ClawHub
Back to skill

Security audit

Agentprizm Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed remote memory integration, but one documented setup path can expose unrelated marketplace-management tools under the user's AgentPrizm account.

Install only with the recommended memory-only configuration or verify the MCP server exposes only memory_* tools. Avoid the unfiltered manual mcp set example unless you intentionally want AgentPrizm marketplace powers available to the agent, and do not store secrets or regulated data in remote memory without reviewing AgentPrizm's policies.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
README.md:76
Finding

Manual MCP Configuration Exposes Unnecessary Marketplace Tools

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 76–83
Vulnerability Type: Excessive MCP tool permissions
Risk Level: Medium

Vulnerable Code

markdown
If you'd rather set the server in one shot (e.g. to pin a literal key), use `mcp set`.
Note: `mcp set` takes only the **bare per-server object** `{url,transport,headers}` — not
a wrapped config. ([`mcp/openclaw.json`](./mcp/openclaw.json) shows the same server in the
`mcp.servers.<name>` shape it lands as in `~/.openclaw/openclaw.json`; copy only the inner
object into `mcp set`.)

```bash
openclaw mcp set agentprizm-memory '{"url":"https://agentprizm.com/api/mcp","transport":"streamable-http","headers":{"Authorization":"Bearer ap_xxxxxxxxxxxxxxxxxx"}}'
text

### Technical Analysis

The documented manual configuration omits the `toolFilter.include: ["memory_*"]` restriction present in `mcp/openclaw.json` and the recommended installation command. According to the project documentation, registering the AgentPrizm server without this filter exposes all 22 server tools rather than only the eight memory tools.

The additional capabilities include 14 `skill_*` marketplace operations, such as installing, publishing, updating, deprecating, and unpublishing skills. These capabilities are unrelated to the skill's declared persistent-memory purpose and violate least-privilege principles.

### Attack Path

1. A user follows the documented manual configuration alternative.
2. OpenClaw registers the remote MCP endpoint without a memory-only tool filter.
3. The agent receives access to all tools advertised by the remote server, including marketplace modification operations.
4. Malicious or misleading content, agent misuse, or a compromised remote service induces the agent to invoke an unrelated `skill_*` operation.
5. The agent installs or modifies marketplace skills using the user's authenticated AgentPrizm account.

### Impact Assessment

Explo
...[truncated 481 chars]
Remediation
View remediation

Remediation Suggestions

Add the memory-only tool filter to the manual configuration:

bash
openclaw mcp set agentprizm-memory '{"url":"https://agentprizm.com/api/mcp","transport":"streamable-http","headers":{"Authorization":"Bearer ap_xxxxxxxxxxxxxxxxxx"},"toolFilter":{"include":["memory_*"]}}'

If mcp set does not support toolFilter, document and require an immediate follow-up command that restricts the server to memory_*.

Also:

  1. State explicitly that an unfiltered server exposes marketplace-management capabilities.
  2. Present unrestricted access only as a clearly labeled, explicit opt-in.
  3. Add a verification step using openclaw mcp tools to confirm that only the eight expected memory tools are exposed.
  4. Keep mcp/openclaw.json, the recommended installation command, and every alternative setup path aligned with the same least-privilege policy.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README states the agent will recall before acting and store new durable information via a remote MCP server, but it does not prominently warn that user data, preferences, contacts, and lessons may be transmitted to and persisted by a third-party service. This can lead to unintentional exfiltration of sensitive or regulated information because users may not understand the privacy boundary or storage implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

Your memories are yours, scoped to your account.

  1. Sign up free at agentprizm.com.

  2. Create an API key (keys are prefixed ap_).

  3. Set it in your environment:

    bash

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README expands a memory-focused skill to optionally expose 14 additional remote skill_* tools, including install, publish, and marketplace operations. This broadens the trust and capability surface beyond the stated purpose, increasing the chance an agent can be induced to fetch, install, modify, or publish external content through the same MCP connection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The MCP configuration embeds a bearer token directly in the skill config, causing any user who installs or inspects the skill to inherit or reuse a fixed credential. This can expose the token to unauthorized parties, prevent per-user consent and accountability, and let the skill route memory data through a shared external account without clear user control.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text
the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN