ClawHub
Back to skill

Security audit

Agent Memory System Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local memory-workflow skill whose file and helper-script actions fit its stated purpose, though users should be careful with restore commands.

Install only if you want an agent to maintain local memory files in a workspace. Do not store passwords, API keys, or private secrets in these memory files. Before running import or --clean, confirm the workspace path and keep the generated pre-import backup so you can recover if the restored memory is not what you expected.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs the agent to read, write, and invoke shell commands such as running python3 scripts/memory_capture.py and modifying workspace files, but the metadata declares no permissions. This creates a transparency and policy-enforcement gap: users or platforms may treat the skill as low-risk while it actually drives filesystem and command execution behavior.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README documents an import flow that performs overwrite-style restore and a `--clean` mode, but it does not prominently warn that these operations can replace existing memory files and potentially discard user data. In a memory-management skill, users may run the commands against real workspaces, so insufficient warning increases the chance of destructive misuse even if the behavior is intended.

Static analysis

No suspicious patterns detected.