Is masterworrall/solid-agent-storage safe?
https://github.com/openclaw/skills/tree/main/skills/masterworrall/solid-agent-storage
solid-agent-storage is a functionally legitimate Solid Protocol integration skill with no prompt injection, malware, or covert exfiltration. The primary concern is architectural: the skill defaults to storing all agent memory, notes, and conversation logs on crawlout.io, a server operated by the skill author (Interition), without end-to-end encryption. While this is documented, most users will not configure a self-hosted server, resulting in passive aggregation of sensitive agent state on author-controlled infrastructure. The compiled-only code distribution and undisclosed cross-skill dependency add minor auditability concerns.
Category Scores
Findings (9)
HIGH Default storage backend is author-controlled server -30 ▶
When SOLID_SERVER_URL is not configured, all agent data is stored on https://crawlout.io operated by Interition, the skill author. The skill explicitly encourages storing agent memory (notes, learned facts, preferences) and conversation logs in pod containers that reside on this server. The server administrator has technical capability to read all stored pod data regardless of WAC access controls. This is disclosed in SKILL.md but is easily missed, and the default path presents a persistent data aggregation risk for all non-self-hosting users.
MEDIUM Pre-compiled JavaScript distributed without source -20 ▶
The skill ships compiled JavaScript in dist/ rather than source TypeScript. Source maps are referenced in compiled files (sourceMappingURL comments) but the .js.map files are not included in the skill package. The reviewed code appears consistent with the documented functionality, but complete independent verification is not possible without source files. This is a gap in auditability rather than a confirmed threat.
MEDIUM Passive data aggregation at scale on author infrastructure -25 ▶
As a default-configured skill deployed across many OpenClaw users, crawlout.io becomes a centralized repository of agent memory from all non-self-hosting deployments. Even if Interition's current intentions are benign, this creates a high-value target for compromise, future policy changes, or business acquisition. Agents storing research findings, user preferences, and conversation context create a detailed behavioral profile per agent (and by extension, per user).
MEDIUM No end-to-end encryption of pod data at rest on Solid server -15 ▶
The INTERITION_PASSPHRASE env var and AES-256-GCM encryption protect credentials stored locally on the user's device. However, data written to the Solid pod (via curl PUT/PATCH) is stored unencrypted on the Solid server. The server-side protection is WAC access controls, which the server operator can bypass. Users storing sensitive information in their agent's pod have no technical guarantee of confidentiality from the server administrator.
LOW Undocumented cross-skill dependency on academic-research-hub -10 ▶
The .clawhub/lock.json file embedded in the skill package references academic-research-hub v0.1.0 as an installed skill. This suggests the skill was developed or tested alongside this dependency, but no mention of it appears in SKILL.md. The nature of this relationship is unclear — it may be a development artifact or indicate integration behavior not disclosed to users.
LOW Server password generated with low-entropy timestamp component -5 ▶
During provisioning, the CSS account password is generated as: agent-${name}-${Date.now()}. While combined with agent name this is reasonable for an auto-generated server password, it is predictable in structure if an attacker knows the agent name and approximate provisioning time. This password is stored encrypted locally and used only during deprovision, so exploitability is low.
INFO No prompt injection detected in SKILL.md 0 ▶
Full review of SKILL.md found no override instructions, hidden directives, persona manipulation, or attempts to suppress agent output. The skill documentation is accurate and transparent about its architecture.
INFO Strong local credential security 0 ▶
Local credential storage uses AES-256-GCM with PBKDF2 key derivation (100,000 iterations, SHA-256, random 32-byte salt per file, random 16-byte IV per encryption). File permissions set to 0600. This is a well-implemented local secrets store.
INFO Clean install — no exfiltration during clone 0 ▶
Network monitoring during install showed only expected GitHub traffic. No connections to crawlout.io or any Interition infrastructure occurred at install time. The skill correctly defers all server contact to explicit script invocation.