ClawHub
Back to skill

Security audit

Evolutionary Model

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent agent-memory framework, but it should be reviewed because it normalizes persistent chat logs and self-modifying agent rules without clear consent, retention, or approval controls.

Install only if you intentionally want a file-based agent memory system. Before using it, decide what may be logged, disable or minimize raw chat logs, keep memory files out of shared repos and backups, add deletion and retention rules, and require explicit review before any changes to AGENTS.md, SOUL.md, policy.yaml, or auto-activated skills.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:39
Finding

Persistent Plaintext Storage of Conversation History and Personal Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:39-44, SKILL.md:80-87, SKILL.md:130-143
Vulnerability Type: Persistent storage of sensitive data without defined safeguards
Risk Level: Medium

Complete Code Snippets

text
memory/SESSION-STATE.md      — current focus (WAL, read first)
memory/YYYY-MM-DD.md         — daily raw log
MEMORY.md                    — curated long-term memory
memory/chat-log-YYYY-MM-DD.jsonl  — conversation history
text
Every session, the agent:
1. Reads `SESSION-STATE.md` (hot context)
2. Reads today's daily log
3. Works
4. Writes new decisions/insights to daily log
5. Periodically distills into `MEMORY.md`
text
Bootstrap checklist:
1. Fill `USER.md` with owner's name, timezone, communication style
text
Month 2: agent knows your projects, communication style, key contacts

Technical Analysis

The documented architecture instructs an agent to retain raw conversation history, session state, daily logs, decisions, personal profile information, projects, and key contacts in ordinary files. The skill does not define access controls, restrictive file permissions, encryption, data minimization, secret filtering, retention periods, deletion procedures, or user consent requirements.

Conversation logs can contain credentials, authentication tokens, private messages, customer information, internal project details, or other sensitive data even when those values were not intentionally selected for long-term retention. Storing raw conversations and subsequently distilling them into additional memory files also creates multiple copies, increasing the exposure surface.

Attack Path

  1. A user supplies personal, confidential, or credential-bearing information during a normal agent conversation.
  2. Following the documented workflow, the agent writes the conversation or extracted decisions into a JSONL log, daily log, session-state fi ...[truncated 983 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make raw conversation logging disabled by default and require explicit, informed user opt-in.
  2. Store only the minimum information necessary for the agent's documented purpose; prefer concise summaries over complete transcripts.
  3. Apply secret and personal-data detection before every memory write, including filtering credentials, tokens, financial data, private keys, and unnecessary contact details.
  4. Define retention periods and automatic deletion for session state, daily logs, and raw JSONL transcripts.
  5. Create memory files with restrictive owner-only permissions and document the required permissions.
  6. Encrypt sensitive persistent state at rest where the threat model warrants it, with keys kept separately from the stored data.
  7. Obtain separate consent before retaining personal contacts, project information, or other third-party data.
  8. Prevent memory directories from being committed or publicly shared by supplying appropriate ignore rules and backup guidance.
  9. Provide commands or documented procedures for users to inspect, correct, export, and permanently delete retained information.

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:94
Finding

Unvalidated Persistent Modification of Core Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:94-99
Vulnerability Type: Persistent behavioral-rule poisoning
Risk Level: Medium

Complete Code Snippet

text
### Mistake → Protocol
When the agent makes a mistake:
1. Analyzes root cause
2. Adds rule to `AGENTS.md` or `SOUL.md`
3. Future sessions inherit the fix

Technical Analysis

The skill directs the agent to transform conclusions from the current session into persistent rules in AGENTS.md or SOUL.md. Those files are described as controlling the agent's operating rules, identity, values, and future behavior.

The workflow does not require owner approval, trusted provenance, separation between untrusted input and policy, semantic validation, conflict checks, integrity protection, version review, or rollback. Consequently, a false lesson induced by malicious content or an erroneous root-cause analysis can become a durable instruction loaded by later sessions.

This is a memory-poisoning risk because session-derived content can cross a trust boundary and become persistent behavioral state. The finding does not establish that the skill contains an attacker-supplied rule; it identifies the documented write process that could allow such a rule to persist.

Attack Path

  1. An agent processes attacker-controlled or otherwise untrusted content during a task.
  2. The content causes an error or frames legitimate behavior as a mistake.
  3. During root-cause analysis, the agent derives a malicious or incorrect corrective rule from that content.
  4. Following the documented procedure, the agent writes the rule into AGENTS.md or SOUL.md without independent approval or validation.
  5. Future sessions load the modified file and inherit the poisoned rule.
  6. The rule can repeatedly influence later decisions until a user detects and removes it.

Impact Assessment

The affected scope includes future sessions that consume the modified `AGENT ...[truncated 471 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit owner review and approval before modifying AGENTS.md, SOUL.md, or any equivalent policy file.
  2. Never generate persistent policy directly from untrusted documents, web content, tool output, or third-party messages.
  3. Store proposed lessons in a separate quarantine or review file rather than immediately promoting them to active instructions.
  4. Record provenance for every proposal, including the triggering task, source content, author, timestamp, and rationale.
  5. Validate proposed rules against immutable safety constraints and reject rules that weaken authorization, confidentiality, or tool-use controls.
  6. Restrict automated edits to a clearly delimited section and protect foundational safety and identity sections from autonomous modification.
  7. Require a diff review and detect conflicts with existing rules before activation.
  8. Maintain version history, integrity checks, and a straightforward rollback process.
  9. Periodically audit persistent rules for stale, duplicated, overly broad, or suspicious instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill's activation criteria are broad and overlap with very common requests such as setting up an AI agent, explaining architecture, or auditing an agent setup. That can cause the skill to trigger in contexts where persistent memory, protocol changes, or skill creation are not expected, increasing the chance of unintended data retention or over-application of the framework.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly describes storing session state, daily logs, long-term memory, and conversation history to local files, but it does not present this as a privacy or consent-sensitive behavior. Users or downstream agents could adopt the pattern without realizing it persists potentially sensitive personal data and chat transcripts, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

text
AGENTS.md     — operating rules, safety, memory protocol
HEARTBEAT.md  — periodic check-in schedule and format
policy.yaml   — what agent can do without asking (allow/ask/deny)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
### Task → Skill
When the agent solves a new type of problem:
1. Documents the solution
2. Creates `skills/task-name/SKILL.md`
3. Adds `when_to_use` so it auto-activates next time

### Mistake → Protocol