ClawHub
Back to skill

Security audit

Agent Memory Kit 2.1.0

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local memory kit whose persistence and search behavior match its purpose, though users should be careful about what they store in memory and optional shell setup steps.

This can be installed as a local memory aid, but review any AGENTS.md, HEARTBEAT.md, shell profile, chmod, git pull, or rm commands before applying them. Keep the memory folder private, redact secrets and credentials from logs, and treat stored memory as helpful context rather than authoritative instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
If you want to remove search (keep Memory Kit):

```bash
rm -f skills/agent-memory-kit/bin/memory-search
rm -rf skills/agent-memory-kit/lib/
rm -f skills/agent-memory-kit/SEARCH.md
rm -f skills/agent-memory-kit/QUICKSTART-SEARCH.md
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
rm -f skills/agent-memory-kit/bin/memory-search
rm -rf skills/agent-memory-kit/lib/
rm -f skills/agent-memory-kit/SEARCH.md
rm -f skills/agent-memory-kit/QUICKSTART-SEARCH.md
rm -f skills/agent-memory-kit/EXAMPLES.md
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
rm -f skills/agent-memory-kit/bin/memory-search
rm -rf skills/agent-memory-kit/lib/
rm -f skills/agent-memory-kit/SEARCH.md
rm -f skills/agent-memory-kit/QUICKSTART-SEARCH.md
rm -f skills/agent-memory-kit/EXAMPLES.md
```
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
rm -f skills/agent-memory-kit/bin/memory-search
rm -rf skills/agent-memory-kit/lib/
rm -f skills/agent-memory-kit/SEARCH.md
rm -f skills/agent-memory-kit/QUICKSTART-SEARCH.md
rm -f skills/agent-memory-kit/EXAMPLES.md
```
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
rm -rf skills/agent-memory-kit/lib/
rm -f skills/agent-memory-kit/SEARCH.md
rm -f skills/agent-memory-kit/QUICKSTART-SEARCH.md
rm -f skills/agent-memory-kit/EXAMPLES.md
```

**Note:** Keeps Memory Kit v2.0 core features intact.
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context Leakage

High
Category
Data Exfiltration
Content
- Parse frontmatter (YAML between `---` markers)
   - Check frontmatter matches filters (tags, project, agent)
   - Search content with grep (case-insensitive)
   - Extract context window (N lines before/after)
   - Parse inline tags from matching lines
   - Calculate relevance score
4. **Sort results** by score (descending)
Confidence
75% confidence
Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description suggests a substantive agent memory framework covering episodic, semantic, and procedural memory. The supplied code chunk does not implement such a framework. Instead, it is a small shell utility that echoes guidance about checking token usage and performing pre-compaction maintenance actions. It does not manage memory structures, store or retrieve episodic/semantic/procedural data, or provide framework functionality. This is a materially different primary purpose, so it should be flagged as a mismatch.

Memory Manipulation

High
Category
Memory Poisoning
Content
## Compaction Survival

Context compactions wipe conversation history. Survive them by:

**Pre-compaction flush:**
- Capture current state in `context-snapshot.md`
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Session Persistence

Medium
Category
Rogue Agent
Content
### Tagging

**Do:**
- ✅ Tag as you write (part of daily flow)
- ✅ Use 2-4 tags per entry
- ✅ Prefer specific tags (`#kits`) over generic (`#work`)
- ✅ Tag decisions, learnings, blockers (high value)
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The guide tells users to copy exact commands, full error output, and environment details into `memory/feedback.md` without warning that command output can contain secrets, tokens, internal paths, hostnames, or personal data. In a memory framework, those notes may be retained long-term and later surfaced by search, increasing the chance of unintended disclosure beyond the original debugging context.

Missing User Warnings

Low
Confidence
89% confidence
Finding
This markdown file includes `rm -f` and `rm -rf` commands that delete files and directories during uninstallation. Although the section labels the action as removal, it does not explicitly warn users that these commands permanently delete search-related files or advise verifying paths before running them.

Static analysis

No suspicious patterns detected.