ClawHub
Back to skill

Security audit

Agent Memory Persistence

Security checks for vulnerabilities and agentic risk

Overview

This is a local SQLite memory library for agents, with no evidence of hidden execution, network exfiltration, or unrelated privileged behavior.

Before installing, treat this as a local persistent memory database: avoid storing secrets or highly sensitive conversation content unless you control the database path, access permissions, retention policy, and deletion workflow. Pin dependencies if you need reproducible or stricter supply-chain controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The code largely matches the declared persistence/storage aspects: it uses SQLite, stores structured metadata and embeddings, supports create/read/update/delete, filtering by user/session/time/type, expiration lifecycle management, and stats. However, the description explicitly claims semantic retrieval, which would imply embedding-based similarity search or vector querying. The supplied code only stores embeddings as JSON and never performs similarity computation, nearest-neighbor lookup, or embedding-aware retrieval. Thus the description overstates a core capability.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README explicitly promotes long-term storage of user- and session-linked memories, including free-text content, metadata, and embeddings, but provides no privacy, consent, retention, or deletion guidance. In an agent-memory component, this omission can lead integrators to persist sensitive personal or conversational data indefinitely, increasing risk of privacy violations, over-collection, and noncompliant data handling.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The natural-language documentation is entirely in Chinese, with no indication that language choice is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate the language/locale policy when a specific language is imposed without user opt-in or documented justification.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"typecheck": "tsc -p tsconfig.json --noEmit"
  },
  "dependencies": {
    "better-sqlite3": "^11.10.0"
  },
  "devDependencies": {
    "@types/better-sqlite3": "^7.6.12",
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"better-sqlite3": "^11.10.0"
  },
  "devDependencies": {
    "@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "devDependencies": {
    "@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"
  }
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"devDependencies": {
    "@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"
  }
}
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"
  }
}
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This code performs a destructive delete of stored memory records, but there is no confirmation prompt, logging, comment, or docstring warning that data will be removed. For a code-file warning audit, destructive operations should include some visible disclosure unless clearly documented elsewhere as expected behavior.

Static analysis

No suspicious patterns detected.