Skills/ClawHub/meili-memory

meili-memory@3.0.0

BLOCKED· install only

Publisher claims: "Local full-text search for OpenClaw memory recall using MeiliSearch. Self-hosted." Observed in sandbox: sends data to install.meilisearch.com.

Registry ClawHubPublisher enjuguna · publishing for 154 daysInstalls 631Last detonated 26 h ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-13 and scored it 46/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Pipe-to-shell pattern. Summary: sends data to install.meilisearch.com.

Behavior trace

Honeypot run · 0 s · 2 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1snetworkCONNECT tcp://install.meilisearch.com:443 · not in the allow-list, refused
0.1sprocessexec /usr/bin/curl
0.1sprocessexited 127: ./install.sh: line 10: sudo: command not found
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
0.2snetworkCONNECT tcp://install.meilisearch.com:443 · not in the allow-list, refused
0.2sprocessexec /usr/bin/curl
0.2sprocessexited 127: ./install.sh: line 10: sudo: command not found

Static findings

HIGH
Access to sensitive file pathsSKILL.md:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **Credentials**: MeiliSearch master key is loaded from `~/.openclaw/workspace/.env` — never hardcoded in scriptsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSee `.env.example` for all options.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patterninstall.sh:9 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -L https://install.meilisearch.com | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Instructs the agent to modify its persistent memory or instruction filesSKILL.md:22 · Instructs the agent to modify its persistent memory or instruction files- **Write**: MeiliSearch indexes (`core`, `working`, `archive`), `MEMORY.md` (distillation only with `--apply`)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Instructs the agent to modify its persistent memory or instruction filesSKILL.md:80 · Instructs the agent to modify its persistent memory or instruction filesbash scripts/distill.sh --apply # Actually write to MEMORY.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsSKILL.md:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesRequires `~/.openclaw/workspace/.env`:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:9 · Remote installer piped to shellcurl -L https://install.meilisearch.com | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandSKILL.md:17 · File permission modification command — agent changes file ownership/permissions- **Secure temp files**: All temporary files use `mktemp` with `chmod 600` and are cleaned up on exitFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandinstall.sh:39 · Privileged sudo command — agent may execute with elevated privilegessudo cp /tmp/meilisearch.service /etc/systemd/system/meilisearch.serviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/distill.sh:6 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file# Default is dry-run. Use --apply to actually write to MEMORY.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedscripts/indexer.sh:337 · Python subprocess execution detectedsubprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathslib/config.sh:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="${WORKSPACE}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandinstall.sh:41 · Privileged sudo command — agent may execute with elevated privilegessudo systemctl enable meilisearchFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/indexer.sh:41 · File permission modification command — agent changes file ownership/permissionschmod 600 "$f"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:17 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file- **Write**: MeiliSearch indexes (`core`, `working`, `archive`), `MEMORY.md` (distillation only with `--apply`)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:51 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filebash scripts/distill.sh --apply # Write to MEMORY.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedscripts/distill.sh:193 · Python subprocess execution detectedsubprocess.run(["bash", f"{skill_dir}/scripts/indexer.sh"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/search.sh:27 · File permission modification command — agent changes file ownership/permissionschmod 600 "$f"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandinstall.sh:40 · Privileged sudo command — agent may execute with elevated privilegessudo systemctl daemon-reloadFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/search.sh:123 · Python subprocess execution detectedresult = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/search.sh:156 · Python subprocess execution detectedresult = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/indexer.sh:301 · File permission modification command — agent changes file ownership/permissionschmod 600 "$DOC_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesskill-card.md:54 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file**Other Properties Related to Output:** [Can update MeiliSearch indexes and append distilled facts to MEMORY.md when explicitly applied.]Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Privileged sudo commandinstall.sh:20 · Privileged sudo command — agent may execute with elevated privilegessudo mkdir -p /var/lib/meilisearchFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandinstall.sh:10 · Privileged sudo command — agent may execute with elevated privilegessudo mv ./meilisearch /usr/local/bin/Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathslib/config.sh:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load .env if it existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/distill.sh:200 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileprint("\nRun with --apply to write these to MEMORY.md")Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/distill.sh:2 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file# Memory distillation: extract key facts from daily notes and append to MEMORY.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandinstall.sh:57 · File permission modification command — agent changes file ownership/permissionschmod +x "${SKILL_DIR}/scripts/"*.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈856 tok
1 file · 8 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

34 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim enjuguna: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim enjugunaPropose a patch to the maintainer