ClawHub
Back to skill

Security audit

Daily Reflection

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent daily-reflection purpose, but it broadly reads and rewrites persistent agent memory with limited scoping or runtime visibility.

Install only in an isolated memory/workspace context where the operator expects persistent local writes. Avoid using it with memories that may contain credentials, private chat content, production data, or unrelated project history, and review generated solution_memory and pattern files before letting future sessions rely on them.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:13
Finding

Unbounded Collection and Persistence of Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-15, SKILL.md:80-82, SKILL.md:130-160
Vulnerability Type: Excessive access to and retention of agent memory
Risk Level: Medium

Vulnerable Code

SKILL.md:13-15:

markdown
## STEP 1 — Day Analysis

Load all today's entries from memory (memory_search for "today", current date, active projects).

SKILL.md:80-82:

markdown
## STEP 4 — Pattern Detection (last 7 days)

Check memory_search over last 7 days:

SKILL.md:130-160:

markdown
Write structured summary to `memory/YYYY-MM-DD.md` (append).

Format:

23:59 Reflection

Completed today

  • [Task 1]
  • [Task 2]

Open / In Progress

  • [Task]

What went well

  • [Concrete things that worked — code, communication, decisions]

What went poorly

  • [Honest — errors, misunderstandings, bad decisions]

Learnings

  • Situation: [What happened] → Better tomorrow: [Concrete change]

New Patterns

  • If new pattern detected → write to memory/patterns.md
  • If no new pattern: "No new patterns"

Solution Memory Updates

  • [ID] — [short description]
text

**REQUIRED:** What went well + What went poorly + Learnings must ALWAYS be filled in.

Technical Analysis

The skill directs the agent to load all entries associated with the current day and search memory across the preceding seven days. These searches are not limited to a specific project, trusted namespace, data classification, or minimum set of records required for reflection.

The retrieved information is subsequently summarized and copied into persistent files. Other instructions in the skill also permit writing code snippets and bug details into solution-memory records. Although README.md states that credentials, tokens, private chat dumps, raw transcripts, and production data should not be stored, equivalent filtering and redaction requirements are absent from the ope ...[truncated 1661 chars]

Remediation
View remediation

Remediation Suggestions

  1. Restrict searches to explicitly approved project and task namespaces instead of loading all daily entries.
  2. Add mandatory filters to SKILL.md that exclude credentials, authentication tokens, private chat content, raw transcripts, personal data, production data, and unrelated projects.
  3. Redact secrets and sensitive identifiers before generating or writing any summary.
  4. Require explicit user approval before processing private or cross-project memory sources.
  5. Apply data minimization: store references or concise non-sensitive conclusions rather than reproducing source content or code unnecessarily.
  6. Define retention periods and cleanup procedures for daily summaries, briefings, patterns, quality logs, and solution-memory records.
  7. Enforce host-level namespace isolation so the skill can search and write only within a dedicated reflection area.
  8. Record provenance for every persisted item so users can identify its source and remove it safely.

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:205
Finding

Persistent Behavioral Influence Through Unvalidated Solution and Pattern Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:70-76, SKILL.md:147-150, SKILL.md:185-187, SKILL.md:205-214
Vulnerability Type: Persistent memory poisoning through unvalidated behavioral guidance
Risk Level: Medium

Vulnerable Code

SKILL.md:70-76:

markdown
  "project": "[Project name]",
  "confidence": 0.95,
  "solved_at": "[Date]",
  "time_to_solve_minutes": 0
}

Write to memory under solution_memory/[id].json.

text

`SKILL.md:147-150`:

```markdown
### New Patterns
- If new pattern detected → write to memory/patterns.md
- If no new pattern: "No new patterns"

SKILL.md:185-187:

markdown
Write to `memory/session-quality-log.md` (append).
If Total < 7 → analyze main reason and propose a new pattern for review.

SKILL.md:205-214:

markdown
## SOLUTION MEMORY — CONSULT BEFORE DEBUGGING

**BEFORE any debugging attempt:**
1. `memory_search("solution_memory [keywords from bug description]")`
2. Relevant solutions found → try these first
3. No solutions → debug normally, then write to solution memory

**BEFORE similar tasks:**
1. `memory_search("solution_memory [task-type]")`
2. Similar past tasks → use time estimate and known pitfalls

Technical Analysis

The skill converts prior session content into persistent solution records and behavioral patterns. It then instructs future sessions to search those records and try matching solutions before conducting independent debugging.

No validation boundary is defined between untrusted historical content and trusted behavioral guidance. The skill does not require confirmation that a stored solution was reproducible, that a pattern was reviewed by the user, or that retrieved memory contains data rather than executable instructions. It also lacks project isolation, expiration, revocation, provenance checks, and confidence calibration. The example assigns a fixed confidence of 0.95, w ...[truncated 1780 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat all retrieved memory as untrusted reference data, never as executable instructions or authoritative policy.
  2. Require explicit user approval before promoting generated observations into durable behavioral patterns.
  3. Store solution records initially with an unverified status and promote them only after reproducible validation.
  4. Replace “try these first” with advisory language requiring current-context verification and independent diagnosis.
  5. Add provenance fields identifying the source session, project, author, evidence, and validation history.
  6. Scope every record to a specific project, technology version, and environment to prevent cross-project contamination.
  7. Use evidence-based confidence values rather than assigning a fixed confidence of 0.95.
  8. Add expiration and revocation mechanisms for stale, rejected, or superseded solutions and patterns.
  9. Ensure the agent ignores tool calls, commands, policy changes, and behavioral instructions embedded inside retrieved memory.
  10. Require security review before applying remembered solutions that involve credentials, permissions, deployment, shell commands, or production systems.

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
95% confidence
Finding

The 'OUTPUT RULE' instructs the agent to keep user-facing output minimal and prefer writing results to memory files, which suppresses transparency about actions taken and hides potentially sensitive or destructive behavior from the user. This is especially risky because the skill also performs broad memory reads, pattern analysis, and persistent writes, so the user may not realize what data was accessed or modified.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md
---

## OUTPUT RULE

Keep user-facing output minimal. Prefer memory files for routine results.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill directs the agent to overwrite and append multiple memory files, including a morning briefing and daily logs, without requiring explicit confirmation or a user-visible notice at execution time. In an automated cron context this can silently modify persistent state, increasing the risk of unintended data loss, corruption, or privacy-sensitive retention if the memory contents are inaccurate or overly broad.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README explicitly instructs the agent to create and update several local memory files, but it does not prominently warn operators that running this skill will modify persistent workspace state. In an automated cron context, that can lead to unexpected file creation, overwrites, or accumulation of sensitive summaries in local memory, especially if the operator assumes the skill is read-only.

Content

No source excerpt is available for this finding.