ClawHub
Back to skill

Security audit

Talamus Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently sets up a local memory tool and discloses its sensitive actions, with user consent required for installation, LLM use, repository scanning, MCP setup, and session capture.

Install only if you trust the Talamus package source. Keep automatic session capture disabled unless you are comfortable with local storage derived from transcripts and git diffs, and avoid approving --allow-secrets or broad brain scopes unless you understand what will be captured.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–49
Vulnerability Type: Supply-chain risk from an unpinned dependency
Risk Level: Medium

Vulnerable Code

bash
uv tool install "talamus[mcp]"
# or, when uv is unavailable:
pipx install "talamus[mcp]"
# last resort:
python -m pip install --user "talamus[mcp]"

Technical Analysis

The skill instructs the agent to install the external talamus[mcp] package without specifying a version, integrity hash, lockfile, signature, or immutable source revision. Consequently, the package installed when the skill is used may differ from the package version available when the skill was audited.

Although installation requires user approval, approval does not mitigate package substitution, a compromised upstream release, or an unexpected behavioral change in a later version. Python package installation can execute package-controlled installation logic, and the installed CLI subsequently operates with the user's permissions.

Attack Path

  1. An attacker compromises the package publisher, package repository, distribution credentials, or a future upstream release.
  2. The attacker publishes a modified version under the package name referenced by the skill.
  3. A user approves installation after the agent reports that the CLI is missing.
  4. One of the documented installers retrieves the mutable package version.
  5. Malicious installation or runtime code executes with the permissions of the user running the agent.
  6. The package may access files, configuration, transcripts, repositories, or credentials available to that user.

Impact Assessment

Successful exploitation could provide code execution under the invoking user's account. The accessible scope includes user-readable project files, local configuration, environment data exposed to the process, and any other resources available to that account. The instructions do not request elevated opera ...[truncated 106 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specifically reviewed version, such as an exact == version.
  • Require cryptographic hashes through a locked requirements file or equivalent verified package manifest.
  • Document the canonical publisher, source repository, and expected package index.
  • Prefer signed, immutable release artifacts where available.
  • Install the package in an isolated environment with only the permissions required for the task.
  • Re-audit the package before updating the pinned version.
  • Display the resolved version and source to the user before requesting installation approval.

T06 · System Persistence

Warning
Location
SKILL.md:142
Finding

Persistent Session-Capture Hook with Access to Sensitive Development Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 142–147
Vulnerability Type: Persistent hook installation
Risk Level: Medium

Vulnerable Code

markdown
For automatic session memory, explain that the hook reads the session
transcript and git diff, stores decisions locally, and audits the decision.
Install it only after explicit consent through `talamus setup --capture yes` or
the dedicated hook command.

Technical Analysis

The skill supports installation of an automatic session-capture hook that persists beyond the immediate workflow and reads future session transcripts and Git diffs. These sources can contain proprietary code, credentials, personal information, internal prompts, and other sensitive data.

The explicit-consent requirement is a meaningful safeguard and prevents this from being a silent installation path. However, the persistent hook is implemented by the externally installed package rather than auditable code in this project. The reviewed files do not define its exact installation location, execution boundaries, retention period, redaction behavior, removal procedure, or controls preventing capture outside the intended project.

Attack Path

  1. The user explicitly enables automatic capture using talamus setup --capture yes or the referenced dedicated hook command.
  2. The external Talamus package installs a hook that survives the current skill invocation.
  3. During later development sessions, the hook reads session transcripts and Git diffs.
  4. Sensitive material present in those inputs is stored in durable local memory.
  5. If the external implementation is compromised, overly broad, or improperly configured, the captured information may be accessed outside its intended scope or retained longer than expected.

This exploitation path is conditional: the audited instructions require explicit user consent, and no evidence in the reviewed files establishes that the hook ...[truncated 555 chars]

Remediation
View remediation

Remediation Suggestions

  • Keep session capture disabled by default and continue requiring explicit, informed consent.
  • Before installation, disclose the exact hook files, trigger conditions, captured fields, storage path, retention period, and project scope.
  • Provide and document a deterministic command for disabling and completely removing the hook.
  • Apply secret detection and redaction before transcript or Git-diff content is persisted.
  • Restrict capture to the selected project and prevent traversal into unrelated repositories or sessions.
  • Store captured data with restrictive filesystem permissions and encryption where appropriate.
  • Offer a preview mode showing what would be captured before enabling persistence.
  • Record an auditable consent event and allow users to inspect and delete previously captured data.
  • Pin and independently review the external package version responsible for implementing the hook.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep