T01 · Skill Instruction Hijacking
Error
- Location
scripts/mengram-profile.sh:30- Finding
Remote Profile Content Can Hijack Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Mengram Openclaw Skill
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is mostly coherent, but it gives an agent broad automatic long-term memory and sends sensitive data and the API key to configurable remote endpoints with some under-disclosed risks.
Install only if you are comfortable with Mengram receiving and retaining conversation text, personal facts, search queries, workflow details, and procedure feedback across sessions and channels. Avoid using it for sensitive chats unless you can restrict retention, review/delete stored memories, and ensure MENGRAM_BASE_URL cannot be set to an untrusted endpoint. Do not use the unpinned npx installer command without verifying the package name, publisher, and version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mengram-add.sh:9- Finding
Unrestricted Base URL Override Can Exfiltrate Credentials and Private Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mengram-setup.sh:21- Finding
Setup Script Exposes an API-Key Prefix in Logs
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
README.md:31- Finding
Installation Instructions Execute an Unpinned and Potentially Misspelled Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill discloses that conversation data, search queries, and procedure feedback are sent to a third-party endpoint, yet this external API use is not expressed as a formal permission scope in the manifest. In a memory skill, that is especially sensitive because the exported content includes personal history and profile-building data across sessions and channels.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill discloses that conversation data, search queries, and procedure feedback are sent to a third-party endpoint, yet this external API use is not expressed as a formal permission scope in the manifest. In a memory skill, that is especially sensitive because the exported content includes personal history and profile-building data across sessions and channels.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill discloses that conversation data, search queries, and procedure feedback are sent to a third-party endpoint, yet this external API use is not expressed as a formal permission scope in the manifest. In a memory skill, that is especially sensitive because the exported content includes personal history and profile-building data across sessions and channels.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill discloses that conversation data, search queries, and procedure feedback are sent to a third-party endpoint, yet this external API use is not expressed as a formal permission scope in the manifest. In a memory skill, that is especially sensitive because the exported content includes personal history and profile-building data across sessions and channels.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill discloses that conversation data, search queries, and procedure feedback are sent to a third-party endpoint, yet this external API use is not expressed as a formal permission scope in the manifest. In a memory skill, that is especially sensitive because the exported content includes personal history and profile-building data across sessions and channels.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill promotes cross-session and cross-channel persistence of what the user said on one platform for reuse on another, which materially expands surveillance scope and the blast radius of any compromise. In context, this is more dangerous because it is coupled with comprehensive profiling and third-party storage, making ordinary conversations available beyond their original setting.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Because MENGRAM_BASE_URL is attacker-controllable through the environment, the script will POST both workflow contents and the Authorization bearer token to any specified endpoint. In a memory skill, the transmitted workflow data may contain sensitive user history, preferences, or learned procedures, so this creates a direct exfiltration path for both secrets and stored context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README advertises persistent cross-session and cross-channel memory that stores personal facts, events, and workflows, but it does not provide a clear upfront privacy warning about what data is collected, retained, and sent to the external
mengram.ioservice. In a memory skill, this context makes the issue more serious because users are encouraged to share sensitive personal history, preferences, and operational details that may be transmitted and retained without informed consent.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to run
npx clawdhub@latest install mengram-memory, which executes whatever code is currently published under that package name rather than a reviewed, pinned version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published, users may execute attacker-controlled code during installation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README states that the agent 'automatically' saves new information and workflows to memory, which means data persistence occurs by default without an explicit warning or consent flow. Because this is long-term memory tied to user interactions, it can silently accumulate sensitive personal, conversational, or operational information over time and increase privacy and compliance risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell scripts and declares required binaries and an API key, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a governance gap where a host agent may permit broader shell execution or networked behavior than reviewers expect, increasing the chance of unintended command execution and data egress.