Performs fast local semantic search on OpenClaw memory files using TF-IDF without external dependencies or APIs.

This skill will read all OpenClaw memory files under ~/.openclaw and write an index at ~/.openclaw/memory_index.json — that's expected for a local search tool. However: (1) the README claims TF‑IDF and 'no external dependencies', but the script uses embeddings and calls an external embedding provider (runs the 'ollama' CLI or posts to http://localhost:11434). (2) Before running, verify whether you have or will install 'ollama' and how that service is configured (it might forward data elsewhere). If you want a pure TF‑IDF implementation that never calls external binaries or services, review or modify the code to replace get_embedding with a local TF‑IDF calculator. If you proceed, avoid running it on machine memory containing highly sensitive data until you confirm the embedding provider is local and trustworthy.

Type: OpenClaw Skill Name: local-memory-search Version: 1.0.0 The skill is classified as suspicious due to a potential Remote Code Execution (RCE) vulnerability in `search.py`. The script uses `subprocess.run(['ollama', 'embed', EMBEDDING_MODEL, text])` to execute an external command, passing user-controlled input (`text` derived from file content or query) directly as an argument. While `subprocess.run` with a list is generally safer, it still presents a command injection risk if the `ollama` CLI tool itself has argument parsing vulnerabilities. There is no evidence of intentional malicious behavior like data exfiltration to external endpoints or backdoor installation; the network calls are limited to `localhost` for the Ollama service.