ClawHub
Back to skill

Security audit

Ai Sidekick

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it gives the agent broad authority to persist user and operational memory without enough consent or protection.

Install only if you want this skill to manage long-term agent memory and behavior files. Before using it, require approval for every write to USER.md, MEMORY.md, SOUL.md, logs, cron tasks, or backups; avoid storing credential paths or other sensitive operational details; and review backup permissions or encryption.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:76
Finding

Unvalidated Conversation Content Can Poison Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76-80 and 100-115
Vulnerability Type: Persistent memory poisoning through automatic, unvalidated updates
Risk Level: Medium

Vulnerable Skill Instructions

The following is an English translation of the relevant source instructions:

markdown
### 2.2 Automatic update rules

Whenever the following is learned during a conversation:
- New project direction or technology stack → update USER.md
- Explicit preference, such as "do not use tables; use lists" → record it in USER.md
- Disliked behavior, such as "dislikes verbose AI responses" → record it in USER.md
markdown
### 3.2 Long-term memory (MEMORY.md)

Located in the workspace root and loaded only in the main session.

Structure:
- User identity and preferences: essential information that must not be forgotten
- Experience and decisions: accumulated project experience, technical decisions, and lessons learned
- Tool usage records: API key locations, certificate paths, and similar information
- Security rules: security requirements explicitly specified by the user

### 3.3 Memory update triggers

| Scenario | Action |
|---|---|
| End of each day | Write the daily log |
| New issue or solution discovered | Immediately update MEMORY.md |
| Explicit user preference | Immediately update USER.md |
| Major project decision | Write to the log and update MEMORY.md |

Technical Analysis

The Skill instructs the agent to persist information derived from conversations automatically and immediately. It does not require owner confirmation, provenance verification, trust-level checks, sanitization, or separation between descriptive facts and behavioral instructions.

USER.md and MEMORY.md are subsequently loaded into main sessions. Consequently, attacker-controlled text recorded during one session can become trusted context in later sessions. The risk is especially signif ...[truncated 1736 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit workspace-owner approval before writing conversation-derived information to USER.md or MEMORY.md.
  2. Treat all conversation content as untrusted data rather than executable or authoritative instructions.
  3. Store memory in a structured format with fields for source, author, timestamp, confidence, trust level, and approval status.
  4. Prohibit memory entries from modifying system policy, security boundaries, tool permissions, or instruction priority.
  5. Separate factual project notes from behavioral preferences and security policy.
  6. Allow only authenticated owners to create or modify security-related memory entries.
  7. Sanitize free-form text and reject embedded directives, prompt-injection language, shell commands, and requests to override higher-priority instructions.
  8. Present proposed memory changes as a diff and require confirmation before committing them.
  9. Maintain version history and provide a review, deletion, and rollback mechanism.
  10. On session startup, load persistent memory as reference data with lower trust than system and developer instructions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:90
Finding

Sensitive Metadata Is Retained and Backed Up Without Explicit Confidentiality Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 90-132
Vulnerability Type: Excessive sensitive-data retention and insufficiently protected local backups
Risk Level: Medium

Vulnerable Skill Instructions

The following is an English translation of the relevant source instructions:

markdown
After each important conversation, record:
- Decisions that were made
- Problems encountered and their solutions
- Important information disclosed by the user
markdown
Structure:
- User identity and preferences
- Experience and decisions
- Tool usage records: API key locations, certificate paths, and similar information
- Security rules
bash
# scripts/backup_memory.sh
#!/bin/bash
WORKSPACE="$HOME/.qclaw/workspace-agent-37058ef3"
BACKUP_DIR="$HOME/.qclaw/backups"
mkdir -p "$BACKUP_DIR"
DATE=$(date +%Y%m%d_%H%M%S)
tar czf "$BACKUP_DIR/memory_${DATE}.tar.gz" \
  "$WORKSPACE/MEMORY.md" \
  "$WORKSPACE/memory/" 2>/dev/null
echo "Backup completed: $BACKUP_DIR/memory_${DATE}.tar.gz"

Technical Analysis

The Skill recommends retaining broadly defined “important information” disclosed by the user and explicitly includes API-key locations and certificate paths in long-term memory. Even when actual credentials are not stored, precise credential and certificate locations constitute sensitive operational metadata that can facilitate later credential discovery.

The backup example archives all long-term and daily memory into an unencrypted tar.gz file. It does not set a restrictive umask, explicitly restrict archive or directory permissions, encrypt the archive, verify ownership, enforce a retention period, or protect against accidental synchronization and sharing.

The exact file permissions depend on the host's existing umask, so the archive is not necessarily accessible to other users on every system. However, the script does not establish the confidentiality gua ...[truncated 1833 chars]

Remediation
View remediation

Remediation Suggestions

  1. Apply data minimization: define precisely which information may be retained and exclude unrelated user disclosures.
  2. Never store credentials, secret values, recovery material, private keys, or exact credential locations in general-purpose memory.
  3. Obtain explicit user consent before retaining personal or security-sensitive information.
  4. Add automatic redaction for API keys, tokens, passwords, private-key material, certificate secrets, and sensitive filesystem paths.
  5. Set restrictive permissions before creating backup content:
    bash
    umask 077
install -d -m 700 "$BACKUP_DIR"
  6. Create archives with owner-only access and verify permissions after creation:
    bash
    chmod 600 "$BACKUP_DIR/memory_${DATE}.tar.gz"
  7. Encrypt backups with an authenticated encryption mechanism and keep encryption keys outside the archive directory.
  8. Verify that the workspace and backup directory are owned by the expected account and are not symbolic links before writing.
  9. Implement bounded retention, automatic expiration, and secure deletion of obsolete archives.
  10. Exclude backup archives from cloud synchronization, source control, diagnostic bundles, and routine file sharing unless the user explicitly approves.
  11. Document a restore process that preserves restrictive permissions and does not overwrite memory without confirmation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger conditions include very broad phrases such as '配置 AI', '训练 AI', '安全设置', and '优化 AI', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. Because this skill governs memory, behavior rules, and safety settings, accidental activation could lead to unintended configuration changes or over-collection of user context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
75% confidence
Finding

L067 使用固定时区示例“Asia/Shanghai”，结合全文中文化表述，容易将特定语言/地区设置默认化。若技能面向通用用户而未明确允许自定义语言/地区，可能构成未获用户选择的语言或 locale 偏向。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs automatic updating of USER.md based on newly learned preferences and dislikes, but it does not require explicit consent, notice, or review before persisting personal information. This creates a privacy risk because users may reveal information conversationally without understanding it will be stored long-term.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directs the agent to persistently record user-revealed information, including project decisions, preferences, and even operational details like API key locations and certificate paths in long-term memory. Persistent storage of sensitive operational metadata increases the blast radius of prompt injection, local compromise, accidental disclosure, and unauthorized reuse across sessions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
- 用户要安装新 Skill → 提醒先扫描
- 用户要发送敏感信息 → 提醒使用安全通道
- 用户配置 API Key → 建议用 keychain/环境变量
- 用户要执行高危命令（rm -rf、sudo 等）→ 显式确认

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L255 在 cron 配置中直接指定“tz: Asia/Shanghai”，属于明确的 locale 固定。文档未说明这是示例值，也未要求根据用户时区调整，可能导致技能默认采用特定地区设置而未获得用户选择。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The recommendation to periodically clean old memory logs lacks an accompanying warning about irreversible deletion, retention requirements, or backup verification. In a memory-management skill, this can cause unintended loss of important historical context or user data.

Content

No source excerpt is available for this finding.