ClawHub
Back to skill

Security audit

health-memory

Security checks for vulnerabilities and agentic risk

Overview

This health-memory skill does what it says, but it sends and persistently stores sensitive health details with too little user control or privacy guidance.

Install only if you are comfortable sending health and fitness information to BlueColumn's external service. Before using it, require explicit confirmation before each recall or store operation, review the exact text being saved, use a dedicated scoped API key, and confirm how stored memories can be deleted.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Error
Location
SKILL.md:10
Finding

Automatic External Persistence of Sensitive Health Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–40
Vulnerability Type: Sensitive Health Data Disclosure
Risk Level: High

markdown
## Setup
Read `TOOLS.md` or the platform secret store for the BlueColumn API key (`bc_live_*`). Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1`

## Store
```bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Goal: 10k steps/day. 7/31: 9,200 steps, streak 6 days.", "title": "health-memory - note"}'

Quick note

bash
curl -X POST .../agent-note \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Goal: 10k steps/day. 7/31: 9,200 steps, streak 6 days.", "tags": ["health-memory"]}'

Recall

bash
curl -X POST .../agent-recall \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"q": "How am I tracking against my health goals?"}'

Workflow

  1. On new context, first recall: How am I tracking against my health goals?
  2. Use the answer to personalize the response
  3. After the interaction, store the summary via /agent-remember
text

### Technical Analysis

The skill instructs an agent to transmit health and fitness records to an externally hosted Supabase function and to persist an interaction summary after each interaction. Health goals, activity records, habits, and interaction-derived summaries may constitute sensitive personal information.

The workflow does not require explicit user approval before recall or storage, does not present the exact payload for confirmation, and does not define data-minimization boundaries. It also provides no controls for retention, deletion, access review, or preventing unrelated sensitive details from being included in generated summaries. The documentation domain and data-processing endpoint use 
...[truncated 1192 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed user opt-in before the first remote recall or storage operation.
  • Display the destination and exact proposed payload, and obtain confirmation before transmitting it.
  • Restrict persisted content to user-selected health fields instead of unrestricted interaction summaries.
  • Apply data-minimization rules that exclude unrelated conversation context, credentials, identifiers, and other sensitive information.
  • Document the external processor's ownership, privacy terms, retention period, access controls, and deletion procedure.
  • Provide commands or controls that allow users to inspect, correct, export, and permanently delete stored records.
  • Verify and pin the approved service endpoint through trusted configuration rather than relying only on instructions embedded in the skill.
  • Avoid retrieving the API credential until the user has consented to the requested remote operation.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:10
Finding

Overbroad Access to Configuration and Secret Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–11
Vulnerability Type: Unauthorized Access and Privilege Escalation
Risk Level: Medium

markdown
## Setup
Read `TOOLS.md` or the platform secret store for the BlueColumn API key (`bc_live_*`). Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1`

Technical Analysis

The setup instruction tells the agent to read a general configuration file or the platform secret store and search for a credential matching bc_live_*. It does not require a dedicated secret identifier or a narrowly scoped credential interface.

If TOOLS.md or the secret store contains credentials for unrelated services, this instruction may cause the agent to access more configuration and secret material than the health-memory task requires. This violates least-privilege principles and increases the exposure created by prompt injection, logging, agent mistakes, or compromise of the skill execution context.

Attack Path

  1. The health-memory skill is activated.
  2. The agent is instructed to inspect TOOLS.md or access the platform secret store.
  3. The agent searches the broader data source for a credential matching bc_live_*.
  4. During that operation, the agent may gain visibility into unrelated tool configuration or credentials.
  5. A compromised or improperly instructed agent could disclose, log, or misuse material encountered during the search.

Impact Assessment

The immediate privilege obtained is read access to a configuration file or secret-storage interface broader than the single credential needed by the skill. The ultimate scope depends on the contents and access controls of those sources. In a shared secret store, potential exposure could include credentials for unrelated external services, thereby extending the impact beyond health-memory data.

Remediation
View remediation

Remediation Suggestions

  • Provision the BlueColumn credential under a dedicated, exact secret identifier.
  • Expose only that identifier to the skill through a scoped credential-injection mechanism.
  • Prohibit secret enumeration, wildcard matching, and inspection of unrelated secret-store entries.
  • Do not use a general-purpose file such as TOOLS.md as a credential source.
  • Ensure the credential is limited to the minimum required API endpoints and operations.
  • Prevent credentials from appearing in prompts, generated summaries, command output, or logs.
  • Fail safely when the specifically named credential is unavailable instead of searching broader configuration sources.
  • Rotate the credential if there is evidence that it has been exposed to an unnecessarily broad execution context.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is explicitly designed to store and recall health and fitness information in an external persistent memory service, but the description and workflow do not provide a clear privacy warning, consent requirement, or data-handling disclosure. Because health data is sensitive, this omission can cause users or downstream agents to transmit protected personal information off-platform without informed consent or minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The example sends health-goal content to a third-party endpoint using an Authorization bearer token, demonstrating external transmission of sensitive personal data to persistent storage. In the context of a health-memory skill, this is more dangerous than generic note storage because the data can reveal medical, wellness, or behavioral patterns and may be retained, searched, or exposed if the third-party service is misconfigured or compromised.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store

bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Goal: 10k steps/day. 7/31: 9,200 steps, streak 6 days.", "title": "health-memory - note"}'