ClawHub
Back to skill

Security audit

Memory Guard

Security checks for vulnerabilities and agentic risk

Overview

Memory Guard has a coherent security purpose, but its verifier contains an unsafe code-injection path that could execute attacker-controlled Python if its workspace registry is tampered with.

Review this carefully before installing. The concept is useful, but this version should not be run automatically on untrusted or shared workspaces unless the Python invocations are fixed to pass paths and file names as data arguments instead of embedding them into source code.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
memory-guard.sh:127
Finding

Arbitrary Python Code Execution Through Untrusted Integrity Registry Keys

Content
View full analysis
/dev/null) [ "$stored_hash" = "UNTRACKED" ] && continue checked=$((checked + 1)) local current_hash current_hash=$(hash_file "$fname") local is_critical is_critical=$(python3 -c " import json d = json.load(open('$HASH_FILE')) print(d.get('$fname', {}).get('critical', False)) " 2>/dev/null) ``` The value assigned to `fname` comes directly from keys in the JSON registry: ```bash done < <(python3 -c " import json for k in json.load(open('$HASH_FILE')): print(k) " 2>/dev/null) ``` ### Technical Analysis The `verify` command reads property names from `.memory-guard/hashes.json` and assigns each property name to the shell variable `fname`. It then embeds that value directly inside Python source passed to `python3 -c`: ```python print(d.get('$fname', {}).get('hash', 'UNTRACKED')) ``` No quoting, escaping, or structural validation is performed before interpolation. A malicious JSON property name containing quote characters, line breaks, and Python statements can terminate the intended Python string literal and introduce attacker-controlled Python code. This is source-code injection rather than ordinary argument injection: the untrusted value is inserted into the program text itself. Shell quoting around the multiline `python3 -c` argument does not protect the Python interpreter from malicious Python syntax embedded through variable expansion. The configured registry path, `HASH_FILE`, is also interpolated into Python source in the same code blocks. Because it is derived from the externally config ...[truncated 2042 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.