ClawHub
Back to skill

Security audit

learning-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a learning-memory integration, but it can automatically send and store conversation summaries in an external service without clear consent or data limits.

Review before installing. Use it only if you are comfortable with learning notes and summaries being sent to BlueColumn/Supabase-backed persistent storage, and require explicit approval plus redaction before saving anything sensitive or unrelated to learning.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:9
Finding

Unscoped Automatic External Data Persistence

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–40
Vulnerability Type: Unconsented external collection and persistence of conversation-derived data
Risk Level: Medium

Relevant Code Snippet:

markdown
## Setup
Read `TOOLS.md` or the platform secret store for the BlueColumn API key (`bc_live_*`). Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1`
markdown
## Workflow
1. On new context, first recall: `What have I been learning and what stuck?`
2. Use the answer to personalize the response
3. After the interaction, store the summary via `/agent-remember`

Technical Analysis

The workflow instructs the agent to retrieve an API credential from TOOLS.md or the platform secret store and communicate with an external Supabase endpoint. It then mandates recalling previously stored information whenever a new context begins and uploading an interaction summary afterward.

The storage instruction contains no explicit-consent requirement, data minimization rule, scope restriction, or redaction requirement. In particular, it does not limit summaries to learning-related information selected by the user or prohibit the inclusion of credentials, personal information, or unrelated conversation content. The documentation also does not specify retention, deletion, or access-control behavior for uploaded records.

Although persistent memory is consistent with the stated purpose of the Skill, automatic upload after every interaction creates a risk of excessive external data collection. The configured destination is an opaque Supabase project URL rather than the visible bluecolumn.ai domain, so its ownership and trust relationship should be independently verified.

Attack Path

  1. The Skill is activated for a learning-memory interaction.
  2. The agent reads a bc_live_* API key from TOOLS.md or the platform secret store.
  3. The agent sends a recall request to the configur ...[truncated 1143 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user consent before the first recall operation and before storing any interaction-derived information.
  2. Replace automatic post-interaction storage with an opt-in workflow that displays or clearly describes the information to be stored.
  3. Restrict stored content to user-selected learning notes and prevent unrelated conversation context from entering summaries.
  4. Apply deterministic redaction for API keys, authentication tokens, passwords, personal information, and other sensitive values before transmission.
  5. Define strict allowlisted fields, maximum record sizes, and validation rules for all outbound requests.
  6. Document retention periods, deletion procedures, tenant isolation, data-processing terms, and who can access stored records.
  7. Verify and document that xkjkwqbfvkswwdmbtndo.supabase.co is an authorized BlueColumn-controlled endpoint. Prefer a verified first-party domain where possible.
  8. Use a narrowly scoped API credential that can access only the necessary memory records and endpoints. Do not expose the credential in prompts, logs, summaries, or responses.
  9. Provide independent controls for recall and storage so users can use the Skill without automatically enabling both operations.
  10. Clearly notify users whenever information is transmitted to or retrieved from external persistent storage.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description uses broad activation criteria like 'when an agent tracks learning and skill growth' and 'store, recall, or search learning memory context,' which can cause the agent to invoke the skill for a wide range of conversations without clear user consent boundaries. In a memory skill backed by an external service, ambiguous triggering increases the chance that sensitive personal learning history or conversational content is stored or recalled unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation instructs sending learning notes and recall queries to BlueColumn, an external persistence service, but does not provide any user-facing privacy warning or data-sharing notice. This is dangerous because users may not realize their educational history, notes, or derived summaries are being transmitted and retained by a third party, creating privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill explicitly demonstrates transmitting user-derived content via a POST request to an external endpoint using a bearer token. In context, external transmission is the core function of the skill, but it still creates a real security and privacy risk if agents send conversation summaries or learning notes without strict consent, minimization, and handling controls.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store

bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Completed: 'Prompt Engineering' course. Key lessons: chain-of-thought, few-shot.", "title": "learning-memory - note"}'