, but the CLI behavior does not enforce explicit user acknowledgement that content is leaving the local environment. This is dangerous because arbitrary file contents, manual text, or migrated memory data may be transmitted to third-party services, causing unintended data disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The delete command performs an irreversible point deletion immediately from the configured collection using a user-supplied ID, with no confirmation prompt, dry-run mode, or warning. In an agent skill context, this increases the chance of accidental or manipulated destructive actions that can remove knowledge-base entries without recovery safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The migrate-sqlite command reads a local SQLite database from a default path under the user's home directory and bulk-transfers its contents into Qdrant. That expands the skill's data-access scope beyond direct Qdrant operations and can exfiltrate or duplicate sensitive local memory data into another system, especially when Qdrant or embedding services are remote.

Static analysis

No suspicious patterns detected.