ClawHub
Back to skill

Security audit

Vestige

Security checks for vulnerabilities and agentic risk

Overview

This is a local persistent-memory skill, but it encourages broad automatic saving and automatic recall without enough consent or safety boundaries.

Install only if you are comfortable with a local memory system that may save and later reuse conversation details. Before use, require explicit confirmation before saving memories, avoid storing secrets or sensitive personal data, review/delete stored entries regularly, and treat recalled memories as untrusted notes rather than instructions that override the current user request or system rules.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:67
Finding

Persistent User-Controlled Content Can Poison Future Agent Sessions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–89
Vulnerability Type: Persistent memory poisoning
Risk Level: Medium

Vulnerable Code

markdown
## Trigger Words

| User Says | Action |
|-----------|--------|
| "Remember this" | `smart_ingest` immediately |
| "Don't forget" | `smart_ingest` with high priority |
| "I always..." / "I never..." | Save as preference |
| "I prefer..." / "I like..." | Save as preference |
| "This is important" | `smart_ingest` + `promote_memory` |
| "Remind me..." | Create `intention` |

## Session Start Routine

At the start of conversations, search for relevant context:

```bash
# Search user preferences
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search","arguments":{"query":"user preferences instructions"}}}' | ~/bin/vestige-mcp 2>/dev/null | jq -r '.result.content[0].text'

# Search project context
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search","arguments":{"query":"current project context"}}}' | ~/bin/vestige-mcp 2>/dev/null | jq -r '.result.content[0].text'
text

### Technical Analysis

The skill directs the agent to persist broadly defined, user-controlled statements as preferences or important memories. It then searches persistent storage at the beginning of subsequent conversations using a query that explicitly includes the term `instructions`.

No trust boundary, provenance check, session scope, confirmation step, or instruction/data separation is defined. Consequently, an attacker can phrase behavioral directives as preferences and cause them to be stored. When those records are retrieved in a later session, instruction-like memory content may be introduced into the agent's context and treated as authoritative user guidance.

Semantic search increases this risk because a malicious record does not need to match the startup query exactly. It only needs to be sufficiently related to
...[truncated 1389 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation before saving preferences, behavioral rules, or instruction-like content.
  2. Do not use generic startup searches for instructions. Retrieve narrowly scoped facts relevant to the active task.
  3. Store provenance metadata, including the originating user, session, project, timestamp, and whether persistence was explicitly approved.
  4. Treat all retrieved memories as untrusted quoted data, never as executable instructions.
  5. Explicitly state that memories cannot override system instructions, developer instructions, current-session user requests, or safety policies.
  6. Separate factual memories, preferences, reminders, and behavioral directives into distinct schemas with different trust policies.
  7. Scope memory searches to the current user and project to prevent cross-user or cross-project contamination.
  8. Reject or quarantine records containing tool directives, policy overrides, credential requests, or instructions to ignore higher-priority rules.
  9. Provide mechanisms to review, edit, expire, and delete stored records before they are loaded into future sessions.
  10. Limit the number and size of retrieved records, and present their source and age when adding them to agent context.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:96
Finding

Unescaped Shell Arguments Are Embedded Directly into JSON-RPC Requests

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96–116
Vulnerability Type: JSON injection through unsafe string construction
Risk Level: Medium

Vulnerable Code

bash
#!/bin/bash
# Vestige Memory Helper
ACTION=$1
shift

case $ACTION in
  search)
    echo "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"search\",\"arguments\":{\"query\":\"$*\"}}}" | ~/bin/vestige-mcp 2>/dev/null | jq -r '.result.content[0].text // .error.message'
    ;;
  save)
    echo "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"smart_ingest\",\"arguments\":{\"content\":\"$*\"}}}" | ~/bin/vestige-mcp 2>/dev/null | jq -r '.result.content[0].text // .error.message'
    ;;
  stats)
    ~/bin/vestige stats
    ;;
  *)
    echo "Usage: vmem [search|save|stats] [content]"
    ;;
esac

Technical Analysis

The helper script places $* directly inside a double-quoted JSON string without applying JSON escaping. Input containing quotation marks, backslashes, newlines, control characters, or JSON delimiters can break the intended string boundary and produce malformed or structurally altered JSON-RPC input.

This is a JSON injection issue at the boundary between the shell helper and vestige-mcp. It is not, by itself, direct shell command injection: shell metacharacters introduced through ordinary parameter expansion are not reparsed as shell syntax. However, crafted values can still change how the downstream JSON parser interprets the request, cause denial of service through parsing failures, or make the stored or searched value differ from the caller's intent.

The precise ability to override fields depends on the JSON parser's handling of malformed data and duplicate object keys in the externally installed vestige-mcp binary. That binary is not included in the audited project, so stronger downstream effects cannot be confirmed.

Attack Pa

...[truncated 1169 chars]

Remediation
View remediation

Remediation Suggestions

Construct JSON with a dedicated serializer rather than shell string interpolation. For example:

bash
#!/bin/bash
ACTION=$1
shift

case "$ACTION" in
  search)
    jq -n --arg query "$*" \
      '{jsonrpc:"2.0", id:1, method:"tools/call",
        params:{name:"search", arguments:{query:$query}}}' |
      ~/bin/vestige-mcp 2>/dev/null |
      jq -r '.result.content[0].text // .error.message'
    ;;
  save)
    jq -n --arg content "$*" \
      '{jsonrpc:"2.0", id:1, method:"tools/call",
        params:{name:"smart_ingest", arguments:{content:$content}}}' |
      ~/bin/vestige-mcp 2>/dev/null |
      jq -r '.result.content[0].text // .error.message'
    ;;
  stats)
    ~/bin/vestige stats
    ;;
  *)
    echo "Usage: vmem [search|save|stats] [content]" >&2
    exit 2
    ;;
esac

Additional hardening should include:

  1. Quote "$ACTION" consistently.
  2. Validate required arguments and reject missing content.
  3. Apply reasonable input-size limits to prevent memory or parser exhaustion.
  4. Check pipeline exit statuses and report malformed responses rather than suppressing all diagnostics.
  5. Use set -o pipefail so failures in jq or vestige-mcp are not hidden.
  6. Add tests covering quotation marks, backslashes, newlines, Unicode, control characters, and JSON-looking input.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly promotes persistent storage of user preferences, bug fixes, project patterns, reminders, and other conversational material across sessions, but it does not clearly warn users about retention, sensitivity, or review/deletion controls. Because the skill is designed for durable memory, omission of these safeguards materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file encourages broad, always-on retention of cross-session conversational information, including preferences and project details, in natural language. This is a genuine data retention vulnerability because such memory can accumulate sensitive material and later be surfaced in unintended contexts, especially when no minimization or sensitivity boundaries are described.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad everyday language such as "Remember this," "I prefer...," and "This is important," which can cause the agent to store ordinary conversational content without an explicit, contextual consent step. In a memory skill whose purpose is persistent cross-session recall, this creates a real risk of unintentionally capturing sensitive or private information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger-word table semantically instructs automatic saving of broad classes of user statements, including preference and reminder phrasing that commonly appears in normal conversation. This is more dangerous in this skill's context because the storage is persistent and automatic, so private facts, operational details, or sensitive intentions may be captured and retained without a deliberate storage decision.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The session-start routine instructs automatic retrieval of stored user preferences and instructions at the beginning of conversations, increasing the chance that previously retained sensitive context is exposed or influences responses inappropriately. In a persistent memory system, automatic recall amplifies the harm from over-collection by making old private data routinely accessible and reusable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.