ClawHub

Mema Brain

Security checks across malware telemetry and agentic risk

Overview

This is a memory-management skill with expected Redis and local metadata storage behavior, but users should configure it carefully because it can erase its own stored memory and may reference sensitive paths.

Install only if you want an agent memory layer and can point it at a Redis instance you control or trust. Do not ask it to index sensitive paths unless you intend those references to become part of memory, and treat `mental clear` as a full reset of the skill's Redis-backed state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The `mental clear` path deletes all keys matching the application prefix without any confirmation, dry-run, or scope summary. In a memory-management skill whose purpose is to preserve session context, accidental invocation can immediately destroy all ephemeral state for the user or agent workflow, causing integrity and availability loss.

Unpinned Dependencies

Low
Category
Supply Chain
Content
redis>=5.0.0
Confidence
94% confidence
Finding
redis>=5.0.0

Known Vulnerable Dependency: redis — 4 advisory(ies): CVE-2023-28858 (redis-py Race Condition vulnerability); CVE-2023-28859 (redis-py Race Condition due to incomplete fix); CVE-2023-28858 (redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connectio) +1 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
redis

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal