Slim Project Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:56 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent documentation organizer, but its credential-handling instructions are contradictory enough that it could persist real secrets in a local agent memory file.

Review generated changes carefully before using this skill. Do not allow it to copy real passwords, API keys, database URLs, Redis URLs, personal access tokens, or other credential values into CLAUDE.local.md; keep only environment variable names and non-secret service URLs there. Treat any DB migration command, commit, or push as requiring explicit approval, and prefer a pinned local project dependency instead of an unpinned npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:160

Finding

Ambiguous migration instructions may persist plaintext credentials in CLAUDE.local.md

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:148,160; references/CLAUDE-local-template.md:13; references/cruise-intelligence-case-study.md:73-75
Vulnerability Type: Plaintext sensitive-data storage caused by conflicting security instructions
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:148:

markdown

- **Moves to `CLAUDE.local.md`**: any block containing connection strings, passwords, API keys, or internal proxy URLs — convert to env var name references, not inline values

SKILL.md:160:

markdown

3. Create `CLAUDE.local.md` with secrets extracted from existing CLAUDE.md. Verify `git check-ignore`.

references/CLAUDE-local-template.md:13:

markdown

If you must document a specific credential value for a debugging or setup workflow, set a short-lived, read-only, staging-only token and rotate it after the session. Never embed production admin tokens in any file.

references/cruise-intelligence-case-study.md:73-75:

markdown

2. Add `CLAUDE.local.md` to `.gitignore`
3. Create `CLAUDE.local.md` with all 3 envs' DB URLs, Redis URLs, FalkorDB credentials, GitHub PAT
4. Verify with `git check-ignore -v CLAUDE.local.md` (matched line 70)

Technical Analysis

The skill contains conflicting guidance. One instruction correctly requires converting credentials into environment-variable name references, while the execution sequence says to create CLAUDE.local.md using “secrets extracted” from the existing file. The template also explicitly allows a credential value under some circumstances, and the bundled case study demonstrates copying database credentials and a GitHub personal access token into the local file.

Adding the file to .gitignore only reduces the probability of committing it to Git. It does not encrypt the file or prevent access by other local users, processes, backup tools, indexing services, endpoint malware, editor extensions, or late ...[truncated 1665 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace SKILL.md:160 with an unambiguous requirement such as:

   markdown

   Create `CLAUDE.local.md` containing only public environment URLs and environment-variable names. Never copy credential values from the existing CLAUDE.md. Replace every detected secret with its environment-variable reference or a redacted placeholder.
   

2. Remove the exception permitting temporary credential values from references/CLAUDE-local-template.md. Require all credentials, including short-lived staging tokens, to remain in environment variables or a dedicated secret manager.

3. Rewrite the case-study execution sequence so that it records only variable names such as STAGING_DATABASE_URL and GITHUB_TOKEN, not their values.

4. Add a mandatory secret scan covering both tracked and ignored generated files. The verification should explicitly scan CLAUDE.local.md because ordinary Git-based scanners may omit ignored files.

5. Fail closed when a credential-like value is detected: stop the migration, report the source location, and ask the user to move or rotate the credential.

6. If prior users followed the documented case study, advise them to remove plaintext values and rotate any credentials that may have been exposed.

T08 · Insecure Dependencies

Note

• Location: references/CLAUDE-local-template.md:61

Finding

Unpinned npx invocation may download and execute a mutable third-party package

Content

View full analysis

Vulnerability Details

File Location: references/CLAUDE-local-template.md:61-64
Vulnerability Type: Unpinned runtime dependency retrieval and execution
Risk Level: Low

