ClawHub
Back to skill

Security audit

super-memori

Security checks for vulnerabilities and agentic risk

Overview

This local memory skill is mostly coherent, but it handles sensitive memory through under-scoped services, broad local scans, and an automatic startup hook that need careful review before installation.

Install only if you are comfortable with a local memory skill that can persist agent history, index memory into Qdrant, run a startup hook, and scan some host metadata. Keep Qdrant and the semantic daemon bound to loopback, avoid remote SUPER_MEMORI_* endpoint settings unless separately secured, review hook configuration before enabling it, and treat auto-learning/system-hygiene features as opt-in maintenance workflows for sensitive environments.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/super_memori_common.py:255
Finding

Configurable Qdrant Endpoint Can Receive Complete Memory Contents over Plaintext HTTP

Content
View full analysis
dict: url = f"{QDRANT_URL}{path}" data = None headers = {"Content-Type": "application/json"} if payload is not None: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request(url, data=data, headers=headers, method=method) with urllib.request.urlopen(req, timeout=timeout) as r: raw = r.read().decode("utf-8", "ignore") return json.loads(raw) if raw else {} ``` During semantic index rebuilding, the Qdrant payload includes complete memory chunks, local source paths, metadata, and vectors: ```python for start in range(0, len(rows), SEMANTIC_BATCH_SIZE): batch = rows[start:start + SEMANTIC_BATCH_SIZ ...[truncated 2706 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/semantic_daemon.py:30
Finding

Semantic Daemon Can Be Bound to the Network without Authentication

Content
View full analysis
None: _touch() if self.path == "/embed": try: payload = self._read_json() texts = payload.get("texts") or [] prefix = str(payload.get("prefix") or "query") vectors = _embed_texts([str(t) for t in texts], prefix=prefix) self._send(200, {"vectors": vectors}) except Exception as exc: self._send(500, {"error": str(exc)}) return if self.path == "/semantic-search": try: payload = self._read_json() results = semantic_search_via_qdrant( str(payload.get("query") or ""), memory_type=str(payload.get("memory_type") or "all"), limit=int(payload.get("limit") or 5), reviewed_only=bool(payload.get("reviewed_only")), ) self._send(200, {"results": results}) except Exception as exc: self._send(500, {"error": str(exc)}) return self._send(404, {"error": "not found"}) ``` The configured address is used directly by the server: ```python server = HTTPServer((HOST, PORT), Handler) ``` If `HOST` is set to `0.0.0.0`, `::`, or a network interface address, any ...[truncated 1698 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
hooks/super-memori-session-start/handler.js:53
Finding

Session-Start Hook Executes Free-Form Configuration through a Shell

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/system_hygiene_memory.py:16
Finding

Routine Memory Indexing Recursively Enumerates Unrelated User Data Directories

Content
View full analysis
list[dict]: findings: list[dict] = [] if not root.exists(): return findings for path in sorted(root.rglob("*")): try: if path.is_dir(): continue if len(path.relative_to(root).parts) > 6: continue stat = path.stat() size = stat.st_size age_days = round(max(0.0, time.time() - stat.st_mtime) / 86400.0, 2) category = _candidate_category(path) if size < min_bytes and category not in {"memory-index-health", "openclaw-runtime-health"}: continue if category == "stale-log" and age_days < 7: continue if category == "stale-backup" and age_days < 14: continue full = str(path).casefold() findings.append({ "finding_id": sha256_text(f"{path}:{stat.st_mtime}:{size}")[:16], "category": category, "path": str(path), "size": size, "size_human": _human_size(size), "age": age_days, "owner": _path_owner_guess(path), "source": str(root), "why_it_matter ...[truncated 3390 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:92
Finding

Semantic Dependencies Are Installed without Version or Hash Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (81)

Tainted flow: 'req' from os.environ.get (line 1136, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

This request sends data to a URL derived from environment-controlled configuration without constraining the destination to a trusted local endpoint. In this skill, request payloads can include memory content and queries, so a manipulated environment variable could redirect sensitive local memory data to an attacker-controlled service.

Content

Scanner excerpt · scripts/super_memori_common.py (reported line 1116)May include surrounding context.

python
if payload is not None:
        data = json.dumps(payload, ensure_ascii=False).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=headers, method=method)
    with urllib.request.urlopen(req, timeout=timeout) as r:
        raw = r.read().decode("utf-8", "ignore")
        return json.loads(raw) if raw else {}

Tainted flow: 'QDRANT_URL' from os.environ.get (line 255, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

QDRANT_URL is fully environment-controlled and used for HTTP requests without validating that it is local or trusted. Because this skill stores and searches long-term memory, redirecting Qdrant traffic could expose indexed memory metadata and content to an external service.

