ClawHub
Back to skill

Security audit

github-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a GitHub memory helper, but it automatically stores repository and interaction summaries in a third-party persistent service without enough user control or data-safety limits.

Review this carefully before installing. Use it only if your organization permits GitHub workflow data to be sent to BlueColumn, and configure agents to ask before storing, redact secrets and private details, avoid source code or credentials, and confirm how stored memories can be reviewed and deleted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:9
Finding

Automatic Disclosure and Persistent Storage of Potentially Sensitive Context

Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{"text": "PR #88: adds recall streaming. Reviewers: Alex, Sam. Merged 7/29.", "title": "github-memory - note"}' ``` ## Quick note ```bash curl -X POST .../agent-note \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"text": "PR #88: adds recall streaming. Reviewers: Alex, Sam. Merged 7/29.", "tags": ["github-memory"]}' ``` ## Recall ```bash curl -X POST .../agent-recall \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"q": "What PRs are waiting on review?"}' ``` ## Workflow 1. On new context, first recall: `What PRs are waiting on review?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember` ## Docs Full API reference: https://bluecolumn.ai/docs — fields are `text`, `q`, `tags` (not `content`/`query`/`note`). ``` ### Technical Analysis The prescribed workflow directs the agent to persist a summary after an interaction without requiring explicit approval for each upload. Interaction summaries involving GitHub issues and pull requests may include private repository metadata, contributor identities, code details, internal URLs, or other confidential conversation content. The data is transmitted to a third-party Supabase function endpoint using a bearer credential and retained as persistent vector memory. The skill does not specify: - Which fields may be included in a summary. - Secret or personal-data redaction requirements. - Restrictions aga ...[truncated 2051 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly tells agents to remember GitHub issues, PRs, and interaction context in BlueColumn persistent memory, but it does not warn that this data is sent to and retained by a third-party service. This creates a privacy and data-governance risk because repository context, internal workflow details, or user interaction summaries may be exfiltrated outside the primary system without informed consent or data minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setup and workflow sections provide concrete instructions and API examples for sending content to an external endpoint, including GitHub-related notes and post-interaction summaries, without any safety notice about external transmission or persistence. In context, this is more dangerous because the skill is specifically designed to accumulate operational memory over time, increasing the chance that sensitive repository metadata or internal collaboration details are stored off-platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The curl example demonstrates direct transmission of repository workflow information to an external service using a bearer token. External transmission is expected for this skill's functionality, but it is still a real security concern because the example normalizes sending potentially sensitive project context to a third party without discussing trust boundaries, retention, or filtering of sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store

bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "PR #88: adds recall streaming. Reviewers: Alex, Sam. Merged 7/29.", "title": "github-memory - note"}'