ClawHub
Back to skill

Security audit

journal-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a remote journaling-memory helper, but it encourages automatic storage and recall of potentially sensitive journal and conversation content without clear consent or minimization controls.

Install only if you intentionally want journal entries and interaction summaries sent to BlueColumn/Supabase for persistent searchable memory. Before using it, require per-entry approval, review the exact payload, avoid secrets or regulated personal data, and confirm how stored memories can be inspected, deleted, and kept separate from trusted instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Error
Location
SKILL.md:9
Finding

Automatic Transmission of Sensitive Journal and Conversation Data to an External Service

Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{"text": "Journal 7/31: launched the memory company strategy, feeling good about ClawHub push.", "title": "journal-memory - note"}' ``` ## Quick note ```bash curl -X POST .../agent-note \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"text": "Journal 7/31: launched the memory company strategy, feeling good about ClawHub push.", "tags": ["journal-memory"]}' ``` ## Recall ```bash curl -X POST .../agent-recall \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"q": "What did I journal about last week?"}' ``` ## Workflow 1. On new context, first recall: `What did I journal about last week?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember` ``` ### Technical Analysis The skill directs an agent to send journal entries and post-interaction summaries to a third-party Supabase endpoint using a BlueColumn API credential. The mandatory workflow states that the agent should store a summary after an interaction, while the broader description encourages it to “Store every thought.” No instruction requires informed user consent before transmission, limits storage to content explicitly selected by the user, or requires the removal of credentials, personal information, proprietary information, or other sensitive data. There are also no stated retention, deletion, access-control, or payload-review safeguards. Consequently, an agent following the skill may disclose ...[truncated 1676 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs agents to send journal content and recall queries to an external network endpoint using an API key, but it does not prominently warn that private thoughts, summaries, or personal context leave the local environment and become stored by a third party. In a journaling context, this is especially dangerous because entries are likely to contain sensitive personal, strategic, or confidential information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description is broad enough to trigger on many ordinary memory, recall, note-taking, or journaling requests, increasing the chance that an agent invokes it without clear user intent or informed consent. Because the skill transmits and persists user text to an external service, overbroad activation materially raises the risk of unnecessary disclosure and retention of sensitive data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The language 'Store every thought as searchable memory' encourages indiscriminate persistence of conversational or journal content, which creates unnecessary long-term retention of potentially sensitive data. Searchable memory amplifies disclosure risk because previously stored content may later be surfaced in unrelated contexts or to unintended workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This example explicitly demonstrates external transmission of journal text to a remote endpoint with bearer-token authorization. While external calls are expected for a memory service, the transmitted content is sensitive by nature, so without consent, redaction, and clear disclosure this constitutes a meaningful privacy and data-exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store

bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Journal 7/31: launched the memory company strategy, feeling good about ClawHub push.", "title": "journal-memory - note"}'

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow directs the agent to automatically recall prior journal entries to personalize responses and then store new summaries after each interaction, creating a compounding memory loop. This increases the chance of cumulative leakage, context mixing, and retention of sensitive user data beyond what is necessary for the current task.

Content

No source excerpt is available for this finding.