Content

Scanner excerpt · scripts/super_memori_common.py (reported line 1123)May include surrounding context.

python
def qdrant_ok() -> bool:
    try:
        with urllib.request.urlopen(f"{QDRANT_URL}/collections", timeout=3) as r:
            return r.status == 200
    except Exception:
        return False

Tainted flow: 'req' from os.environ.get (line 1136, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

The semantic daemon request path uses an environment-derived base URL and can transmit search queries to that endpoint. If SUPER_MEMORI_SEMANTIC_DAEMON_HOST or port are altered, the skill may exfiltrate memory queries and potentially indexed content to an untrusted remote listener.

Content

Scanner excerpt · scripts/super_memori_common.py (reported line 1137)May include surrounding context.

python
data = json.dumps(payload, ensure_ascii=False).encode("utf-8")
    method = "POST" if payload is not None else "GET"
    req = urllib.request.Request(url, data=data, headers=headers, method=method)
    with urllib.request.urlopen(req, timeout=timeout) as r:
        raw = r.read().decode("utf-8", "ignore")
        return json.loads(raw) if raw else {}

Tainted flow: 'SEMANTIC_DAEMON_URL' from os.environ.get (line 260, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The semantic daemon health check trusts an environment-derived URL and silently probes it. In the broader skill context, this local-service trust model makes endpoint redirection particularly risky because the same endpoint family also receives sensitive query and embedding traffic.

Content

Scanner excerpt · scripts/super_memori_common.py (reported line 1144)May include surrounding context.

python
def semantic_daemon_ok() -> bool:
    try:
        with urllib.request.urlopen(f"{SEMANTIC_DAEMON_URL}{SEMANTIC_DAEMON_HEALTH_PATH}", timeout=1.5) as r:
            return r.status == 200
    except Exception:
        return False

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Release/package gating and automated validation are privileged maintenance behaviors that do not belong in a casually invoked memory skill with everyday-language triggers. This mismatch makes the skill more dangerous because an agent could cross from read-oriented user assistance into repository governance and execution workflows without an obvious trust boundary.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/architecture.md (reported line 58)May include surrounding context.

md
## Non-goals for the current v4 line
- graph database first
- autonomous self-rewrite of memory policy
- cloud-backed memory services
- many public scripts for weak models
- canonical storage inside vector DB

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md
- `--audit`

### Actual exit codes
- `0` requested action completed without warnings
- `2` completed with warnings or expected degraded conditions
- `3` storage/runtime failure during index maintenance
- `4` bad arguments

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/command-contracts.md (reported line 112)May include surrounding context.

md
- `--audit`

### Actual exit codes
- `0` requested action completed without warnings
- `2` completed with warnings or expected degraded conditions
- `3` storage/runtime failure during index maintenance
- `4` bad arguments

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/release-prep.sh (reported line 9)May include surrounding context.

sh
echo "=== Cleaning build artifacts ==="
find . -type d -name '__pycache__' -prune -exec rm -rf {} + 2>/dev/null || true
find . -type f -name '*.pyc' -delete 2>/dev/null || true
rm -rf reports/test-generated 2>/dev/null || true

echo "=== Running regression pack ==="
./tests/regression/run-all.sh

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
96% confidence
Finding

Passing os.environ.copy() to the daemon propagates the full parent environment, which may contain API keys, tokens, proxy settings, and other secrets unrelated to the daemon's task. If the daemon is compromised, logged, or redirected to attacker-controlled code, those inherited secrets are immediately exposed.

Content

Scanner excerpt · scripts/super_memori_common.py (reported line 1161)May include surrounding context.

python
proc = subprocess.Popen(
            ["python3", str(daemon_script)],
            cwd=str(WORKSPACE),
            env=os.environ.copy(),
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
            start_new_session=True,

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill exposes shell, file read/write, environment, and possible network-related capabilities in its documented behavior, but it declares no explicit tool scope or permission boundary. That makes it easier for an agent or integrator to invoke more capability than intended, increasing the risk of unsafe command execution, unintended file mutation, or environment access under a broad trigger surface.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger description is extremely broad, covering common requests like 'remember' or 'find in memory,' which can overlap with ordinary conversation and many unrelated tasks. In a skill that also exposes shell, indexing, write, and maintenance flows, broad triggers materially increase the chance of unintended activation and unsafe tool use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script mines the agent's full shell command log to derive new memory candidates, which materially expands the skill from memory recall/search into host activity surveillance. Command histories often contain sensitive operational details, secrets typed on the CLI, file paths, service names, and incident context; persisting and reprocessing them creates a privacy and data-minimization risk beyond the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.