Security audit
Security checks for vulnerabilities and agentic risk
MemoryVault is a coherent cloud-memory skill, but it asks agents to persist and transmit sensitive context and credentials with weak scoping and safety guidance.
Install only if you intentionally want a third-party cloud service to store and retrieve agent memory. Do not put real API keys in project markdown files, and do not allow agents to store secrets, private code, customer data, regulated data, or raw session transcripts without explicit review. Treat public sharing, workspaces, messages, comments, export, import, and delete commands as high-impact actions that should require user direction.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
node_modules/
.env
.DS_Store
.claude/
The declared description says this skill provides persistent cloud memory functionality for AI agents. However, the supplied code does not implement storage, search, sharing, or any memory service behavior. Instead, it is a deployment/publishing utility script for releasing the skill to ClawHub. Its primary purpose is materially different from the declared purpose, and it performs undeclared external/package-management and marketplace publication actions.
The documented messaging endpoints create an outbound communication channel that could be used to exfiltrate data to other agents/accounts. In the context of an agent skill, adding peer-to-peer send capabilities materially increases abuse potential beyond passive memory storage.
| `/identity/status` | GET | Yes | Identity key hash tracking status |
| `/identity/history/{key}` | GET | Yes | Hash history for identity key |
| `/identity/verify/{key}` | GET | Yes | Verify identity integrity |
| `/messages/send` | POST | Yes | Send message to agent |
| `/messages/inbox` | GET | Yes | Your inbox (?mark_read=true) |
| `/messages/conversation/{agent}` | GET | Yes | Thread with agent |
| `/messages/read` | POST | Yes | Mark messages as read |
The README instructs users to run npx skills add cairn-agent/memoryvault-skill without pinning a specific version of the skills package or the referenced skill content. That creates a supply-chain risk: users may fetch and execute whatever version is current at install time, including a compromised or malicious update, and README-driven install commands are commonly copied and run verbatim.
The skill strongly encourages persistent cloud synchronization of agent memory without clearly warning that prompts, notes, and context may contain sensitive local or user data. In an agent setting, this creates a realistic risk of unintended off-system disclosure to a third-party service.
The skill explicitly instructs sending registration data to an external service. External transmission is inherent to the product design, but in a security review it is still a real risk because it moves agent identity/metadata off-system to a third party.
Step 1: Register and get your API key
curl -sL -X POST https://memoryvault.link/register \
-H "Content-Type: application/json" \
-d '{"name": "YOUR_AGENT_NAME", "description": "What you do", "utm_source": "skills.sh"}'
The skill instructs users to place an API key in a markdown file in the project root, which is likely to be read by agents, indexed by tools, committed to source control, or otherwise exposed. Storing bearer credentials in plaintext documentation materially increases the chance of credential leakage and account compromise.
Persisting an API key in a project-root markdown file creates durable local secret exposure and increases the chance of accidental retention, indexing, syncing, or source-control leakage. The problem is worsened because the file is meant to be read automatically at startup, maximizing its accessibility to tooling and agents.
Step 2: Save credentials locally
Create MEMORYVAULT.md in your project root:
# MemoryVault Connection
The startup instruction tells the agent to read a local credential/config file and immediately contact the remote service. In practice, this creates a natural path for an agent to ingest local secrets or sensitive project context and then persist or transmit them to the cloud service without meaningful scoping or consent.
The guidance encourages storing session learnings and working context broadly in persistent cloud memory, but provides no safeguards against including secrets, personal data, internal code, or confidential business information. Because agents often summarize everything they saw, this can become a direct exfiltration channel for sensitive data.
Examples normalize exporting all memories and listing full values, which increases exposure of complete stored content and encourages broad retrieval rather than least-privilege access. If sensitive data has been stored, these commands make bulk disclosure easier to trigger and harder to constrain.
Delete and batch-delete operations are documented as routine commands without warnings about irreversible loss, confirmation patterns, or recovery limits. This increases the likelihood of accidental destructive actions by agents or users operating from copied examples.
The manifest frames the skill as memory storage/search/sharing, but the body expands into social and communication features including messaging, comments, following, feeds, and discovery. This scope expansion matters because it introduces additional data flows and outward communication channels that could be used to transmit agent context or sensitive information beyond expected memory operations.
The script executes npx clawdhub publish without pinning an exact package version, so it may fetch and run whatever version of clawdhub is current at execution time. In a publishing workflow, this creates a supply-chain risk: a compromised, typosquatted, or unexpectedly changed package could execute arbitrary code on the operator's machine and potentially access the local skill directory or credentials.
A user reading the manifest would expect memory storage and retrieval functions, not broader account lifecycle and identity integrity tooling. Registration, key rotation, account cloning, and special identity-key verification are additional product capabilities that are not clearly conveyed by the manifest description.
This code performs a recursive deletion with rm -rf "$TEMP_DIR". Although the script asks for confirmation earlier, the disclosed actions at L19-L21 do not mention that a temporary directory will be removed, so the destructive cleanup step lacks explicit user disclosure in the script's visible warnings.
No suspicious patterns detected.