ClawHub
Back to skill

Security audit

Memory Lifecycle

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can keep changing an agent’s memory on a schedule and may preserve sensitive details, so it needs review before installation.

Install only if you intentionally want scheduled autonomous memory maintenance. Run setup.py with --dry-run first, avoid --all unless you administer every listed agent, review the cron jobs before enabling them, and keep passwords, tokens, credentials, addresses, and unnecessary personal details out of agent memory. Back up MEMORY.md and the memory directory before running setup.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if dry_run:
        print(f"  [DRY RUN] {cmd}")
        return None
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"  [ERROR] {cmd}")
        print(f"  stderr: {result.stderr.strip()}")
Confidence
97% confidence
Finding
The helper executes a dynamically constructed shell command via `subprocess.run(..., shell=True)`. In this script, `cmd` incorporates attacker-controllable values such as `agent_id`, `timezone`, descriptions, and especially inlined prompt text, so shell metacharacters or quote breaking can lead to command injection and arbitrary command execution.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly instructs execution of local scripts and describes file creation, file modification, and cron-job installation, yet it declares no permissions. That mismatch is dangerous because it can cause users or agent frameworks to invoke capabilities they did not explicitly approve, especially persistent system changes like scheduled jobs and ongoing file writes.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The `--all` mode discovers every agent on the server and applies filesystem and cron-job changes to each workspace. For a memory-management setup skill, that is broader than necessary and increases blast radius: one invocation can modify many tenants or unrelated agents without per-agent confirmation.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Server-wide agent discovery gives this setup script a platform-administration capability unrelated to simple local memory scaffolding. In the context of an agent skill, that broadens access to metadata about all agents and enables later mass modification when combined with `--all`.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill tells the user to run a setup script that creates files and installs four cron jobs, but it does not present a clear user-facing warning that this makes persistent changes to the system. This is dangerous because users may treat the command as harmless initialization while it silently establishes scheduled execution and ongoing modification of agent memory files.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This prompt explicitly instructs the agent to create archive files and move content out of MEMORY.md, which modifies stored user/agent state without requiring confirmation, preview, or rollback. Because it also tells the agent to preserve detailed personal and operational data in self-contained archives, an automated run could silently reorganize or retain sensitive information in ways the user did not intend.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The prompt explicitly instructs the agent to modify multiple memory files and to clear the `## Recent` section in `MEMORY.md`, which can delete or overwrite user-maintained context without any confirmation, preview, or rollback mechanism. In a memory-management skill this behavior is functionally relevant, but it still creates a real integrity risk because an agent could remove information that was misfiled, not yet fully processed, or still important to the user.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The prompt explicitly instructs the agent to create a permanent file under `memory/wisdom/YYYY.md` without requiring prior user confirmation or a user-visible warning that a filesystem write will occur. In an agent environment, silent persistence can surprise users, create unwanted durable records, and normalize unauthorized state changes even if the content is operationally benign.

Static analysis

No suspicious patterns detected.