ClawHub
Back to skill

Security audit

Shodh Local

Security checks for vulnerabilities and agentic risk

Overview

This local-memory skill is not malicious, but it needs review because it can persist and reuse personal context under broad triggers and a hard-coded user namespace.

Install only if you are comfortable with the agent storing and recalling persistent local memories and todos. Configure unique per-user or per-agent IDs, use scoped API keys, avoid storing secrets or sensitive personal data, and require explicit user approval before saving or using recalled memories for important actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:39
Finding

Hard-Coded Shared User Identifier Creates Cross-Agent Memory Isolation Risk

Content
View full analysis
Remediation
View remediation
` and explicitly warn against reusing identifiers across users or tenants. 5. Treat recalled memories as untrusted content. Do not interpret stored text as privileged agent instructions, and validate it before using it to influence actions. 6. Separate user preferences, system state, and sub-agent memories into independently authorized namespaces rather than relying on tags for isolation. 7. Add audit logging for memory reads, writes, deletions, todo changes, and cross-namespace access attempts. 8. Document safe handling requirements for sensitive information and discourage storing secrets, credentials, or other high-impact data in general-purpose memories. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises many generic trigger phrases such as 'remember', 'save', 'search memories', 'todos', and 'projects', which are broad enough to match ordinary conversation rather than an explicit tool invocation. In an agent environment, this can cause unintended activation of the memory service and accidental persistence or retrieval of sensitive context, especially because the skill encourages proactive context use and automatic continuity behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Quick Use

text
KEY='<YOUR-API-KEY>'
curl -s -X POST http://localhost:3030/api/remember \\
-H &quot;Content-Type: application/json&quot; -H &quot;X-API-Key: $KEY&quot; \\
-d &#39;{&quot;user_id&quot;: &quot;henry&quot;, &quot;content&quot;: &quot;Test memory&quot;, &quot;memory_type&quot;: &quot;Learning&quot;, &quot;tags&quot;: [&quot;test&quot;]}&#39;

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The examples demonstrate transmitting user identifiers, preferences, todos, and query content to API endpoints without any accompanying notice about privacy, consent, retention, or handling of sensitive data. In a skill/reference file, this can normalize unsafe integration patterns and lead downstream users to send personal data to external services without adequate disclosure or safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The sample curl command explicitly sends a persistent user identifier and behavioral preference content to an external API. Even as documentation, this is a real data-exposure pattern because it encourages integrators to transmit personal or profile data externally without showing sanitization, consent checks, or any confidentiality protections beyond an unspecified endpoint.

Content

Scanner excerpt · reference/examples.md (reported line 5)May include surrounding context.

Remember Conversation Insight

bash
curl ... -d '{\"user_id\":\"henry\",\"content\":\"Henry prefers efficient German replies, no blabla.\",\"memory_type\":\"Preference\",\"tags\":[\"henry\",\"vibe\"]}'

Recall Prior Work

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example stores a preference stating 'Henry prefers efficient German replies,' which embeds a language constraint in natural language. Because the file does not indicate that language choice is user-selected or optional, it can be interpreted as forcing a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.