Clawhub Memory Tiers Pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:28 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent multi-agent memory framework, but it lets shared agent-written files influence future agent behavior without enough trust, privacy, or approval controls.

Install only if you are comfortable with agents sharing workspace state and using persistent memory files. Keep per-agent permissions narrow, treat handoffs and lessons as untrusted data, require human review for SOUL.md changes, and avoid storing secrets or sensitive user data in L0, L1, lessons, patterns, or handoff files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:249

Finding

Persistent Instruction Poisoning Through Shared Agent-Controlled State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 249–279 and 320–329
Vulnerability Type: Persistent memory poisoning and unsafe trust of shared agent state
Risk Level: Medium

Vulnerable Instructions

markdown

## Orchestrator: Handoff Protocol

When Agent A's output feeds into Agent B's input:

1. Agent A completes its task and writes output to a shared handoff file:
   `workspace/handoffs/[AGENT_A]-to-[AGENT_B]-YYYY-MM-DD.md`

2. Agent A updates its L0.md line 3: "Handed off [deliverable] to [AGENT_B]."

3. Orchestrator reads Agent A's L0, confirms handoff file exists.

4. Orchestrator triggers Agent B with:
   - Pointer to the handoff file
   - Context: what Agent A produced and why
   - Expected output format

5. Agent B reads the handoff file, executes its task, writes output.

6. Agent B updates its L0.md and L1.md as normal.

Rules:
- Handoff files are write-once. Agent B never modifies Agent A's output.
- Handoff files older than 7 days can be archived to handoffs/archive/.
- If the handoff file is missing or malformed, Agent B stops and flags the orchestrator.

markdown

Create `workspace/lessons.md` in your main workspace. Any agent (or human) can append to it.

markdown

## Monthly Audit Checklist

Run this on the 1st of every month:

1. Score every agent using the 8-point rubric. Record in scorecards/.
2. Review lessons.md — are the same mistakes repeating? If yes, the fix was insufficient.
3. Review patterns.md — are proven patterns actually being used? If not, add them to SOUL.md workflows.
4. Check L0/L1 freshness — any agent with "Last run" older than 14 days is either unused or broken.
5. Check SOUL.md sizes — any over 400 lines needs externalization.
6. Archive old handoff files (> 7 days) and resolved blockers.
7. Update the orchestrator's agent roster with any new or retired agents.

Output: One-page swarm health report for the human
...[truncated 2630 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all agent-generated handoffs, lessons, patterns, and memory files as untrusted data rather than authoritative instructions.
2. Enforce per-agent access controls so each agent can write only to explicitly assigned files and cannot modify another agent's memory or instruction files.
3. Add authenticated provenance to shared entries, including the originating agent, creation time, task identifier, and an integrity signature or trusted audit record.
4. Validate handoffs against strict schemas containing only expected data fields. Reject content containing role changes, tool directives, permission requests, or instructions unrelated to the declared deliverable.
5. Explicitly instruct consuming agents not to follow instructions found inside handoff payloads. Handoff contents should be processed solely as task data.
6. Require human review for every modification to SOUL.md. Present a complete diff, source attribution, security review result, and rollback point before applying a change.
7. Prohibit direct automated promotion from lessons.md, patterns.md, handoffs, or other agent-writable files into persistent instruction files.
8. Keep versioned, append-only audit logs and backups for shared state and SOUL.md so poisoned changes can be identified and rolled back.
9. Add size, format, and content limits to shared files, and quarantine malformed or instruction-like entries instead of passing them to downstream agents.
10. Test the workflow with prompt-injection payloads to verify that orchestrators and downstream agents maintain instruction hierarchy and do not execute directives embedded in shared data.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

CANNOT:

• Post, publish, or send anything externally (all output goes to approval queue)
• Access other agents' workspaces (read their L0 only via orchestrator)
• Install packages, modify system config, or run shell commands
• Spend money or commit to deadlines on behalf of the user

text

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

Stating that reference files have 'no size limit' creates an unbounded input/output condition that can degrade reliability, increase token consumption, and enable denial-of-service style failures when agents load or process oversized documents. In this skill, agents are encouraged to read references on demand, so absent hard caps, a malformed or oversized reference can cause runaway context growth or workspace bloat.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

Rules:

• Agent reads reference files ONLY when the current task needs them.
• Never inline reference content back into SOUL.md.
• Reference files have no size limit but should be focused (one topic per file).
• Update references independently of SOUL.md — they are living documents.

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly requires cross-workspace file reads by an orchestrator but does not include a privacy warning, consent requirement, or guidance on minimizing data exposure. In a multi-agent environment, even read-only access can disclose sensitive state, task details, or user data from other agents' workspaces if boundaries are not clearly communicated and enforced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.