Vulnerable Code Snippet

markdown

```bash
# Reference env vars set in Railway/Vercel, not inline values:
DATABASE_URL="$STAGING_DATABASE_URL" npx prisma migrate deploy

text

### Technical Analysis

`npx prisma migrate deploy` relies on package resolution at execution time. If the project does not already contain an installed local Prisma CLI, `npx` may offer to retrieve and execute a package from the configured npm registry. The command does not specify an audited version or require resolution from the project's lockfile.

Consequently, the effective executable can vary over time or according to local registry configuration. A compromised registry, malicious registry mirror, altered npm configuration, or unexpected package resolution could cause unreviewed code to execute with the invoking user's privileges. The process also receives `DATABASE_URL`, so malicious package code could read that environment variable.

This finding does not establish that the legitimate `prisma` package is malicious. The risk is the mutable, runtime dependency-resolution pattern and the absence of an explicit requirement that a lockfile-installed local binary be used.

### Attack Path

1. A user follows the generated remote-migration instructions on a system where Prisma is not installed in the project.
2. `npx` resolves the package through the configured npm registry or mirror and retrieves executable package content.
3. An attacker has compromised the relevant package-delivery path, registry account, mirror, DNS/network trust boundary, or local npm configuration.
4. The retrieved package executes through `npx` under the user's operating-system account.
5. The package reads `STAGING_DATABASE_URL` from the child process environment and can access files a
...[truncated 767 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare Prisma as a pinned project dependency and commit the package-manager lockfile.
2. Require an immutable dependency installation before migrations, such as npm ci, and verify lockfile integrity in CI.
3. Invoke only the installed local CLI. For example, use a package script whose prisma command resolves from the project's locked node_modules/.bin directory.
4. If npx must be retained, use npx --no-install prisma migrate deploy so execution fails when the reviewed local dependency is absent.
5. Do not recommend dynamically installing a migration tool while a database credential is present in the process environment.
6. Require explicit authorization, a verified target environment, a current backup, and least-privilege migration credentials before executing remote migrations.
7. Pin and audit the npm registry configuration in controlled environments to reduce registry and mirror substitution risks.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

Read `references/CLAUDE-local-template.md`, substitute placeholders for branch/env structure. The template uses env var name references instead of inline creden

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

Tell the user:
- "CLAUDE.md and CLAUDE.local.md are ready. CLAUDE.local.md is gitignored."
- "Open CLAUDE.local.md and add the env var name references — secrets go in Railway dashboard / .env files, not inline in this file."
- "As you build the project, add new facts to the relevant `docs/` file, not directly to CLAUDE.md."

Do not commit anything. The user owns the first commit.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

Tell the user:
- "CLAUDE.md and CLAUDE.local.md are ready. CLAUDE.local.md is gitignored."
- "Open CLAUDE.local.md and add the env var name references — secrets go in Railway dashboard / .env files, not inline in this file."
- "As you build the project, add new facts to the relevant `docs/` file, not directly to CLAUDE.md."

Do not commit anything. The user owns the first commit.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/CLAUDE-template.md (reported line 13)May include surrounding context.

md

## Hard rules (non-negotiable)

<!--
  PROJECT-SPECIFIC LOAD-BEARING RULES.
  Replace this comment with the actual rules for THIS project.
  Examples to consider:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/CLAUDE-template.md (reported line 36)May include surrounding context.

md

## Branch → environment topology

<!--
  Replace with the actual branches and environments for this project.
  Don't include connection strings here — those go in CLAUDE.local.md.
-->

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/CLAUDE-template.md (reported line 41)May include surrounding context.

md

Don't include connection strings here — those go in CLAUDE.local.md.
-->

| Branch | Environment | Auto-deploy | Notes |
|--------|-------------|-------------|-------|
{{#BRANCHES}}
| {{branch}} | {{env}} | {{auto_deploy}} | {{notes}} |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/CLAUDE-template.md (reported line 44)May include surrounding context.

md

| Branch | Environment | Auto-deploy | Notes |
|--------|-------------|-------------|-------|
{{#BRANCHES}}
| {{branch}} | {{env}} | {{auto_deploy}} | {{notes}} |
{{/BRANCHES}}

(Connection strings → `CLAUDE.local.md`)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/cruise-intelligence-case-study.md (reported line 29)May include surrounding context.

md

## Mode chosen

EXISTING mode (CLAUDE.md was substantial, project was mid-life). Goal: reproduce the slim structure without losing any information and without checking secrets into git.

## Pre-flight audit

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Even with the historical-note disclaimer at the top, the execution step still explicitly says to create a local file containing live DB URLs, Redis URLs, FalkorDB credentials, and a GitHub PAT. In an agent skill/reference, concrete credential-handling steps can be copied mechanically by downstream agents or users, normalizing plaintext secret aggregation and increasing risk of local disclosure, accidental logging, or future check-in mistakes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

L121 states the migration was pushed to origin, while L135 says 'Never auto-commit a documentation migration.' As written, the reference narrative documents the skill flow performing commits/pushes but the concluding guidance frames auto-commit as prohibited, creating an intent/documentation contradiction about whether committing is part of the skill's own behavior or only user-authorized follow-up.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes a skill for restructuring/initializing project memory files, local env reference files, and docs organization. Line L125 instructs operators to always run a secret-leak grep against the whole repo and report leaks in unrelated files, which is a broader security-audit capability not obviously required for the core memory-slimming task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.