ClawHub
Back to skill

Security audit

voice-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent voice-memory purpose, but it encourages indefinitely storing sensitive call details with an external service without enough privacy, retention, or scoping controls.

Review this carefully before installing. Use it only where callers have been informed and consent to external memory storage, avoid sending sensitive or regulated data unless your BlueColumn setup is approved for it, and confirm retention, deletion, tenant isolation, and endpoint details before wiring it into production calls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Ssd 3

Medium
Confidence
92% confidence
Finding
The skill promotes indefinite memory of every conversation and reuse of prior caller details across future interactions without any safeguards around scope, retention limits, access control, or sensitivity filtering. Persistent cross-session memory can expose sensitive information to future users, agents, or contexts and increases the blast radius of accidental collection.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly demonstrates sending call transcripts, phone numbers, and caller preferences to a third-party service, but it provides no privacy notice, consent guidance, minimization controls, or handling requirements for personal data. In a voice-agent context this is dangerous because users may disclose sensitive or regulated information during calls, and operators could unknowingly transmit that data externally.

External Transmission

Medium
Category
Data Exfiltration
Content
## Store a call
```bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" -H "Content-Type: application/json" \
  -d '{"text": "Caller +12065550123 asked about pricing, prefers email follow-up.", "title": "Voice call - +12065550123"}'
```
Confidence
90% confidence
Finding
The example directly instructs sending externally sourced call content, including a phone number and interaction details, to an external endpoint. External transmission is expected for this skill, but it remains security-relevant because the transmitted data may contain personal or confidential information and the skill gives no guardrails on sanitization, destination validation, or safe handling.

Static analysis

No suspicious patterns detected.