ClawHub
Back to skill

Security audit

TokST Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward TokST cloud-memory connector with clear external storage and persistence behavior, but no hidden execution or deceptive behavior was found.

Install this only if you intend to use TokST as a third-party cloud memory service. Confirm the active workspace before saving information, avoid storing secrets or raw logs, and review TokST dashboard settings for sensitive or personal data handling.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
Use `fact`, `decision`, `preference`, `architecture`, or `note` for durable knowledge. The `task` type serves historical compatibility; formal assigned work belongs in a Task.

Write formal memories in Markdown by default: include a clear heading and concise sections or bullets that preserve the user's working language, important tables, values, file changes, risks, and confirmed next steps. Exclude credentials, private keys, cookies, access tokens, raw reasoning, raw tool JSON, debug traces, and temporary errors.

## Scope and safety

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · instructions/CLAUDE.md (reported line 16)May include surrounding context.

md
Use `fact`, `decision`, `preference`, `architecture`, or `note` for durable knowledge. The `task` type serves historical compatibility; formal assigned work belongs in a Task.

Write formal memories in Markdown by default: include a clear heading and concise sections or bullets that preserve the user's working language, important tables, values, file changes, risks, and confirmed next steps. Exclude credentials, private keys, cookies, access tokens, raw reasoning, raw tool JSON, debug traces, and temporary errors.

## Scope and safety

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · instructions/CODEX.md (reported line 16)May include surrounding context.

md
Use `fact`, `decision`, `preference`, `architecture`, or `note` for durable knowledge. The `task` type serves historical compatibility; formal assigned work belongs in a Task.

Write formal memories in Markdown by default: include a clear heading and concise sections or bullets that preserve the user's working language, important tables, values, file changes, risks, and confirmed next steps. Exclude credentials, private keys, cookies, access tokens, raw reasoning, raw tool JSON, debug traces, and temporary errors.

## Scope and safety

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md
## Connect Cloud MCP

Configure the Agent with `https://api.tokst.com/mcp`. OAuth-capable clients
open a browser for approval. Static clients use a dedicated Dashboard API key
as a Bearer credential.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

md
## Connect Cloud MCP

Configure the Agent with `https://api.tokst.com/mcp`. OAuth-capable clients
open a browser for approval. Static clients use a dedicated Dashboard API key
as a Bearer credential.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
## Connect Cloud MCP

Configure the Agent with `https://api.tokst.com/mcp`. OAuth-capable clients
open a browser for approval. Static clients use a dedicated Dashboard API key
as a Bearer credential.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill directs the agent to send memory operations to an external cloud endpoint, which creates a real data-exfiltration/privacy boundary. Even though this is the stated purpose of the skill and not obviously malicious, any use of durable memory can transmit user/project data off-platform to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
and authorized workspaces. Use the TokST Cloud MCP connection for all memory
operations. The MCP endpoint is:

https://api.tokst.com/mcp

## Connection

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
browser authorization requested by the client. Static or headless deployments
may use a TokST API key as a Bearer token.

The connected client exposes TokST tools directly. Use those tools; do not ask
the user to install a CLI for memory retrieval or memory writes.

## First-use check

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The first-use workflow explicitly instructs connecting to the external MCP endpoint and performing both read and write actions. This is a genuine external transmission risk because it operationalizes immediate data exchange with a remote service, including persistence of content outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
## First-use check

1. Connect `https://api.tokst.com/mcp` and complete browser authorization.
2. Use `tokst_search` to return the title and ID for one known topic.
3. Use `tokst_remember` to save one confirmed Markdown memory with a clear
   heading.

Static analysis

No suspicious patterns detected.