Security audit

T138 Imea Clawhub

Security checks for vulnerabilities and agentic risk

Overview

This local memory skill is not malicious, but it asks agents to automatically record and reuse conversation and task history with weak privacy and deletion controls.

Install only if you intentionally want persistent local agent memory. Before enabling hooks or heartbeat checks, inspect scripts/memory-check.sh, decide which workspaces may be indexed, exclude secrets and confidential conversations, create a deletion/retention process for L1/L2/L3 and SESSION-STATE.md, and avoid using it in sensitive projects until those controls are in place.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly defines persistent multi-tier memory directories and describes storing daily conversations, major events, and long-term memory with permanent retention for some layers. This is dangerous because it encourages broad retention of potentially sensitive user content without disclosure, minimization, consent, or filtering, increasing privacy and data exposure risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The configuration documents automatic hooks at session end and before actions, plus heartbeat-driven checks, implying recurring automated execution and file writes. Undisclosed automation that persists data or alters the workspace can surprise users and operators, causing unintended data retention and system-side effects.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document requires persistent WAL and conversation logging for every task and dialogue, but it provides no limits on what data may be logged, no retention period, no consent model, and no privacy safeguards. In an agent skill context, this can cause routine capture of sensitive user inputs, internal task details, or credentials into shared files, increasing exposure well beyond immediate operational need.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document directs automatic recording of daily conversations and permanent storage of CEO preferences and long-term memory without any consent, minimization, retention controls, or access restrictions. This creates a privacy and data-governance risk because sensitive personal, behavioral, and operational information may be collected and retained indefinitely, increasing exposure if the memory store is misused or breached.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill instructs retention of conversation records, event records, and long-term memory without any boundaries on what content is eligible, and without sensitivity classification or exclusion rules. In context, this memory-centric design makes the issue more dangerous because the core purpose of the skill is to accumulate and preserve agent-derived and user-derived content over time.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The workflow directs the agent to write task outputs into L1 memory and later classify/archive them into longer-lived stores, creating systematic accumulation of user-related content. Without minimization, access controls, or expiry constraints for archived data, this can lead to unnecessary persistence of sensitive information and larger blast radius if the workspace is accessed or exfiltrated.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill mandates writing every conversation summary, decisions, and follow-up items into persistent L1 daily memory files. This creates systematic retention of user-provided content and agent-generated context, which may later be surfaced, searched, or leaked to other tasks or operators without necessity or authorization.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The WAL protocol instructs agents to record task details, decisions, impacts, and lessons before execution in a shared session state file. In practice, this encourages storing sensitive task context and future actions in persistent logs, which can expose confidential requests, internal workflows, or security-relevant operational details to unintended readers or later components.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill operationalizes broad, automatic conversation logging and long-term retention of user or CEO preferences as part of normal agent behavior. In a memory system context this is more dangerous, not less, because the instructions normalize persistent collection across multiple layers, making over-collection, sensitive data retention, and secondary misuse likely unless strong safeguards exist.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Requiring agents to search all prior memory before acting and to write every completed interaction into daily memory creates a broad default data-access and persistence model. This increases the chance of unnecessary exposure of historical sensitive data to every task, and it encourages indiscriminate retention of conversations that may contain credentials, personal information, or confidential context.

Static analysis

No suspicious patterns detected.