ClawHub
Back to skill

Security audit

remember-coding-sessions

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed coding-session memory helper that sends user-chosen notes to an external BlueColumn/Supabase API.

Install this only if you are comfortable sending coding-session notes, architecture decisions, TODOs, and handoff summaries to the BlueColumn service. Avoid including secrets, credentials, customer data, proprietary source code, or sensitive internal details unless your organization has approved that use, and keep the API key in a secure environment variable or secrets manager.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to send coding-session content such as architecture decisions, TODOs, and handoff notes to a remote third-party API, but it does not warn that these notes may contain proprietary source context, internal design details, or sensitive project metadata. In this context, the danger is unintentional data exfiltration: normal use of the skill encourages exporting development context outside the local environment without requiring consent, minimization, or classification of what is safe to share.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This command performs an outbound HTTPS POST containing project decision records to an external endpoint. Because the payload is specifically development context intended to preserve continuity, it is likely to include sensitive internal architecture, task status, and implementation reasoning; the skill encourages this transfer without safeguards, redaction guidance, or user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

When a meaningful choice is made (library, schema, pattern), store the decision, the reason, and the rejected alternatives.

bash
curl -X POST https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-remember \
  -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "DECISION: use SQLite for the sync cache. Reason: zero-ops, local-first. Rejected: Postgres (too heavy for a client cache), Redis (extra process). Date: 2026-07-31.", "title": "arch - sync cache storage"}'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill requires a live API key and shows it being used in shell commands, but it provides no guidance on secure credential handling. This can lead to accidental exposure through shell history, terminal logging, screenshots, CI logs, or reuse of overprivileged long-lived tokens.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.