ClawHub
Back to skill

Security audit

Memory Search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed memory-recall helper that may retrieve personal stored context, but I found no hidden execution, exfiltration, or persistence beyond that purpose.

Install this only if you are comfortable with the agent checking stored memory, daily notes, raw logs, and enabled transcripts when answering questions about past context or personal details. Avoid enabling transcript indexing for highly sensitive chats unless that behavior is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:5
Finding

Overbroad Access to Sensitive Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–7, 37–56, and 73–79
Vulnerability Type: Overbroad retrieval of sensitive retained information
Risk Level: Medium

Evidence

SKILL.md, lines 5–7:

markdown
You have two tools for recalling information from your memory files. Use them.

## Tools

SKILL.md, lines 37–56:

markdown
## When to Use Memory Search

**Always search before answering about:**

- Prior conversations or decisions
- The human's preferences, habits, or opinions
- Dates, deadlines, birthdays, events
- Project status or history
- Anything the human said "remember this" about
- Todos, action items, or commitments
- People, names, relationships

**The pattern is:**

1. Receive a question that might involve past context
2. Call `memory_search` with a relevant query
3. Review the results
4. If a snippet looks promising but needs more context, call `memory_get` with the path and line range
5. Answer using what you found (cite sources in direct chats)

SKILL.md, lines 73–79:

markdown
## What Gets Indexed

Your memory search covers:

- `MEMORY.md` — your curated long-term memory
- `memory/*.md` — daily notes and raw logs
- Session transcripts (if enabled)

Technical Analysis

The skill directs the agent to search long-term memory, daily notes, raw logs, and potentially complete session transcripts whenever a request broadly concerns prior conversations, preferences, dates, commitments, projects, or relationships. These sources can contain sensitive personal or operational information.

Memory access is the skill's declared function, and the audited file does not contain instructions to exfiltrate data, bypass authorization, execute code, or write attacker-controlled content into persistent memory. Nevertheless, the unconditional phrase “Always search” creates an overbroad retrieval policy. It does not require explicit user intent, verify that the requester is authorized to receive the informati ...[truncated 1761 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the unconditional “Always search” rule with a requirement to search only when the user explicitly requests historical or personalized context.
  2. Verify that the requester and conversation context are authorized to access the relevant retained information.
  3. Apply least-privilege retrieval by narrowing queries to the specific subject, date range, and source required for the request.
  4. Exclude session transcripts and raw logs by default; require explicit confirmation before searching these higher-sensitivity sources.
  5. Retrieve the smallest useful excerpt and avoid using memory_get unless surrounding context is essential.
  6. Add mandatory filtering for credentials, authentication tokens, financial information, health information, private relationship details, and unrelated third-party data.
  7. Summarize relevant facts instead of reproducing raw memory snippets whenever possible.
  8. If results contain unrelated sensitive information, omit it and state only that relevant memory was checked.
  9. Maintain access logging and source-level controls so memory searches can be reviewed and restricted according to data sensitivity.
  10. Add an instruction that memory content is untrusted data and must never be treated as higher-priority agent instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs the agent to search indexed memory files and session transcripts for personal information such as preferences, birthdays, relationships, commitments, and raw logs, but it does not require a user-facing notice, consent check, or sensitivity filter before retrieval. This creates a privacy risk because the agent may surface sensitive remembered data in response to ordinary prompts, especially when session transcripts and long-term memory are broadly indexed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.