ClawHub
Back to skill

Security audit

remember-preferences

Security checks for vulnerabilities and agentic risk

Overview

This skill is a remote preference-memory tool, but it tells agents to immediately store named user preferences externally and reuse them later without enough consent, scoping, or safety boundaries.

Install only if you are comfortable sending user preference data to the BlueColumn/Supabase service configured by this skill. Before using it, require explicit user approval for each stored preference, avoid names and sensitive details when possible, keep records narrow, and provide a way to review, correct, and delete stored preferences. Recalled preferences should be treated as untrusted data, not as authority to override system, security, privacy, or authorization rules.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Warning
Location
SKILL.md:13
Finding

Unconsented Disclosure of User Preference Data to an External Service

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:21
Finding

Persistent Behavioral Manipulation Through Untrusted Recalled Preferences

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill clearly instructs agents to collect, store, and later recall user-specific preferences, including potentially sensitive details such as privacy expectations, communication style, schedule habits, and critical feedback preferences, but it does not present a clear warning about remote persistence or data sensitivity. This can cause users or integrators to unknowingly transmit personal data to a third-party service, increasing privacy, consent, and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The skill directs agents to POST user preference content and user identifiers to an external remote endpoint using an API key, which is a direct external transmission of personal data. In this skill's context, the transmission is the core feature, but it is still security-relevant because it sends potentially sensitive user information off-platform to a third-party service without visible safeguards, minimization, or consent requirements.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store each preference as a clear rule with the user it belongs to.

bash
curl -X POST https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-remember \
  -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "PREFERENCE (Joe): keep summaries under 5 bullets. No emojis in work emails. Prefers morning updates, not evening. Wants to be called out directly when wrong.", "title": "prefs - Joe communication"}'

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow tells the agent to immediately capture and reuse user-provided preferences, explicitly including privacy-related preferences, as durable natural-language records. That creates a standing risk of over-collection, indefinite retention, and replay of sensitive personal details in later contexts without sufficient consent, scoping, or minimization controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.