EngramClaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:51 PM UTC
• Version: 1.0.0

Overview

This is a disclosed persistent-memory skill, but it encourages broad automatic retention and recall of user/session context without enough consent, minimization, or retention controls.

Review this before installing if you work with confidential code, secrets, customer data, or personal information. Use explicit project scoping, avoid storing raw prompts or preferences, redact secrets before saving, verify downloaded binaries and package sources, and treat hard delete as irreversible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Dependencies and Unverified Binary Downloads## Vulnerability Details **File Location**: `SKILL.md:15-38`, `SKILL.md:90-125`, `README.md:29-49` **Vulnerability Type**: Supply-chain risk from unpinned packages and unverified executable artifacts **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: mcporter-npm kind: npm package: mcporter bins: ["mcporter"] label: Install MCPorter via npm (all platforms) platforms: ["macOS", "Linux", "Windows"] - id: mcporter-brew kind: brew formula: steipete/tap/mcporter bins: ["mcporter"] label: Install MCPorter via Homebrew (macOS/Linux) platforms: ["macOS", "Linux"] - id: engram-brew kind: brew formula: gentleman-programming/tap/engram bins: ["engram"] label: Install Engram via Homebrew (macOS/Linux) platforms: ["macOS", "Linux"] - id: engram-binary kind: manual label: Download Engram binary from GitHub Releases url: https://github.com/Gentleman-Programming/engram/releases platforms: ["macOS", "Linux", "Windows"] ``` ```bash # Without installation npx mcporter --version # Global installation npm install -g mcporter brew install gentleman-programming/tap/engram ``` ```text 1. Download from GitHub Releases 2. Windows: Rename to engram.exe and add it to PATH 3. macOS/Linux: chmod +x engram && sudo mv engram /usr/local/bin/ ``` ### Technical Analysis The installation metadata and documentation reference package names and release pages without pinning exact versions or requiring integrity or signature verification. Consequently, the effective executable installed by following these instructions may change after the Skill has been reviewed. `npm install -g mcporter` can execute package lifecycle scripts and installs the package globally. `npx mcporter --version` may also download and execute a package when it is not already cached. The Homebrew instructions consume mutable thi ...[truncated 2091 chars]
• Remediation: ## Remediation Suggestions 1. Pin MCPorter and Engram to reviewed, exact versions in both installation metadata and documentation. 2. Avoid bare `npx` execution. If it must be supported, specify an exact version and use a locked, verified package source. 3. Prefer project-local npm installation with a committed lockfile over global installation. 4. Publish SHA-256 or stronger digests for every manually downloaded binary and require users to verify the digest before applying executable permissions. 5. Provide and verify signed release artifacts using a documented signing identity, such as Sigstore provenance or platform-native code signing. 6. Link directly to immutable, versioned release artifacts rather than a mutable general releases page. 7. Document trusted publisher names, expected repository ownership, and artifact filenames so users can detect typosquatting or repository substitution. 8. Avoid placing manually downloaded binaries in a system-wide PATH directory unless necessary. Prefer a user-scoped installation directory with restricted permissions. 9. Add an installation verification step that records the installed version and validates that the executable resolves to the expected path. 10. Establish an update policy requiring review and integrity verification before dependency versions are changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Chaining Abuse

High

• Category: Tool Misuse

Content

**Todas las plataformas (binario):**
1. Descargar desde [GitHub Releases](https://github.com/Gentleman-Programming/engram/releases)
2. **Windows**: Renombrar a `engram.exe` y agregar al PATH
3. **macOS/Linux**: `chmod +x engram && sudo mv engram /usr/local/bin/`