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guidance frames the skill as applicable whenever recalling prior user context, saving important information, tracking workflows, or reporting outcomes, which is broad enough to trigger on many normal conversations. In practice this can cause over-collection and routine exfiltration of personal data to the external memory service without sufficiently narrow conditions or consent boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to ALWAYS search memory before answering is overly broad and can force external lookups for routine questions, unnecessarily exposing user prompts and creating a habit of pervasive profiling. In a memory skill tied to a third-party service, that materially increases privacy risk and can bias agent behavior toward hidden context retrieval even when not needed.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These instructions direct the agent to retain personal information, events, relationships, corrections, and workflow outcomes across sessions, which creates a durable dossier on the user. Because the skill also states that this data is stored on external servers and shared across channels, the privacy impact is substantial if users did not explicitly consent or if sensitive data is captured by default.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The profile feature builds a comprehensive portrait of the user from accumulated memory, which is a classic profiling function with meaningful privacy and misuse implications. In this skill's context, the danger is elevated because the profile aggregates sensitive facts, events, and workflows from multiple sessions and channels and may be retrieved automatically at session start.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Periodic logging of recent conversation highlights encourages bulk retention of conversational content rather than targeted storage of user-approved facts. That increases the likelihood of capturing sensitive or irrelevant material and shipping it to the external service simply because it appeared in conversation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This script transmits arbitrary user-provided text to an external service over the network, which is a genuine data exfiltration/privacy risk if the caller passes sensitive information. The risk is heightened by the skill’s purpose as long-term memory across sessions, because users may supply personal preferences, conversation history, or workflow details that are sensitive and persist outside the local environment.
- Content
sh # Sanitize input for JSON SAFE_TEXT=$(python3 -c "import json,sys; print(json.dumps(sys.argv[1]))" "$TEXT") RESPONSE=$(curl -s -w "\n%{http_code}" \ -X POST "${MENGRAM_BASE_URL}/v1/add" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The script sends user-supplied context and procedure feedback to a remote service via curl, which is a real external data transmission. In a long-term memory skill, the context may contain sensitive conversation content, workflow details, or user preferences, so transmitting it off-host can expose private data if users or operators do not clearly understand what is being sent.
- Content
sh fi if [ -n "$BODY" ]; then RESPONSE=$(curl -s -w "\n%{http_code}" \ -X PATCH "${MENGRAM_BASE_URL}/v1/procedures/${PROC_ID}/feedback?success=${SUCCESS}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script’s security manifest states that only a fixed Mengram endpoint is contacted, but the implementation allows MENGRAM_BASE_URL to override the destination. This can redirect the user’s query and Bearer token to an attacker-controlled host, defeating review assumptions and creating credential and data exfiltration risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # Sanitize query for JSON SAFE_QUERY=$(python3 -c "import json,sys; print(json.dumps(sys.argv[1]))" "$QUERY") RESPONSE=$(curl -s -w "\n%{http_code}" \ -X POST "${MENGRAM_BASE_URL}/v1/search/all" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # Sanitize query for JSON SAFE_QUERY=$(python3 -c "import json,sys; print(json.dumps(sys.argv[1]))" "$QUERY") RESPONSE=$(curl -s -w "\n%{http_code}" \ -X POST "${MENGRAM_BASE_URL}/v1/search/all" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script’s manifest claims it only contacts fixed Mengram endpoints, but it actually allows the base URL to be overridden via MENGRAM_BASE_URL. Because the same script then sends the Authorization bearer token to that URL, an attacker who can influence the environment can redirect the request to an arbitrary host and capture the API key.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script prints the first 10 characters of the API key to user-facing output. Even partial secret disclosure can leak into terminal history, CI logs, screenshots, or support transcripts and may aid credential identification, correlation, or partial reconstruction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The security manifest states that only the fixed Mengram endpoint is contacted, but the script actually allows the destination to be overridden via MENGRAM_BASE_URL. That mismatch is security-relevant because users and reviewers may trust the manifest while the code can send authenticated data to an arbitrary host.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh print(json.dumps(desc)) " "$WORKFLOW_NAME" "$STEPS" "$OUTCOME") RESPONSE=$(curl -s -w "\n%{http_code}" \ -X POST "${MENGRAM_BASE_URL}/v1/add" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \