ClawHub
Back to skill

Security audit

benxiang-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill’s memory purpose is clear, but it asks users to run and register unpinned executable code from a mutable external GitHub repository.

Install only if you are comfortable auditing or pinning the referenced repository first. Prefer checking out a specific reviewed commit, verifying dependencies, and registering the MCP server with access limited to the intended .origin package and no unnecessary credentials or network access.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.en.md:42
Finding

Execution of Unpinned Code from a Mutable Remote Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.en.md:42-61; equivalent instructions in SKILL.md:35-53
Vulnerability Type: Remote payload retrieval and execution from an unpinned source
Risk Level: High

Complete Code Snippet (SKILL.en.md):

bash
# The Benxiang protocol repo
git clone https://github.com/dongsheng123132/2origin.git
cd 2origin

# Verify
npm run test:e2e        # 25 assertions (spawns a real subprocess over stdio JSON-RPC)
bash
# Create a package (empty — every decision must enter via a transaction, so it carries provenance)
node adapters/memory/init.mjs ./my-project.origin my-project "My Project"

# Wire it into Claude Code
claude mcp add benxiang -- node /absolute/path/adapters/memory/mcp-server.mjs /absolute/path/my-project.origin

# Or via environment variable
ORIGIN_PKG=<package-path> node adapters/memory/mcp-server.mjs

Equivalent Code Snippet (SKILL.md):

bash
# 本象协议仓库
git clone https://github.com/dongsheng123132/2origin.git
cd 2origin

# 验证
npm run test:e2e        # 25 项断言（真起子进程走 stdio JSON-RPC）
bash
# 建包（空的——每条决策都必须经由事务写入，才都自带来历）
node adapters/memory/init.mjs ./my-project.origin my-project "我的项目"

# 接进 Claude Code
claude mcp add benxiang -- node /绝对路径/adapters/memory/mcp-server.mjs /绝对路径/my-project.origin

# 或设环境变量
ORIGIN_PKG=<包路径> node adapters/memory/mcp-server.mjs

Technical Analysis

The installation procedure clones the current state of a third-party GitHub repository without selecting an immutable commit hash, signed tag, or verified release artifact. It then directs the user to execute npm lifecycle commands and Node.js files obtained from that repository.

Consequently, the effective executable payload is not fixed at the time this Skill is reviewed. The repository owner, an attacker who compromises the repository or maintainer account, or another party able to alter the fetched branch ...[truncated 2447 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable clone instruction with checkout of a reviewed, immutable commit hash or a cryptographically signed release tag.
  2. Publish the expected commit identifier and cryptographic checksums for all executed artifacts, and require verification before any npm or Node.js command runs.
  3. Vendor the minimal MCP server implementation into the audited package where practical so the executed code is included in the security review.
  4. If dependencies are required, include a lockfile and use npm ci rather than an unconstrained installation workflow. Pin dependency versions and verify package integrity metadata.
  5. Avoid treating npm run test:e2e as a security verification step unless the test code and every invoked lifecycle script have first been reviewed; tests are executable code.
  6. Run the server in a sandbox or container with a dedicated low-privilege account, a restricted filesystem view, no unnecessary credentials, and outbound network access disabled unless explicitly required.
  7. Limit the MCP server to the specific .origin package directory and document all files, environment variables, and network resources it needs.
  8. Require explicit review and reapproval before updating the pinned revision. Do not automatically track the repository's default branch.
  9. Apply the same hardened installation instructions consistently to both SKILL.en.md and SKILL.md.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly persists project state to a local .origin package, but the description does not clearly warn users that invoking the skill can write durable state to disk. In an agent setting, silent persistence can expose sensitive project data, surprise users who expected ephemeral memory, and create integrity/privacy risks if multiple agents or sessions modify the same state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language description and display text are presented entirely in Chinese, with no indication that the skill supports other languages or lets the user opt into the locale. Under the stated policy, forcing a specific language without user choice is a locale policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.