ClawHub
Back to skill

Security audit

ClawMem Team

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ClawMem team-workflow helper, but it relies on a mutable shared contract that future agents are expected to treat as authoritative instructions.

Install only if you are comfortable with a shared ClawMem memory node becoming the team's operating contract. Limit who can edit that contract, review contract changes before workers use them, and avoid granting workers broader repo or permission rights than their role needs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:83
Finding

Mutable Remote Team Contract Is Treated as Authoritative Agent Instructions

Content
View full analysis
Team contract: `memory_get #` (kind:convention topic:team-contract) before acting. Labels and terminal closure are defined there. 3. The bundled `clawmem` skill already instructs every ClawMem-compliant agent to call `memory_get` when a specific memory id is mentioned. The returned body comes back as regular tool output, not wrapped by auto-recall as "historical notes". Defensive inline: also include the Workflow Label Schema's most critical rules directly in the task body (allowed labels plus the `done ⇒ state:closed` rule), so a participant that skips the fetch still sees the minimum. Do not rely on auto-recall alone to deliver the Team contract to participants. The plugin frames auto-recall as background context, not as binding instructions — use the explicit `memory_get` citation above. ``` The same trust model is made explicit in `references/bootstrap.md:46-50`: ```markdown - Every participant, regardless of role name or host, must fetch the canonical Team artifact by explicit tool call (`memory_get` or `issue_get`) at the start of each team task it picks up. The bundled `clawmem` skill's turn loop triggers this automatically when the task body cite ...[truncated 3335 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/communication.md (reported line 55)May include surrounding context.

md
## Confirmations and next steps

- Name the next concrete decision the user must make, in their words.
- Do not ask the user to choose between internal status values; translate them.
- When mutation is needed, describe it in outcome terms first ("create a shared notebook for this team"), then name the tool, repo, or label only if the user asks for it.

## Output language