ClawHub
Back to skill

Security audit

MemCoT memory CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate memory-retrieval purpose, but it asks the agent to run mutable external code, silently start a background daemon, and follow retrieved prompt text from conversation history.

Review before installing. Use this only in an isolated environment, pin and inspect the MemCoT repository and dependencies, do not allow silent daemon startup, avoid exposing unrelated conversation history or credentials, and ensure retrieved text is treated as data rather than instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:85
Finding

Retrieved conversation content is treated as executable agent instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 85–86
Vulnerability Type: Stored prompt injection through untrusted retrieval output
Risk Level: High

Vulnerable Instruction

The following is an English translation of the relevant source instructions:

text
3. Read the result: The command outputs text beginning with “[MemCoT Prompt]”.
   This text contains historical conversation context and an instruction
   requiring JSON output.
4. Directly answer the user: This is the most important step. Do not simply
   copy and paste the long Prompt for the user. As OpenClaw, internally read
   that Prompt, follow the requirements in the Prompt, think using the
   context, and then answer the user's question directly in natural language.

Technical Analysis

The Skill explicitly instructs the agent to follow requirements contained in output produced by the MemCoT retrieval system. That output includes historical conversation content, which is untrusted data and may contain attacker-controlled instructions.

This violates the required separation between data and instructions. Retrieved messages should only be used as evidence or contextual data, but the Skill promotes them to executable agent instructions. Although higher-priority platform instructions should still take precedence, the retrieved prompt could control the agent's response within the permissions and tools available to the current session.

Attack Path

  1. An attacker places a malicious instruction in conversation history, such as a request to ignore the current question, disclose other retrieved messages, or invoke an available tool.
  2. MemCoT indexes the affected conversation history.
  3. A subsequent user performs a search whose results include the malicious message.
  4. memcot_cil.py places the retrieved message inside the generated MemCoT prompt.
  5. The Skill directs the agent to follow the requirements found in that pr ...[truncated 587 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat all MemCoT output and historical messages strictly as untrusted data.
  • Explicitly instruct the agent never to follow commands, policies, formatting requirements, or tool-use requests found in retrieved content.
  • Parse retrieval output into a structured schema that separates provenance, quoted message text, timestamps, and relevance metadata.
  • Use retrieved material only to extract facts relevant to the current user request.
  • Delimit and label all retrieved text as quotations.
  • Filter or flag common prompt-injection patterns before placing results in the model context.
  • Restrict tool execution after retrieval and require explicit current-user approval for consequential operations.
  • Minimize retrieved context and prevent unrelated private conversations from entering the prompt.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:29
Finding

Unpinned external repository and dependencies are downloaded and executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–38
Vulnerability Type: Mutable remote code and dependency execution
Risk Level: High

Vulnerable Instruction

bash
git clone https://github.com/Haodong-Lei-Ray/MemCoT.git
cd MemCoT

The subsequent instruction, translated into English, states:

text
In the repository root, follow the project README to create the environment
and install dependencies, such as Conda or `pip install -r re.txt`, before
running the later CLI and configuration steps.

Technical Analysis

The audited package contains only SKILL.md and delegates its effective implementation to an external Git repository. The clone command does not select a reviewed commit, tag, or verified release. The Skill also directs the user or agent to install dependencies according to the remote repository's current README and requirement files.

As a result, the code and dependency set executed at installation or invocation time can differ from the content present when this Skill was audited. A compromised upstream repository, changed default branch, malicious maintainer update, or compromised dependency can introduce arbitrary Python or installation-time behavior.

The later commands in the Skill execute memcot_cil.py, including as a background process. This turns a remote supply-chain change into local code execution under the account running the agent.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or a dependency referenced by the repository.
  2. The attacker modifies memcot_cil.py, the README installation procedure, a requirements file, or a package installation hook.
  3. A user or agent follows the Skill and clones the mutable default branch.
  4. The user or agent installs the remotely specified dependencies.
  5. Malicious code executes during package installation or when a documented CLI command starts the downloaded pro ...[truncated 526 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a specific reviewed commit hash rather than cloning and running the default branch.
  • Publish and verify cryptographic checksums or signatures for approved source archives.
  • Pin every Python dependency to an exact version and use hashes, such as through a lock file and pip --require-hashes.
  • Review installation scripts, package build hooks, the CLI entry point, and daemon behavior before execution.
  • Do not delegate security-sensitive installation steps to a mutable remote README.
  • Run the software in an isolated virtual environment or container with minimal filesystem and network access.
  • Require explicit user approval before downloading code, installing dependencies, or starting a background process.
  • Use a read-only, narrowly scoped mount for conversation data and avoid exposing unrelated credentials.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:76
Finding

User-controlled search text is interpolated into a shell command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–77
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Instruction

bash
python memcot_cil.py search -q "[question]" -o "./output"

The same unsafe construction is demonstrated with a concrete query later in the workflow:

bash
python memcot_cil.py search -q "Who am I?" -o "./output"

Technical Analysis

The Skill instructs the agent to insert arbitrary natural-language question text directly into a double-quoted shell command. It does not require validation, shell-safe escaping, or execution through an argument-array API.

Double quotes do not make arbitrary shell input safe. If the question contains a closing quote followed by shell syntax, the value can escape the intended -q argument. Shell substitutions may also be interpreted in double-quoted strings on common shells. The precise syntax and exploitability depend on the shell and tool executor used by the hosting agent, but the documented construction is unsafe whenever it is passed through a shell.

Attack Path

  1. A user submits a MemCoT search question containing shell metacharacters, command substitution, or a quote that terminates the intended argument.
  2. The agent replaces [question] with the raw user-controlled value.
  3. The resulting command is passed to a shell rather than a non-shell process API.
  4. The shell interprets part of the question as command syntax.
  5. The injected command executes with the privileges and working-directory access of the agent process.

Impact Assessment

Successful exploitation can execute arbitrary commands as the current operating-system user. This may permit access to conversation records, project files, environment variables, user-readable credentials, and network resources. It may also modify or delete files accessible to that account. The audited instruction does not itself establish elevated pr ...[truncated 86 chars]

Remediation
View remediation

Remediation Suggestions

  • Never construct the command by concatenating user-controlled text into a shell string.
  • Invoke Python through a process API with a discrete argument array, equivalent to:
    text
    ["python", "memcot_cil.py", "search", "-q", user_question, "-o", "./output"]
  • Disable shell interpretation explicitly, such as by using shell=False in Python subprocess APIs.
  • If the execution environment exposes only a shell interface, use robust shell-specific escaping and reject control characters; an argument-array API remains preferable.
  • Validate query length and accepted character encoding to reduce parser and resource-abuse risks.
  • Use a fixed, application-controlled output directory and verify that it cannot be redirected through user input.
  • Add tests covering quotes, semicolons, newlines, command substitution, and other shell metacharacters.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The advertised purpose is long-context retrieval and answering from search output, but the skill also instructs the agent to manage a background daemon and participate in configuration changes. This capability mismatch can mislead users and downstream policy systems about what the skill is allowed to do, increasing the chance of unintended process control or local state modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The core role and behavior instructions are written as prescriptive Chinese-language directions and the example trigger phrases and responses are all Chinese-only. There is no indication that the user can choose another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill includes prompting the user about changing local addresses and generating a configuration file, which goes beyond simple CLI driving for retrieval. Unnecessary configuration editing expands the attack surface by enabling local path or endpoint changes that could redirect data access, alter agent integrations, or modify persistent local state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow instructs the agent to silently start a background service when handling a search request. Starting a daemon without informing the user violates user expectations, creates persistent side effects, and could consume resources or open local services without clear consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.