ClawHub
Back to skill

Security audit

ForesigxtMemory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is coherent and not malicious, but it should be reviewed because it relies on unpinned global third-party installs that will handle persistent private memory data.

Review before installing. Prefer pinned versions or a local sandboxed install, verify the npm package and qmd source you will run, keep the vault scoped to non-sensitive data unless you trust the tools, confirm whether embedding/search sends vault content to any external service, and back up before migration or auto-linking operations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
INSTALL.md:3
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: INSTALL.md:3-7
Additional Location: SKILL.md:13-17
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash
npm install -g @foresigxt/foresigxt-cli-memory

Technical Analysis

The installation documentation directs users to globally install @foresigxt/foresigxt-cli-memory without specifying an exact version or verifying package integrity. Consequently, the package manager resolves the dependency to whichever release is current when the command is run.

The executable source of this package is not included in the audited artifact, so its installation scripts and runtime behavior could not be independently reviewed. A compromised npm package, maintainer account, publishing token, or future release could introduce attacker-controlled installation or runtime code after this Skill has already been reviewed.

The global installation scope increases exposure by placing the executable in the user's global command environment. The command does not itself request elevated privileges, so the resulting privileges ordinarily remain those of the invoking user.

Attack Path

  1. An attacker compromises the package publisher, npm account, publishing token, or upstream release process.
  2. The attacker publishes a malicious version under the existing package name.
  3. A user follows the Skill documentation and runs the unpinned installation command.
  4. npm resolves the package to the malicious current release.
  5. Package lifecycle scripts may execute during installation, or malicious behavior may execute when the user invokes fsxmemory.
  6. The malicious package operates with the invoking user's permissions and may access files available to that account, including configured memory vaults and workspace data.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user performing the inst ...[truncated 568 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the package to an explicitly reviewed version:
    bash
    npm install -g @foresigxt/foresigxt-cli-memory@1.3.1
  2. Publish and document expected package integrity hashes or signed release provenance.
  3. Verify npm provenance and maintain reproducible release artifacts.
  4. Prefer project-local installation over global installation:
    bash
    npm install --save-exact @foresigxt/foresigxt-cli-memory@1.3.1
  5. Commit an appropriate lockfile when distributing the dependency through a project.
  6. Disable lifecycle scripts during initial inspection where practical:
    bash
    npm install --ignore-scripts --save-exact @foresigxt/foresigxt-cli-memory@1.3.1
  7. Audit lifecycle scripts and executable source before enabling or invoking the package.
  8. Run the CLI under least privilege and restrict its vault path to data that it legitimately requires.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:244
Finding

Mutable GitHub Dependency Installed Globally Through Bun

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:244-253
Vulnerability Type: Globally installed dependency sourced from a mutable GitHub reference
Risk Level: Medium

Vulnerable Code

bash
# Install qmd
bun install -g github:tobi/qmd

# Add vault as collection
qmd collection add /path/to/vault --name my-memory --mask "**/*.md"

# Update index
qmd update && qmd embed

Technical Analysis

The documentation installs qmd directly from the github:tobi/qmd repository without specifying an immutable commit hash or signed release. The effective dependency can therefore change as the repository's default branch changes.

The installed tool is subsequently instructed to index and embed all Markdown files in the configured memory vault. If the repository, maintainer account, or default branch were compromised, malicious code could be delivered to users who run the documented installation command. Because the tool is globally installed and later receives broad access to the vault, a compromised version could read or alter indexed documents within the invoking user's access boundaries.

No malicious code from qmd is present in the audited artifact, and this finding does not establish that the referenced repository is currently compromised. It identifies an unsafe and mutable dependency acquisition method.

Attack Path

  1. An attacker compromises the referenced GitHub repository, a maintainer account, or the repository's release workflow.
  2. The attacker modifies the default branch or dependency metadata to include malicious code.
  3. A user runs bun install -g github:tobi/qmd.
  4. Bun retrieves the current repository state rather than a previously reviewed immutable revision.
  5. Malicious lifecycle behavior may execute during installation, or malicious logic executes when qmd is invoked.
  6. The user runs qmd collection add, qmd update, or qmd embed, granting the compromised tool access to Markdown documents in the selected vaul ...[truncated 746 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the GitHub dependency to a reviewed immutable commit:
    bash
    bun install -g github:tobi/qmd#<full-reviewed-commit-sha>
  2. Prefer a signed, versioned package release with published checksums and provenance.
  3. Avoid global installation where a project-local or isolated execution environment is sufficient.
  4. Review package lifecycle scripts and transitive dependencies before installation.
  5. Execute indexing in a sandbox or container with read-only vault access unless modification is explicitly required.
  6. Limit the collection path and file mask to the minimum necessary data.
  7. Document whether embedding or search operations send content to external services; require explicit user approval before any remote transfer.
  8. Periodically re-review and deliberately update the pinned revision rather than tracking a mutable branch automatically.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 18)May include surrounding context.

md
## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md
## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md
## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md
## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md
## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md
- `SKILL.md` - Complete documentation and reference

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

For isolated workspace memory (each workspace has its own vault):

bash
# Create .env in workspace root
echo 'FSXMEMORY_PATH=/path/to/workspace/memory' > .env

# All agents in THIS workspace use this isolated vault

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

Migration flags

--dry-run # Preview changes without modifying files --backup # Create backup before migration (recommended) --force # Skip confirmation prompts --verbose # Show detailed progress --rollback # Restore from last backup

text

Static analysis

No suspicious patterns detected.