Klik Memory Import

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 0.1.0

Overview

This skill appears to perform its stated Klik memory import workflow, but it needs Review because sensitive memory/task data can be uploaded with metadata that is not fully redacted or previewed.

Review the exact draft payload before submitting, especially frontmatter, paths, collector names, and scheduled-task prompts. Do not consent to crontab inspection unless you want system-level scheduled jobs included, and avoid using this skill until metadata redaction or exact final-payload preview is added if your agent memory may contain credentials, private project names, or personal data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/cli.ts:40

Finding

Incomplete Redaction Allows Sensitive Metadata to Be Uploaded

Content

View full analysis

{ const base = opts.baseUrl ?? KLIK_MEMORY_URL; const raw = Buffer.from(JSON.stringify(payload), 'utf8'); const shouldGzip = raw.byteLength > 256 * 1024; const body = shouldGzip ? zlib.gzipSync(raw) : raw; const headers: Record = { 'X-Import-Token': importToken, 'Content-Type': 'application/json', 'Content-Length': String(body.byteLength), }; if (shouldGzip) headers['Content-Encoding'] = 'gzip'; const { status, body: respBody } = await request( 'POST', `${base}/api/v1/memory/import/upload`, body, headers ); ``` ### Technical Analysis The redaction operation processes only the `content` and `prompt` properties of each item. Other string-valued fields are transmitted without ...[truncated 2686 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill imports memory files and scheduled tasks into Klik. However, the supplied code chunk only defines regex-based content redaction functions. It neither accesses agent storage nor enumerates files/tasks, nor communicates with Klik or any external service. Redaction could conceivably be a supporting step in a larger import pipeline, but this chunk alone does not implement the declared primary purpose and instead performs a materially different function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill imports memory files and scheduled tasks into Klik. However, the provided code chunk does not implement any import, migration, file discovery, task handling, authentication/import-code handling, or network upload behavior. It is purely test code for package publication and CLI symlink resolution, including invocation of a 'doctor' command to verify SKILL.md detection. That is a materially different primary purpose from the declared functionality, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about migrating agent storage data and scheduled tasks into Klik. The actual code does not perform any import, migration, storage discovery, task handling, network communication, or Klik integration. Instead, it contains unit tests for text redaction functionality, focused on sanitizing sensitive strings such as API keys and tokens. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises an import/migration feature that scans agent storage for memory files and scheduled tasks, lets the user review them, and uploads them to Klik. The actual code shown does none of that. It is only a unit test file for schema validation, exercising validatePayload with valid and invalid payloads. There is no filesystem discovery logic, no scheduled-task handling, no user review/cleanup flow, no secure upload, and no Klik import code processing. This is a materially different primary purpose, so the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow directs the agent to collect memory contents and task prompts and upload them to an external service. Those artifacts can contain highly sensitive personal, operational, credential-adjacent, or proprietary data, and the redaction guidance is incomplete and easy to bypass because it relies on filename exclusions and basic cleanup rather than robust content inspection and minimization.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

Step 7: Cleanup

bash

rm -f /tmp/klik_import_draft.json

Tell the user the import ID and that Klik will process the data shortly.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to paste a natural-language prompt that both installs a remote skill and authorizes broad collection of 'memory and scheduled tasks' using only a 6-digit code. Because the invocation is open-ended and lacks scope limits, review requirements, or explicit negative constraints, an agent could over-collect sensitive local data or perform installation/import actions without sufficiently bounded user consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs use of Bash, file discovery, and execution of a local Node CLI, but declares no explicit tool scope or allowed-tools boundary. That makes the privilege expectations ambiguous and weakens policy enforcement for a workflow that accesses local files, scheduled tasks, and temporary files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Reading crontab is a form of persistence/scheduled-execution enumeration that can expose how the host maintains recurring actions. In the context of a data-export skill, enumerating persistence mechanisms broadens the security footprint and may leak operational details not necessary for the core task.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

**Scheduled tasks:**
- Look for: `~/.claude/scheduled_tasks.json`, `~/.openclaw/scheduled_tasks.json`
- Also check crontab if user consents: `crontab -l 2>/dev/null`

### Step 3: Clean before packaging

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill expands collection beyond agent-owned storage by instructing the agent to inspect the user's crontab. Crontab entries can reveal unrelated jobs, commands, secrets, or operational details, so this exceeds the stated scope and increases unnecessary exposure of sensitive data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

}

text

Write this JSON to a temporary file: `/tmp/klik_import_draft.json`

**Validate before upload:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code transmits potentially sensitive data to remote services: the verification code is sent in verifyCode and the payload is uploaded in uploadPayload. There are no confirmation prompts, user-facing logs, or inline warnings indicating that user data and tokens will be sent to external endpoints.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.20.2 — 1 advisory(ies): GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r)

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The lockfile pins esbuild to 0.20.2, which is affected by GHSA-67mh-4wv8-2f99 involving the development server accepting cross-origin requests. This is a real supply-chain risk in environments where the esbuild dev server is used, but in this skill the package appears only as a devDependency/build tool and there is no evidence in this file that a dev server is exposed at runtime, so practical impact for the shipped skill is limited.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json

"lint": "tsc --noEmit"
  },
  "devDependencies": {
    "@types/node": "^18.19.0",
    "esbuild": "^0.20.0",
    "typescript": "^5.4.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^18.19.0",
    "esbuild": "^0.20.0",
    "typescript": "^5.4.0"
  }
}

Known Vulnerable Dependency: esbuild==0.20.2 — 1 advisory(ies): GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r)

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The package allows installation of esbuild 0.20.2, which has a known advisory affecting the esbuild development server. In this skill, esbuild appears only as a devDependency used for builds, so the vulnerable functionality is unlikely to be exposed in normal end-user operation; however, developers building or testing the skill could be affected if they run the dev server in a reachable environment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"devDependencies": {
    "@types/node": "^18.19.0",
    "esbuild": "^0.20.0",
    "typescript": "^5.4.0"
  }
}