Store, search, and automatically manage a personal or shared knowledge base integrated with OpenClaw through before/after hooks.

What to check before installing: - Understand where the DB will live: the SKILL.md and scripts disagree on default paths. Inspect (and optionally set) KNOWLEDGE_DB and KNOWLEDGE_KB_MODE to ensure data is private and stored where you expect (set mode=private and a controlled DB path if unsure). - This skill auto-recalls before conversations and auto-captures after turns. If you do not want every conversation persisted, disable the hooks or raise the capture threshold (or avoid installing the generated hook scripts). - Review the scripts for unsafe interpolation: topic_key and other values are interpolated into sqlite3 commands without parameterization. Consider hardening (use parameterized sqlite3 access from Python or properly escape inputs) to avoid local SQL injection or DB corruption from crafted messages. - Shared KB mode allows multiple agents to read/write the same DB — enable only when you explicitly want cross-agent sharing and after you trust all participating agents. - Test in a sandbox: run the scripts on a throwaway agent and inspect the created DB and files. Verify sqlite3 on your system supports FTS5 (it is required). - If you plan to use this skill, consider adding explicit required config/env declarations and limit hook registration to manually enabled hooks so captures are explicit rather than automatic. Why 'suspicious' and not 'malicious': the code implements the advertised KB functionality and uses no unexpected network endpoints, but the undeclared config/env usage, automatic persistence across agents, and unsafe string interpolation are notable coherence and safety issues that should be fixed or accepted knowingly before use.

Type: OpenClaw Skill Name: kb-mini Version: 1.3.0 The skill provides a local knowledge base using SQLite, but it contains multiple critical SQL injection vulnerabilities across `storage.sh`, `retriever.sh`, and `lifecycle.sh` because user-controlled inputs (titles, content, and search queries) are directly interpolated into shell-executed SQL strings. Furthermore, `retriever.sh` includes logic to automatically 'capture' and store sensitive information such as API keys, tokens, and passwords into the local database. While these appear to be unintentional security flaws or risky features rather than intentional malware, the lack of input sanitization and the targeting of secrets make the bundle unsafe for production use.