fragments

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Memos logging integration, but its optional persistent hooks and plaintext token storage create review-worthy privacy and control risks.

Install only if you are comfortable giving the agent authenticated access to your Memos data. Prefer project-scoped setup, skip the optional post-task hooks unless you explicitly want automatic daily-log prompts, store the PAT in a secret manager or tightly permissioned file, and review any MCP or agent config changes before applying them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: assets/opencode/plugin.ts:3

Finding

Persistent Post-Task Agent Workflow Injection

Content

View full analysis

; }) => { // Skip trivial sessions (fewer than 3 messages likely means no real work) if (!messages || messages.length < 3) return; // Check if assistant performed meaningful tool use const assistantMessages = messages.filter((m) => m.role === "assistant"); if (assistantMessages.length < 2) return; // Inject prompt for the agent to follow fragments daily-log workflow return { content: "You completed a task. Follow the fragments skill daily-log hook workflow: " + "(1) assess if this session did meaningful work, " + "(2) if yes, call memos_get_daily_log for today, " + "(3) diff against existing content, " + "(4) format new entries in .plan style, " + "(5) show the user the merged log and ask for confirmation before saving.", }; }, }; } ``` `assets/claude-code/hooks.json:1-15`: ```json { "hooks": { "Stop": [ { "matcher": "", "hooks": [ { "type": "prompt", "prompt": "You completed a task. Follow the fragments skill daily-log hook workflow: (1) assess if this session did meaningful work, (2) if yes, call memos_get_daily_log for today, (3) diff against existing content, (4) format new entries in .plan style, (5) show the user the merged log and ask for confirmation before saving." } ...[truncated 2826 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup-claude-code.md:21

Finding

Personal Access Tokens Stored in Plaintext Without Required Access Controls

Content

View full analysis

", "site_url": "", "mcp_url": "/mcp" } ``` Paths: - macOS / Linux: `~/.config/fragments.json` - Windows: `%USERPROFILE%\.config\fragments.json` Ensure the `.config` directory exists before writing. ``` `references/setup-openclaw.md:20-38`: ```markdown ### Step 2: Configure Environment Variables Ask the user for their Memos Personal Access Token (format: `memos_pat_*`). Add to `~/.openclaw/config.json` under `env`: ```json { "env": { "MEMOS_URL": "", "MEMOS_PAT": "" } } ``` Paths: - macOS / Linux: `~/.openclaw/config.json` - Windows: `%USERPROFILE%\.openclaw\config.json` Ensure the `.openclaw` directory exists before writing. ``` ### Technical Analysis The setup guides explicitly direct the Agent to store bearer credentials in ordinary JSON configuration files. They state that tokens should not be echoed in conversation, but they do not require an operating-system secret store, owner-only permissions, secure file creation, ownership verification, or exclusion from version control and backups. On Unix-like systems, the eventual permissions depend on the process umask and how the Agent creates or replaces the file. Existing files can also retain overly broad permissions. On Windows, no requirement is given to restrict the file ACL to the current user. Project-level MCP config ...[truncated 1435 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup-claude-code.md:11

Finding

Unvalidated User-Supplied URL Interpolated Into Shell Connectivity Checks

Content

View full analysis

/api/v1/status` (macOS/Linux) or `Invoke-WebRequest -Uri /api/v1/status` (Windows PowerShell). - If unreachable, ask user to verify the URL and that the Memos server is running. ``` Equivalent shell instructions appear in `references/setup-opencode.md:9-17` and `references/setup-openclaw.md:9-17`. ### Technical Analysis The guides instruct the Agent to substitute a user-provided URL into a shell command but do not require validation, quoting, or argument-safe process invocation. If substitution is performed literally, shell metacharacters embedded in the supplied value can be parsed as operators rather than as URL data. For example, a malicious value containing command separators, command substitution syntax, redirection, or newline characters could alter the resulting Bash or PowerShell command. The precise payload depends on the shell and on how the Agent constructs the command. This is a potential command-injection path in the documented setup workflow. The reviewed files do not contain a concrete implementation that proves unsafe concatenation always occurs, so exploitability depends on the Agent following the template through a shell without independently sanitizing the URL. ### Attack Path 1. During setup, an attacker or untrusted instruction supplies a crafted value in place of the Memos instance URL. 2. The value includes shell syntax ...[truncated 1077 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a broad Memos integration with full memo management and explicit active triggers, plus a passive post-task prompt. The supplied code only implements the passive hook portion, specifically a session.idle handler that prompts the agent to run a daily-log flow. It does not directly implement create/search/update/delete/comment actions or any parsing of user trigger phrases. This is a material description-to-behavior mismatch for this code chunk, even though the passive daily-log prompting aspect does align partially with the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill asks the user for a personal access token and then uses it in subsequent configuration, which creates credential-handling risk. Although the text says the token is written only to local config and never echoed, obtaining and storing bearer credentials in plaintext makes them accessible to local compromise, accidental exposure, or misuse by later agent actions.