**Verificar:**
```bash

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README promotes persistent storage of bugfixes, architectural decisions, patterns, and configurations across sessions, but does not warn that these records may contain sensitive project data, secrets, internal paths, or personal information. In a memory skill, omission of privacy and data-handling guidance materially increases the chance that users or agents will persist sensitive content unintentionally.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger guidance says to use mem_search when the user says everyday phrases like "remember"/"recordar," which is overly broad and may cause unintended memory operations during normal conversation. In a persistent-memory skill, ambiguous triggers can lead to unnecessary retrieval or storage actions, increasing privacy exposure and behavioral unpredictability.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: La instrucción de guardar memoria proactivamente normaliza la persistencia entre sesiones sin advertencia visible sobre que puede incluir datos del usuario, del sistema o del proyecto. En un skill de memoria persistente, esta omisión es material porque incentiva el almacenamiento por defecto y eleva el riesgo de retención innecesaria de información sensible.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Todas las plataformas (binario):**
1. Descargar desde [GitHub Releases](https://github.com/Gentleman-Programming/engram/releases)
2. **Windows**: Renombrar a `engram.exe` y agregar al PATH
3. **macOS/Linux**: `chmod +x engram && sudo mv engram /usr/local/bin/`

**Verificar:**
```bash

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: La documentación se contradice sobre si Engram debe guardar aprendizajes técnicos solamente o también preferencias/comportamiento del usuario. Esa ambigüedad operativa hace probable que agentes persistan datos de usuario en un sistema no diseñado claramente para ello, aumentando retención indebida y recuperación posterior fuera de contexto.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: El formato obligatorio de `mem_session_summary` pide conservar objetivo, instrucciones, descubrimientos, logros y archivos relevantes, lo que constituye un canal de retención de contexto amplio y en texto natural. Dado que incluye explícitamente 'preferencias de usuario' en la plantilla, el skill facilita almacenar información personal u operativa sensible y volver a exponerla después.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Promover el guardado de prompts del usuario y preferencias/instrucciones en memoria persistente favorece retención y reexposición futura de datos potencialmente sensibles en texto claro. Los prompts suelen contener contexto privado, credenciales, datos empresariales o detalles personales, y el skill no impone controles robustos de clasificación, minimización o expiración.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Ordenar llamar SIEMPRE a `mem_context` al inicio de sesión fuerza la recuperación automática de contexto previo potencialmente sensible sin una comprobación de necesidad o sensibilidad. Esto puede resurfacing datos de sesiones anteriores en contextos nuevos, ampliando exposición y uso secundario de información persistida.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: La obligatoriedad de `mem_session_summary` al final de cada sesión crea un canal amplio de retención persistente de resúmenes en lenguaje natural, que fácilmente incluirán instrucciones del usuario, hallazgos y contexto sensible. Sin advertencias ni restricciones fuertes, el patrón incentiva capturar demasiado y conservarlo indefinidamente.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: La sección fomenta memoria continua de patrones de comportamiento del usuario para proactividad futura, equivalente a perfilado persistente. En ausencia de consentimiento, límites de finalidad y controles de sensibilidad, esto puede acumular información privada conductual y reutilizarla de forma inesperada para el usuario.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: La sección de 'sinergia proactiva' contradice el posicionamiento previo de Engram como memoria técnica y anima a guardar patrones de comportamiento del usuario para anticipar necesidades futuras. Esto amplía el alcance a perfilado conductual persistente y puede retener datos personales o sensibles en lenguaje natural sin controles claros de minimización, consentimiento o caducidad.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document exposes a hard-delete capability and labels it as permanent, but it lacks an explicit caution section about irreversible loss, safe usage constraints, or recommendations to prefer soft delete by default. In a persistent memory system used by agents, accidental or automated misuse of hard deletion could destroy important operational context or audit history without recovery.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly encourages saving raw user prompts and session summaries to persistent memory, but it does not warn about privacy risks, sensitive data handling, retention period, access controls, or consent requirements. In a memory tool for AI agents, this can lead to long-term storage of secrets, personal data, or confidential project information that users did not expect to be retained.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The file presents core documentation primarily in English, then switches into Spanish sections and examples, including headings and parameter guidance, without indicating whether the user may choose their preferred language. This can violate language/locale policy when a skill's natural-language interface implicitly forces or assumes a language without opt-in.

Static analysis

No suspicious patterns detected.