Memora Kb

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

This looks like a real personal knowledge-base skill, but it asks users to run unpinned remote installer code and can send private documents to a configurable API endpoint without strong safeguards.

Review this before installing. Prefer the ClawHub package path or a pinned, reviewed Memora commit; do not run the manual ./install.sh from an unpinned GitHub branch unless you have inspected it. Keep KB_API_BASE pointed at localhost or a trusted HTTPS server, assume uploaded documents and questions are sent to that backend, and avoid pasting or printing full API keys from .env. If using DeepSeek, DashScope, rerank, or other cloud providers, treat document text and prompts as potentially leaving your machine depending on backend configuration.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:135

Finding

Unpinned Remote Installer Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:135-138
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

bash

# Clone repository
git clone https://github.com/zzlzzlzzl15/Memora.git
cd Memora/personal_knowledge_base

# Run installation script
./install.sh

Technical Analysis

The documented installation process clones the current default branch of a remote Git repository and immediately executes its install.sh script. The instructions do not pin the repository to a reviewed commit hash or signed release, nor do they require checksum or signature verification.

The remotely hosted installer is not included in the audited project. Consequently, its behavior can change after this skill has been reviewed. This creates a time-of-check/time-of-use supply-chain risk: the commands may retrieve and execute code materially different from the code that existed during the audit.

Attack Path

1. An attacker compromises the upstream GitHub account, repository, maintainer credentials, or repository publishing workflow.
2. The attacker modifies install.sh or another component invoked by that script on the default branch.
3. A user follows the installation commands in SKILL.md.
4. git clone retrieves the attacker-controlled revision because no immutable revision is specified.
5. The user executes ./install.sh, allowing the modified payload to run locally.
6. The payload operates with the privileges of the user running the installation and may modify any resources accessible to that account.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. Depending on those privileges, the attacker could read or modify user files, steal configured API keys, alter application configuration, install additional software, or compromise knowledge-base data.

If the installation is run with elevated privileges, ...[truncated 198 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository checkout to an immutable, reviewed commit hash:

   bash

   git clone https://github.com/zzlzzlzzl15/Memora.git
   cd Memora
   git checkout --detach <reviewed-commit-hash>
   

2. Prefer a cryptographically signed release and verify the release signature before executing any installer.
3. Publish and verify SHA-256 checksums for downloaded release artifacts.
4. Include the installer in the auditable skill package when feasible, rather than retrieving executable logic at installation time.
5. Review the installer and every script or binary it invokes before execution.
6. Run installation with the least-privileged account possible and avoid sudo unless a specific operation requires it.
7. Add explicit documentation stating that remote code will be executed and identifying the exact reviewed revision.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kb_api.py:22

Finding

Sensitive Knowledge-Base Data Can Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/kb_api.py:22-37
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

python

API_BASE = os.getenv("KB_API_BASE", "http://127.0.0.1:8080")
API_PREFIX = f"{API_BASE}/api/v1"


def _post_json(url, payload, timeout=30):
    """发送 POST JSON 请求"""
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        url,
        data=data,
        headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

The same unrestricted base URL is also used to upload complete file contents:

python

req = urllib.request.Request(
    f"{API_PREFIX}/documents/upload",
    data=body,
    headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
    method="POST",
)
with urllib.request.urlopen(req, timeout=60) as resp:
    data = json.loads(resp.read().decode("utf-8"))

Technical Analysis

The client accepts KB_API_BASE without validating its scheme or destination. Although the default endpoint uses loopback, users can configure a remote endpoint using plaintext http://. The client does not reject or warn about such a configuration.

Search queries, newly created text documents, complete uploaded files, document details, search results, and AI-generated answers may therefore cross a network without transport encryption. Plaintext HTTP provides neither confidentiality nor integrity against an attacker capable of observing or modifying traffic.

The client also supplies no application-level authentication headers, so transport security becomes especially important when the server is accessible beyond a trusted local host.

