ClawHub
Back to skill

Security audit

nautilus-compass-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed long-term agent memory integration, with sensitive but purpose-aligned configuration changes users should review before installing.

Install this only if you want agent activity remembered across sessions. Prefer the local daemon when memory content must stay on your machine; the hosted gateway sends memories and recall queries to the service. Before running the installers, review the pinned repository code and expect changes to Claude and other MCP client configuration files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Agent Config Directory Access

High
Category
Agent Snooping
Content
```

What these scripts do, before you run them: download the local embedding
model, register hooks in `~/.claude/settings.json`, and patch each MCP
client's config — every file is backed up before writing; uninstall = remove
`~/.claude/plugins/nautilus-compass` and restore the backups.
Confidence
95% confidence
Finding
The skill instructs users to run installation scripts that modify `~/.claude/settings.json` and patch multiple MCP client configurations in the user's home directory. Even though backups and commit pinning are mentioned, this is still sensitive agent configuration access that can persist hooks, alter tool behavior, and potentially expand the skill's reach across clients if the scripts are malicious, compromised, or overly broad.

Agent Config Directory Access

High
Category
Agent Snooping
Content
python ~/.claude/plugins/nautilus-compass/scripts/install_to_agent.py
```

脚本会做什么(执行前请知悉): 下载本地嵌入模型、在 `~/.claude/settings.json`
注册钩子、改动各 MCP 客户端配置——每处改动前逐文件备份;卸载=删除
`~/.claude/plugins/nautilus-compass` 并还原备份。
Confidence
93% confidence
Finding
The skill instructs users to run an installer that modifies `~/.claude/settings.json` and other MCP client configuration files, which are security-sensitive agent config locations. Even though backups and commit pinning are mentioned, automatic registration of hooks and config rewrites can grant persistence, alter agent behavior, or expand execution pathways if the script is compromised or reviewed insufficiently.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: nautilus-compass-memory
description: Local-first long-term memory for AI agents via MCP — zero LLM calls at write time, typed retrieval at read time. Use when session decisions and pitfalls should survive across days, when multiple agents or dialogs share facts on the same filesystem, or when you want drift detection so past mistakes don't repeat. Verified claims only — every published number ships as a byte-recomputable, ed25519-signed evidence pack.
---

# Nautilus Compass Memory
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The '何时用' section describes general situations like needing memory across sessions or avoiding repeated mistakes, but it does not define specific activation phrases, boundaries, or exclusion conditions beyond one brief '跳过' line. In a skill card, this kind of broad applicability can cause unintended invocation because many ordinary agent tasks could appear to match.

Natural-Language Policy Violations

Low
Confidence
77% confidence
Finding
The file introduces a substantial locale-specific section headed '中文版' and then provides instructions in Chinese, but does not state that language presentation is user-selectable or optional. Under the policy, forcing or prescribing a specific language/locale without opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low
Confidence
77% confidence
Finding
The file is a Chinese skill card, but it appends an English-only section and directs readers to the full English card without stating whether language is user-selectable. This can create a locale-policy issue if the skill experience assumes or forces a language without explicit user opt-in.

Static analysis

No suspicious patterns detected.