Is ontology safe?
https://clawhub.ai/oswalpalash/ontology
The ontology skill is a legitimate typed knowledge graph system for structured agent memory. It demonstrates good security practices including path traversal protection, credential indirection, and use of safe JSON/YAML parsing. The primary concerns are PII accumulation in plaintext logs and the cross-skill data sharing attack surface that could be exploited by a malicious companion skill.
Category Scores
Findings (8)
MEDIUM PII stored in plaintext append-only log -15 ▶
The ontology stores Person entities with name, email, and phone fields in an unencrypted JSONL file. The append-only design means deleted data persists in the log. No access control or encryption is applied.
MEDIUM Python script with YAML dependency -10 ▶
ontology.py imports yaml (PyYAML) for schema operations. While yaml.safe_load is used correctly, the dependency on an external Python package introduces supply chain risk if the environment has a compromised yaml module.
LOW JSON input parsing via CLI arguments -5 ▶
The script accepts JSON strings via --props and --where CLI arguments. While json.loads is used safely (not eval), malformed JSON could cause unhandled exceptions. The script does not sanitize property values beyond type checking.
LOW Cross-skill data sharing attack surface -10 ▶
The skill explicitly positions itself as shared state between skills ('Skills that use ontology should declare' + 'Cross-Skill Communication' section). A malicious companion skill could read all stored entities including personal data.
LOW Broad trigger phrase matching -5 ▶
The skill activates on common phrases like 'remember', 'what do I know about', and 'show dependencies' which could cause unintended skill activation in normal conversation.
INFO Path traversal protection implemented 0 ▶
The resolve_safe_path function properly validates that all file paths stay within the workspace root directory, preventing directory traversal attacks via --graph or --schema arguments.
INFO Credential indirection enforced 0 ▶
The Credential type uses forbidden_properties to prevent direct storage of secrets, requiring indirection via secret_ref. This is a positive security pattern.
INFO Sensitive file access from runtime, not skill 0 ▶
Monitoring shows .env, .aws/credentials, and .profile access but these originate from the OpenClaw agent runtime bootstrap, not from the skill code itself.