ClawHub
Back to skill

Security audit

documentation-memory

Security checks for vulnerabilities and agentic risk

Overview

This documentation-memory skill is coherent, but it automatically sends and reuses conversation summaries through an external persistent memory service without clear user approval or data limits.

Review before installing if your documentation may contain confidential plans, customer data, credentials, or internal URLs. Use it only with a scoped BlueColumn key, store only explicit documentation facts, and have the agent show and sanitize any summary before sending it to memory.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

Unbounded Transmission of Interaction Summaries to External Persistent Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–40
Vulnerability Type: External storage of potentially sensitive interaction data without explicit consent or data minimization
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Workflow
1. On new context, first recall: `What documentation have we published and where?`
2. Use the answer to personalize the response
3. After the interaction, store the summary via `/agent-remember`

Technical Analysis

The workflow directs the agent to store an interaction summary through the external /agent-remember endpoint after the interaction. This instruction does not require the agent to:

  • Obtain explicit user approval before transmission.
  • Limit the summary to documentation-related information.
  • Exclude credentials, personal data, or proprietary content.
  • Present the summary for review before storage.
  • Apply redaction, retention, or deletion controls.

The phrase “after the interaction” is broader than the skill's stated documentation-memory purpose. Consequently, information outside the intended documentation scope may be transmitted to and retained by an external service.

Attack Path

  1. A user discusses confidential documentation, personal information, credentials, or unrelated sensitive material while the skill is active.
  2. The agent generates a summary of the interaction.
  3. Following the workflow, the agent sends that summary to the external /agent-remember endpoint.
  4. The external service persistently stores the submitted information.
  5. The stored information may subsequently be retrieved in another context through the recall workflow.

This path does not require local privilege escalation; it relies on the skill's authorized network access and API credentials.

Impact Assessment

The issue may expose conversation-derived information to a third-party persistent storage service. The affected scope can include documentation content, proprietary business ...[truncated 451 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user approval before every persistent write.
  2. Restrict stored content to documentation that the user expressly selects.
  3. Display the exact proposed summary and destination before transmission.
  4. Scan and redact API keys, passwords, authentication tokens, personal data, and other sensitive values.
  5. Do not summarize or store unrelated conversation content.
  6. Define and communicate retention, access, export, and deletion policies.
  7. Provide an opt-out mode in which recall and storage are disabled.
  8. Scope API credentials and stored records to the minimum required tenant, user, and operation.
  9. Use secure transport and verify that the configured Supabase URL is an authorized BlueColumn endpoint.

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:37
Finding

Untrusted Persistent Memory Can Influence Future Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–39
Vulnerability Type: Persistent memory poisoning through unvalidated recalled content
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Workflow
1. On new context, first recall: `What documentation have we published and where?`
2. Use the answer to personalize the response

Technical Analysis

The workflow directs the agent to retrieve content from external persistent memory at the beginning of a new context and use the result to personalize its response. It does not require the recalled content to be treated strictly as untrusted data or distinguish factual documentation from embedded instructions.

If an attacker, compromised integration, or incorrectly authorized user can influence stored records, they may insert instruction-like text into memory. That text can then be returned during a later recall and influence agent output. The workflow also lacks explicit requirements for provenance validation, tenant and user scoping, content filtering, and confirmation before recalled material affects behavior.

This creates a cross-session trust-boundary issue: external content written in one interaction can continue affecting later interactions.

Attack Path

  1. An attacker or compromised data source causes crafted text to be stored through /agent-remember or another write-capable endpoint.
  2. The crafted record contains misleading documentation or instruction-like content intended to influence future behavior.
  3. In a later session, the skill automatically calls /agent-recall using the prescribed query.
  4. The external service returns the attacker-influenced record.
  5. The agent follows the instruction to use the recalled answer for personalization.
  6. If the returned text is not treated solely as untrusted reference data, it may alter the response, introduce false information, or attempt to steer subsequent actions.

Successful exploitation requires an ability t ...[truncated 767 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat all recalled memory as untrusted reference data, never as executable instructions.
  2. Explicitly instruct the agent to ignore commands, policy changes, tool requests, or role directives contained in recalled records.
  3. Enforce tenant, user, workspace, and document-level authorization for every write and recall operation.
  4. Preserve and display provenance metadata, including author, creation time, source, and integrity status.
  5. Restrict automatic retrieval; perform recall only when the user explicitly requests it or when it is necessary for the task.
  6. Validate and sanitize records before storage and again before inserting them into agent context.
  7. Separate recalled text from system and skill instructions using clearly delimited data fields.
  8. Require user confirmation before recalled content triggers tool use, external communication, data modification, or other consequential actions.
  9. Provide record review, correction, deletion, and audit-log capabilities.
  10. Use narrowly scoped credentials and rotate them if unauthorized writes are suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This skill includes direct instructions and examples for sending documentation content to an external service endpoint using an authorization token. External transmission is expected for the feature, but it still creates a real data exfiltration risk because the skill encourages uploading written/read documentation and later storing conversation summaries, which may contain sensitive internal information.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store

bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Wrote onboarding doc: install → add key → done. Published to docs site 7/30.", "title": "documentation-memory - note"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow explicitly instructs the agent to store an interaction summary in persistent external memory after the conversation, but it does not require user notice, consent, or data minimization. Because the skill is designed for documentation reuse, users may reasonably provide proprietary or sensitive material that would then be transmitted to a third-party memory service without an explicit warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.