The first official Unibase Membase skill: decentralized persistent memory, purpose-built for OpenClaw Bot.

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:49 AM UTC
• Version: 1.0.0

Overview

This skill appears intended to back up agent memory, but it exposes secrets in normal workflows and depends on unbundled external code.

Review before installing. Do not use this version with real credentials or backup passwords unless the status JSON is redacted, secret-check instructions are replaced with non-disclosing presence checks, password arguments are removed or avoided, restore behavior has clear staging or overwrite confirmation, and the reviewed package includes the actual lib implementation instead of relying on an external symlink.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: commands/status.ts:39

Finding

Sensitive Membase secret key exposed through status JSON output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:55

Finding

Skill instructions direct the agent to print plaintext credentials

Content

View full analysis

1. Check for MEMBASE_BACKUP_PASSWORD: ```bash echo $MEMBASE_BACKUP_PASSWORD ``` ``` ```markdown 1. Check for password: ```bash echo $MEMBASE_BACKUP_PASSWORD ``` ``` ### Technical Analysis The instructions use `echo` to check whether credentials are configured. This does not merely test for presence: it prints the complete account value, secret key, and backup encryption password. Because the file defines agent operating procedures, an agent following the documented backup or restore workflow may execute these commands through its Bash capability. Tool output can then become part of the agent conversation, execution trace, terminal history, telemetry, or centralized logging. A presence check does not require disclosure of the underlying value. Printing the secret key and encryption password violates least disclosure and credential-handling best practices. ### Attack Path 1. The environment contains `MEMBASE_SECRET_KEY` or `MEMBASE_BACKUP_PASSWORD`. 2. A user asks the agent to check configuration, create a backup, or restore one. 3. The agent follows `SKILL.md` and executes an `echo` command. 4. The shell writes the plaintext credential to standard output. 5. The agent platform or another observer records the output. 6. A party with access to those records retrieves the credential. ### Impact Assessment Disclosure of `MEMBASE_SECRET_KEY` may permit authentication as the configured Membase account, depending on server-side authorization. Disclosure of `MEMBASE_BACKUP_PASSWORD` may permit decryption of backups if an att ...[truncated 186 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:93

Finding

Backup passwords are supplied through observable command-line arguments

Content

View full analysis

3. Run backup: ```bash cd skills/membase node membase.ts backup --password "" ``` ``` ```markdown 2. Run restore: ```bash cd skills/membase node membase.ts restore backup-2026-02-02T10-30-45-123Z --password "" ``` ``` ```markdown 2. Run diff with the two IDs: ```bash node membase.ts diff backup-2026-02-02T10-30-45-123Z backup-2026-02-01T15-20-10-456Z --password "" ``` ``` ```ts // commands/backup.ts:14-15 // Get password const password = options.password || options.p || process.env.MEMBASE_BACKUP_PASSWORD || ''; ``` ```ts // commands/restore.ts:22-23 // Get password const password = options.password || options.p || process.env.MEMBASE_BACKUP_PASSWORD || ''; ``` ```ts // commands/diff.ts:22-23 // Get password const password = options.password || options.p || process.env.MEMBASE_BACKUP_PASSWORD || ''; ``` ### Technical Analysis The documented workflow tells agents to insert the plaintext encryption password into the `--password` argument. The command implementations explicitly accept and prioritize that argument. Command-line arguments may be observable through process-inspection facilities while the process is running. They can also be retained in shell history, agent tool-call records, execution telemetry, process accounting, debugging output, or orchestration logs. Quoting the password only affects shell parsing and does not hide it from these channels. The backup password protects the confidentiality of archived memory data, making its exposure security-sens ...[truncated 974 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:375

Finding

Security-critical implementation is loaded from an unaudited external symlink target

Content

View full analysis

### Module not found The lib folder needs to be linked to compiled source: ```bash cd skills/membase ln -sf ../../dist/lib lib ``` ``` ```ts // commands/backup.ts:5-7 import { BackupManager } from '../lib/backup-manager.js'; import { MembaseClient } from '../lib/membase-client.js'; import { MemoryEncryption } from '../lib/encryption.js'; ``` ```ts // commands/restore.ts:5-6 import { BackupManager } from '../lib/backup-manager.js'; import { MembaseClient } from '../lib/membase-client.js'; ``` The same `BackupManager` and `MembaseClient` dependency pattern appears in `commands/list.ts`, `commands/diff.ts`, `commands/status.ts`, and `commands/cleanup.ts`. ### Technical Analysis The supplied project does not contain the referenced `lib` directory. Instead, its troubleshooting instructions tell the operator to create a symbolic link to `../../dist/lib`, which lies outside the audited Skill package. All security-critical behavior is delegated to these missing modules, including: - Selection and reading of local memory files. - Encryption and password validation. - Network authentication and transmission. - Download and decryption of backups. - Restoration and writing of files. - Backup comparison and metadata retrieval. A symbolic link does not pin content or integrity. Code at the target can differ from the reviewed Skill, be replaced after review, or vary by installation. Importing these modules executes code with the privileges and credentials of the Skill process. No malicious implementation was present in the supplied files, so actual compromise of the target is not established. The confirmed vulnerability is the unsafe trust boundary and ...[truncated 1288 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

The documented '--no-validate' option disables password strength validation, allowing weak backup passwords to be used. While not an exploit by itself, in this context it undermines the skill's stated encryption guarantees because weak passwords materially reduce resistance to offline guessing if encrypted backup data is obtained.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

- `--password <pwd>` or `-p <pwd>` - Encryption password (required if not in env)
- `--incremental` or `-i` - Only backup changed files since last backup
- `--workspace <path>` - Custom workspace directory
- `--no-validate` - Skip password strength validation
- `--no-json` - Don't output JSON for agent parsing

**Example conversation:**

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · commands/backup.ts (reported line 30)May include surrounding context.

ts

} catch (error) {
      console.error(`[ERROR] Error: ${error instanceof Error ? error.message : 'Invalid password'}`);
      console.error('   Password must be at least 12 characters with uppercase, lowercase, and numbers');
      console.error('   Use --no-validate to skip password strength check');
      process.exit(1);
    }
  }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users/agents to echo sensitive environment variables such as MEMBASE_SECRET_KEY and MEMBASE_BACKUP_PASSWORD directly to the terminal. This can disclose secrets into terminal scrollback, chat transcripts, recordings, logs, and agent outputs, making credential theft much easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The restore workflow describes restoring memory files into the agent workspace but does not warn that existing local memory files may be overwritten or replaced. In a memory-management skill, silent overwrite can cause integrity loss, accidental destruction of current state, or rollback to attacker-controlled or stale memory if a user restores the wrong backup.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims the backup password never leaves the local machine, but its own examples repeatedly pass the password as a command-line argument. Command-line arguments are commonly exposed to process listings, shell history, audit logs, and agent/tool telemetry, so this contradicts the security claim and can leak the decryption secret to other local users or logging systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The machine-readable JSON output serializes both status and the full config object, which can expose sensitive operational details such as the configured endpoint, workspace path, agent name, and potentially credential-related fields if present in config. Because this output is explicitly intended for agent parsing, it is more likely to be captured in logs, downstream tools, or other automation layers where sensitive configuration data may persist or be exfiltrated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code reads the secret credential from process.env.MEMBASE_SECRET_KEY, but there is no confirmation prompt, user-facing log, or inline warning indicating that sensitive environment data is being accessed. In this file, the surrounding comments describe configuration loading generally but do not disclose credential handling specifically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.