T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/restore_secure.py:10- Finding
Unrestricted URL Fetching Enables Blind Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
EternalClaw Memory Sync
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent memory-restore purpose, but it downloads user-supplied remote content and writes restored files into the workspace with weak containment and secret-handling safeguards.
Review before installing. Only restore backups from sources you fully trust, run the script in a fresh dedicated directory, avoid putting the password directly on the command line, and do not run it from a workspace containing sensitive files or symlinks until URL restrictions, size/time limits, overwrite prompts, and path containment are improved.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/restore_secure.py:35- Finding
Symlink Traversal Allows Restoration Outside the Selected Output Directory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/restore_secure.py:54- Finding
Backup Password Is Exposed Through Command-Line Arguments
- Content
View full analysis
" --password "" ``` ### Technical Analysis Command-line arguments are not an appropriate default channel for secrets. Depending on the operating system and host configuration, arguments can be visible through process inspection utilities, monitoring agents, audit logs, job schedulers, crash diagnostics, or process APIs. Commands may also persist in shell history. Although the source imports `getpass` in `scripts/crypto_utils.py`, the restoration entry point does not use a protected interactive prompt. ### Attack Path 1. A user follows the documented invocation and enters the backup password as the value of `--password`. 2. The shell may save the full command in its history. 3. While the process runs, a local user or monitoring process may inspect its command-line arguments. 4. The observer recovers the password. 5. The observer uses it to decrypt any accessible backup protected by the same password. ### Impact Assessment Successful exploitation discloses the backup decryption password. An attac ...[truncated 260 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/restore_secure.py:12- Finding
Unbounded Network Response Enables Memory Exhaustion and Indefinite Blocking
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:22- Finding
Unpinned Runtime Dependencies Create a Non-Reproducible Supply-Chain Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Claiming secure AES-256-GCM memory restoration while apparently delegating decryption to a generic helper and restoring arbitrary files is dangerous because users may trust stronger guarantees than are actually verified. If the restored payload is not tightly scoped to agent memory, the mechanism can become a general remote file dropper into the workspace.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Claiming secure AES-256-GCM memory restoration while apparently delegating decryption to a generic helper and restoring arbitrary files is dangerous because users may trust stronger guarantees than are actually verified. If the restored payload is not tightly scoped to agent memory, the mechanism can become a general remote file dropper into the workspace.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md`: Documentation (this file).
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documentation advertises behavior that requires network access and local file read/write, but it declares no explicit tool scope or permissions. This creates an authorization and review gap: a user or platform cannot easily assess that the skill can fetch remote content and write restored files into the workspace, increasing the chance of unsafe execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation explicitly states that remote data will be unpacked into the current workspace but gives no warning about overwrite, path safety, or broader system impact. In context, this is especially risky because the skill is designed to fetch attacker-controlled remote content and restore it locally, which can lead to file clobbering, workspace poisoning, or persistence if users run it in sensitive directories.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The stated skill purpose explicitly includes backing up and restoring memory from remote URLs. In this implementation, the backup and restore operations are limited to local filesystem paths via open(), while the rest of the file provides cryptographic utility functions only. This is a semantic mismatch between the claimed remote-transfer behavior and the actual code in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script accepts the decryption password via the --password command-line argument, which can expose the secret through shell history, process listings, audit logs, or job control tooling visible to other local users or administrators. In the context of a memory restore utility, disclosure of this password can allow unauthorized decryption of backup data and compromise the confidentiality of stored agent memory.
- Content