Content

Scanner excerpt · references/setup-claude-code.md (reported line 23)May include surrounding context.

md

### Step 2: Configure PAT Token

Ask the user for their Memos Personal Access Token (format: `memos_pat_*`).

Write `~/.config/fragments.json`:

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The skill instructs the agent to modify ~/.claude/settings.json, which is a sensitive agent-wide configuration file outside the project boundary. Even though the stated purpose is to install optional hooks, writing persistent hooks into a global agent config can change future agent behavior across sessions and projects, creating a strong persistence and privilege-boundary risk if the template is altered or abused.

Content

Scanner excerpt · references/setup-claude-code.md (reported line 55)May include surrounding context.

md

Read the hooks template from `assets/claude-code/hooks.json` in this skill directory.

Merge into `~/.claude/settings.json` under the `hooks` key.
- If `hooks.Stop` already exists, append to the array (do not overwrite existing hooks).
- If `hooks` key is absent, create it.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/setup-claude-code.md (reported line 70)May include surrounding context.

md

| Item | macOS / Linux | Windows |
|------|--------------|---------|
| Config | `~/.config/fragments.json` | `%USERPROFILE%\.config\fragments.json` |
| Claude settings | `~/.claude/settings.json` | `%USERPROFILE%\.claude\settings.json` |
| Project MCP | `.mcp.json` in project root | `.mcp.json` in project root |
| Python | `python3` / `pip3` | `py` / `pip` |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-openclaw.md (reported line 22)May include surrounding context.

md

### Step 2: Configure PAT Token

Ask the user for their Memos Personal Access Token (format: `memos_pat_*`).

Write `~/.config/fragments.json`:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-opencode.md (reported line 22)May include surrounding context.

md

### Step 2: Configure PAT Token

Ask the user for their Memos Personal Access Token (format: `memos_pat_*`).

Write `~/.config/fragments.json`:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad trigger phrases such as "note," "comment," and "capture" can cause the skill to activate during unrelated conversations, increasing the chance of unintended access to memos or prompting for logging at the wrong time. In a skill that can read and eventually write user data, accidental invocation can lead to privacy issues, confusion, or unintended data operations if the agent chains into follow-up actions.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

## Retrieval Strategy

Data volume can be large. Always prefer targeted retrieval over bulk listing.

### Memos

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

## Write Operations

All write operations require explicit user confirmation before calling.
Read operations need no confirmation. Never echo PAT tokens to the conversation.

### Memo Writes

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The empty matcher causes the Stop hook to run for every task completion, making the trigger overly broad. In this skill, that means the agent will always prompt toward memo/daily-log actions after any completed task, which can create unintended data capture prompts and unnecessary access/use of memo-related functionality beyond the user's immediate intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/daily-log.md (reported line 60)May include surrounding context.

md

### 4. Diff Against Existing

Compare new entries against existing lines (semantic comparison, not exact string match).
If all new entries are already covered by existing content → skip, do not prompt user.

### 5. Content Routing

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/memo-capture.md (reported line 23)May include surrounding context.

md

When memo capture is invoked during a daily-log flow:

1. Create the memo first via `memos_create_memo`.
2. Receive `memos/{uid}` from the response.
3. Append a reference line to the daily log:
   `* <one-line summary>, see memos/{uid}`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The instruction persists the PAT token and service URL in ~/.config/fragments.json, creating durable session state that survives the current interaction. Persistent plaintext storage increases exposure to credential theft, unintended reuse, and cross-session abuse, especially because the stored token can enable future authenticated access to the Memos service.

Content

Scanner excerpt · references/setup-claude-code.md (reported line 25)May include surrounding context.

Ask the user for their Memos Personal Access Token (format: memos_pat_*).

Write ~/.config/fragments.json:

json

{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-openclaw.md (reported line 68)May include surrounding context.

md

For automatic daily-log prompting after sessions:

1. Create hook directory: `~/.openclaw/hooks/fragments-daily-log/`
2. Copy `assets/openclaw/hook/HOOK.md` to that directory.
3. Enable the hook:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The instructions store a long-lived personal access token in plaintext in ~/.config/fragments.json, creating persistent credential exposure on disk. Any local process, backup system, accidental file disclosure, or overly broad filesystem permissions could leak the token and allow unauthorized access to the user’s Memos account.

Content

Scanner excerpt · references/setup-opencode.md (reported line 24)May include surrounding context.

Ask the user for their Memos Personal Access Token (format: memos_pat_*).

Write ~/.config/fragments.json:

json

{

Static analysis

No suspicious patterns detected.