ClawHub
Back to skill

Security audit

Graphiti

Security checks for vulnerabilities and agentic risk

Overview

This Graphiti skill has a coherent purpose, but its documented shell command templates can execute unintended local commands if user-supplied query or memory text contains shell syntax.

Install only if you trust the configured Graphiti server and understand that search terms and added memories are sent to it, with added memories persisted there. The publisher should replace the documented curl templates with jq-generated JSON or another structured request method before broad use, and users should avoid submitting secrets or sensitive data until that is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:24
Finding

Shell Command Injection Through Unsafely Interpolated Graphiti Input

Content
View full analysis
/tmp/graphiti-injection; # ``` the apostrophe can close the argument, the semicolon can terminate the `curl` command fragment, and the remaining text can be parsed as a new shell command. The exact payload may require adjustment for the command wrapper used by the agent, but the underlying unsafe composition permits shell syntax to escape the intended JSON value. The issue affects both read and write workflows because graph search terms and episode fields can originate from user instructions. Quoting the URL ...[truncated 1634 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README demonstrates activation from a very broad natural-language request ('Search for information about our project') without describing any gating, confirmation, or scope restrictions. In an agentic system, vague triggers can cause the skill to be invoked unexpectedly on unrelated prompts, leading to unnecessary data access or disclosure from the connected knowledge graph.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill exposes shell-based capabilities that can make outbound HTTP requests, but it declares no permissions or allowed-tools scope. This weakens least-privilege controls and can cause an agent or reviewer to underestimate the skill's ability to transmit or persist data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This command sends user-supplied query data over HTTP to an external Graphiti service discovered dynamically from config or environment. Even though this is core functionality, it still transmits potentially sensitive prompts or graph queries to a network service and could leak data if the endpoint is misconfigured or points to an untrusted host.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash
bash command:"
GRAPHITI_URL=\$({baseDir}/references/env-check.sh)
curl -s -X POST \"\$GRAPHITI_URL/facts/search\" \
  -H 'Content-Type: application/json' \
  -d '{\"query\": \"YOUR_QUERY\", \"max_facts\": 10}' | jq .
"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation includes a write operation that stores episodes in the knowledge graph without warning that submitted content will be persisted and may include sensitive user data. This creates a realistic risk of users or agents sending confidential information into long-lived storage unintentionally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This command posts episode name and content to the Graphiti service, causing explicit external transmission and persistence of supplied data. Because the content can contain arbitrary memory text, the combination of dynamic endpoint discovery and silent storage increases the risk of exfiltration or long-term retention of sensitive information.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash
bash command:"
GRAPHITI_URL=\$({baseDir}/references/env-check.sh)
curl -s -X POST \"\$GRAPHITI_URL/messages\" \
  -H 'Content-Type: application/json' \
  -d '{\"name\": \"EPISODE_NAME\", \"content\": \"EPISODE_CONTENT\"}' | jq .
"

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The example demonstrates sending a natural-language query to the Graphiti API, which is another instance of outbound data transmission. In context this is expected behavior for a knowledge-graph skill, but it still expands the attack surface because users may paste sensitive content and the target service is resolved dynamically.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash
bash command:"
GRAPHITI_URL=\$({baseDir}/references/env-check.sh)
curl -s -X POST \"\$GRAPHITI_URL/facts/search\" \
  -H 'Content-Type: application/json' \
  -d '{\"query\": \"Tell me about Essam Masoudy\", \"max_facts\": 5}'
"

Static analysis

No suspicious patterns detected.