Attack Path

1. A user configures KB_API_BASE with a non-loopback plaintext endpoint, such as `http://knowledge-base. ...[truncated 1193 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse KB_API_BASE with urllib.parse.urlparse before constructing requests.
2. Permit plaintext HTTP only for verified loopback destinations such as 127.0.0.1, localhost, or ::1.
3. Reject non-loopback http:// URLs with a clear error and require https:// for remote servers.
4. Use normal certificate and hostname verification and do not introduce an option that silently disables TLS validation.
5. Support an authentication mechanism, such as a bearer token loaded from a protected environment variable, when communicating with remote services.
6. Document that KB_API_BASE is a data-exfiltration boundary and must point only to a trusted server.
7. Consider an explicit opt-in override, accompanied by a prominent warning, if plaintext operation is required for an isolated development environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'req' from os.getenv (line 161, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kb_api.py (reported line 36)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tainted flow: 'req' from os.getenv (line 161, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kb_api.py (reported line 43)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tainted flow: 'req' from os.getenv (line 161, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kb_api.py (reported line 167)May include surrounding context.

python

headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=60) as resp:
        data = json.loads(resp.read().decode("utf-8"))

    return {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

cd Memora/personal_knowledge_base

# Configure environment variables
cp .env.example .env
# Edit .env with your API keys

# Start services

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

cd Memora/personal_knowledge_base

# Configure environment variables
cp .env.example .env
# Edit .env with your API keys

# Start services

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The troubleshooting command cat .env | grep API_KEY encourages printing secrets directly to the terminal, logs, scrollback, or shared support sessions. In practice this can leak API keys to other local users, shell history capture tools, recordings, or pasted diagnostics.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

Solution:

bash

# Check API key configuration
cat .env | grep API_KEY

# Test API connectivity
curl -H "Authorization: Bearer $DEEPSEEK_API_KEY" \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises capabilities that involve environment variables and network access, but it does not declare any explicit tool scope or permissions boundary. This creates ambiguity for reviewers and users, increasing the chance the skill is invoked with broader access than expected, especially given its external API and web-scraping features.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance is broad enough to match many generic knowledge-management or document-related requests, which can cause the skill to trigger in situations where the user did not intend web scraping, external retrieval, or LLM-backed processing. Overbroad routing is dangerous because it can expose user content to more powerful capabilities than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill describes web scraping and external LLM/API integrations without a clear disclosure that user prompts, documents, or retrieved text may be transmitted to remote services. In a knowledge-base product handling potentially sensitive personal documents, lack of data-flow transparency materially increases privacy and data-exfiltration risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation mentions permanent deletion of documents and vector data without clearly warning that the action is irreversible. This can lead to accidental destructive actions and permanent loss of user knowledge assets, especially in a personal knowledge-base context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

cat .env | grep API_KEY

Test API connectivity

curl -H "Authorization: Bearer $DEEPSEEK_API_KEY"
https://api.deepseek.com/v1/chat/completions
-d '{"model":"deepseek-chat","messages":[{"role":"user","content":"test"}]}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

Test API connectivity

curl -H "Authorization: Bearer $DEEPSEEK_API_KEY"
https://api.deepseek.com/v1/chat/completions
-d '{"model":"deepseek-chat","messages":[{"role":"user","content":"test"}]}'

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The upload_file function reads arbitrary local file contents and transmits them to whatever remote endpoint is configured in KB_API_BASE, but the script provides no explicit confirmation, destination display, or privacy warning at upload time. In this skill context, users may handle sensitive personal knowledge assets, so silent transfer to a misconfigured or attacker-controlled endpoint could expose confidential documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script's docstring, usage text, and runtime error/output messages are written in Chinese only, which imposes a language choice on users without opt-in. The file does not document that it is intentionally limited to a Chinese-speaking audience or provide a mechanism to select another locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.