ClawHub
Back to skill

Security audit

Aionis

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Aionis memory integration, but installation can automatically start a persistent local Docker service and store credentials in local files with limited guardrails.

Review the bootstrap before installing. Only run it if you are comfortable starting a persistent local Docker service, trusting the ghcr.io/cognary/aionis image, and storing Aionis credentials locally. Keep the .runtime files private, avoid exposing the admin token to routine agent tasks, and remove the container and volume when you no longer want the memory service to persist.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises no declared permissions, yet it instructs the agent to execute shell commands later in the document. This creates a capability/permission mismatch that can cause operators or orchestration systems to underestimate the skill's execution power, increasing the risk of unreviewed command execution.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill tells the agent to run a local bootstrap script and source an environment file as part of normal operation, even though the core purpose is calling memory-loop APIs. Executing local scripts and importing environment variables expands the trust boundary to arbitrary local code and secrets, which is dangerous because the script contents are not visible or constrained in this skill.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script persists generated auth tokens and optional third-party API credentials into local env files under the skill directory without setting restrictive permissions or clearly warning the user. On multi-user systems, shared workspaces, backups, or accidental commits, these secrets can be exposed and then reused to access the Aionis instance or external embedding provider.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.