ClawHub
Back to skill

Security audit

memos-memory-guide

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed memory guide, but it deserves review because it also instructs agents to write public memories and install or publish skills persistently without clear user confirmation.

Install only if you are comfortable with the agent searching long-term conversation history and using public cross-agent memory. Before use, require explicit user confirmation for any public memory write, skill installation, publishing, or unpublishing, and avoid using it for sensitive prior conversations unless the user clearly asks for that lookup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is presented as a memory-recall guide, but its activation text and tool list also encourage use of skill discovery, installation, and publishing capabilities unrelated to simple past-conversation retrieval. This broadens the operational scope of the skill and can cause the agent to invoke higher-risk capability-transfer actions in contexts where only memory lookup was expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance says to use the skill whenever the user refers to past chats, preferences, or history, which is broad enough to trigger memory access during many ordinary conversations. That increases the likelihood of unnecessary retrieval of sensitive historical content and normalizes memory use without a clear need-to-know threshold.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill does not warn that searching past conversations may surface sensitive historical data or that public memories are visible across agents. Without disclosure and consent language, users may not realize their request could trigger retrieval or sharing beyond the immediate conversation context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly expands from personal conversation history into cross-agent knowledge sharing and public skill discovery. That scope expansion increases the chance that information learned in one context is propagated or that unrelated public capabilities are introduced, which exceeds the least-privilege expectations for a memory helper.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
## How memory is provided each turn

- **Automatic recall (hook):** At the start of each turn, the system runs a memory search using the user's current message and injects relevant past memories into your context. You do not need to call any tool for that.
- **When that is not enough:** If the user's message is very long, vague, or the automatic search returns **no memories**, you should **generate your own short, focused query** and call `memory_search` yourself.
- **Memory isolation:** Each agent can only see its own memories and memories marked as `public`. Other agents' private memories are invisible to you.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Installing and publishing skills creates persistence and expands future agent capabilities, which is materially different from transient memory recall. Embedding these actions in a memory-oriented guide risks silent capability creep and can lead to unreviewed reuse or distribution of skills outside the user's immediate request.

Content

No source excerpt is available for this finding.