ClawHub
Back to skill

Security audit

basic-memory

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed memory-management skill that persists user context locally, but it may save personal details automatically unless the user limits that behavior.

Install this only if you want your agent to keep structured memory across conversations. Review the auto-save behavior first if you prefer explicit approval before storing names, family details, locations, preferences, project context, or inferred patterns.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

High
Confidence
91% confidence
Finding
Automatically activating at the start of every session lacks scope constraints and may cause the agent to process prior memory even when irrelevant to the current conversation. This expands privacy exposure and can surface or act on stored context unexpectedly, especially in shared or sensitive environments.

Vague Triggers

Medium
Confidence
91% confidence
Finding
Automatically activating at the start of every session lacks scope constraints and may cause the agent to process prior memory even when irrelevant to the current conversation. This expands privacy exposure and can surface or act on stored context unexpectedly, especially in shared or sensitive environments.

Ssd 3

Medium
Confidence
97% confidence
Finding
The skill explicitly says to save information even if the user does not ask, including personal details and contextual facts shared during conversation. Persisting user data without explicit consent creates privacy and data-minimization risks, particularly for identity, employment, location, and family information.

Ssd 3

Medium
Confidence
98% confidence
Finding
The auto-save table directs the agent to collect and persist identity and relationship details such as name, job, company, location, and family. Even with a prohibition on passwords and similar secrets, this still encourages long-term storage of personal data that may be sensitive, unnecessary, or unexpected from the user's perspective.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.