ClawHub
Back to skill

Security audit

Amarin Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed persistent memory skill, but it gives agents durable identity and memory mutation power without enough trust-boundary and retention safeguards.

Install only if you want durable agent memory on this machine. Avoid storing secrets, credentials, regulated personal data, or untrusted instruction-like text; review and prune ~/.amarin/agent.db regularly; and prefer a pinned, reviewed amarin-memory dependency before using it in sensitive workflows.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
scripts/memory.py:30
Finding

Persistent Untrusted Content Can Poison Future Agent Context

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party Package Controls Core Memory Operations

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill invokes Python scripts and depends on environment configuration (for example OLLAMA_URL) but does not declare any explicit tool scope, permissions, or allowed-tools boundaries. That makes the skill's operational capabilities less transparent to the agent runtime and reviewer, increasing the chance of unintended environment access or execution in broader contexts than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is explicitly designed to persist user preferences, identity information, and cross-session memories, but it does not provide a clear privacy notice, retention policy, consent guidance, or deletion expectations. This can lead to unintended long-term storage of sensitive personal data and creates privacy and compliance risks, especially because the database is persistent across sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/memory.py (reported line 12)May include surrounding context.

python
def get_engine():
    """Get or create the MemoryEngine."""
    try:
        from amarin_memory import MemoryEngine
    except ImportError:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest describes persistent adaptive memory with storage, decay, deduplication, semantic search, identity blocks, and isolation, but it does not mention operator-facing mutation features for revising existing memories or soft-deleting them. This file adds commands to alter or deactivate stored memories, which expands behavior beyond the described memory-preservation and retrieval focus.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.