ClawHub
Back to skill

Security audit

Mnemos Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for setting up Mnemos memory, but it asks agents to self-install mutable third-party software and persistent memory integrations without enough scoping or approval guidance.

Install only after reviewing the resolved Mnemos package/plugin source and dependency versions. Prefer a pinned version in an isolated environment, approve installation and host config changes yourself, and review what prompts, tool failures, and project facts will be stored or sent to any configured embedding provider.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party Package and Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:11-13; references/hosts.md:6-7, references/hosts.md:15-16, and references/hosts.md:35-36
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:11-13:

markdown
- Prefer `pip install "mnemos-memory[mcp]"` and `mnemos ui`.
- For OpenClaw / ClawHub, teach the agent to self-install `mnemos-memory[mcp]`, run `mnemos ui`, then wire `mnemos-mcp` to the canonical `MNEMOS_CONFIG_PATH` before relying on memory.
- Recommend SQLite as the supported persistent store.

references/hosts.md:6-7:

bash
pip install "mnemos-memory[mcp]"
mnemos ui

references/hosts.md:15-16:

bash
pip install "mnemos-memory[mcp]"
mnemos ui

references/hosts.md:35-36:

text
/plugin marketplace add anthony-maio/mnemos
/plugin install mnemos-memory@mnemos-marketplace

Technical Analysis

The Skill instructs users or agents to install an executable Python package and a marketplace plugin without pinning a reviewed version, commit, artifact digest, or package hash. Consequently, the installed content may differ from the content that existed when this Skill was audited.

Python package installation can execute dependency-controlled build or installation logic and installs executable commands that are subsequently invoked as mnemos, mnemos-cli, and mnemos-mcp. The optional mcp dependency group can also introduce transitive dependencies whose versions are not constrained in this Skill. Similarly, adding a mutable plugin marketplace and installing a plugin by name does not establish an immutable trust boundary.

The self-installation recommendation for OpenClaw and ClawHub increases the risk because an agent may initiate installation without a human independently reviewing the resolved package version and dependency tree. There is no evidence that the currently referenced pa ...[truncated 1633 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the Python package to a specific reviewed version, for example:
    bash
    python -m pip install "mnemos-memory[mcp]==<reviewed-version>"
  2. Maintain a lock file that constrains all transitive dependencies, not only the top-level package.
  3. Require package hashes with pip --require-hashes or install a verified artifact whose SHA-256 digest is documented.
  4. Pin marketplace content to a reviewed release tag or commit digest instead of relying on a mutable repository or plugin name.
  5. Document the authoritative package registry, publisher identity, source repository, and release-signing or provenance verification procedure.
  6. Require explicit user approval before an agent installs packages or plugins, especially during self-bootstrap flows.
  7. Perform installation in an isolated virtual environment or container with least-privilege filesystem and network access.
  8. Review dependency changes before upgrades and run vulnerability, provenance, and malware checks against the fully resolved dependency set.
  9. Separate installation from execution so users can inspect the selected version and resolved artifacts before launching mnemos, mnemos-cli, or mnemos-mcp.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hosts.md (reported line 79)May include surrounding context.

md
## Codex

- Mnemos for Codex is MCP-first, not plugin-first.
- Register `mnemos-mcp` in `~/.codex/config.toml`.
- Add repo policy text so the agent actually uses the tools consistently.

Minimal config:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger description says to use the skill when users need to 'install, configure, self-bootstrap, troubleshoot, or operate Mnemos' or when they mention broad terms like 'agent memory' and 'memory automation'. Those phrases are expansive and lack negative examples or tighter scope constraints, which could cause the skill to activate in conversations that only loosely relate to memory features.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction says to use the file when the user 'asks how Mnemos actually works in daily use, wants automation, or needs troubleshooting guidance.' Phrases like 'wants automation' and 'needs troubleshooting guidance' are broad and do not define clear boundaries or exclusions, which can cause unintended invocation in ordinary conversations.

Content

No source excerpt is available for this finding.