Security audit

Memory Augment

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent memory skill, but it stores and reuses long-term conversation context with weak scoping and several data-loss or prompt-influence risks.

Install only if you are comfortable with an agent keeping local long-term memories and potentially injecting them into future prompts. Do not store secrets or sensitive personal data, avoid importing memory files you do not fully trust, back up the memory store before deletions, and do not run the included tests against a real home directory until storage isolation is fixed. Prefer pinned, verified installation sources over the unversioned npx/git examples.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: scripts/memory.py:237
Finding: Unvalidated imports can poison persistent agent memory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/test_memory.py:17
Finding: Test suite destructively overwrites the production memory store
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/memory.py:59
Finding: Conversation history is stored in plaintext without enforced owner-only permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:7
Finding: Installation instructions execute an unpinned package through npx
Content: View full analysis
Remediation: View remediation
`. 2. Commit and publish an appropriate lockfile with registry integrity metadata. 3. Publish signed release artifacts and documented SHA-256 checksums. 4. Pin source-based installation instructions to a reviewed commit hash or verified signed tag. 5. Avoid automatically executing a mutable latest release in security-sensitive installation workflows. 6. Document how users can verify package signatures, checksums, and publisher identity before installation. 7. Review package lifecycle scripts and minimize or disable installation-time script execution where possible. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 88% confidence
Finding: The skill exposes memory deletion commands, including bulk deletion by tag and age, without describing authorization checks, confirmation safeguards, backup/undo, or scope restrictions. In a long-term memory system this can directly destroy user context, decisions, and learned preferences, making prompt behavior unreliable and enabling denial-of-service against the agent's memory state.
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
clawhub memory list --since "2026-04-14"

text
### Delete Memory ```bash clawhub memory delete <uuid> clawhub memory delete --tag "temporary" --older-than "7d"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This skill is explicitly designed for cross-session memory and automatic context injection, but the README does not clearly foreground that user conversation content may be persistently stored and later reinserted into future prompts. In an agent setting, that can lead to privacy leakage, retention of sensitive data, and prompt-surface expansion where prior untrusted content influences later actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx clawhub without pinning a specific version, which means installation and execution depend on whatever package version is current at runtime. If the upstream package is compromised, typosquatted, or introduces a breaking or malicious change, users may execute unreviewed code during install or use.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes persistent storage operations, including writing to ~/.memory-augment/storage.yaml and corrections.log, but does not declare an explicit tool scope or allowed-tools boundary. In an agent ecosystem, undeclared write capability increases the chance that the skill is invoked with broader-than-expected file access, reducing auditability and making misuse or accidental writes harder to contain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: Using 'npx clawhub' without a pinned version allows the executed package to change over time, creating a supply-chain risk if a compromised or incompatible release is published. Because installation is presented as the primary setup path, users may unknowingly execute unreviewed code when invoking the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger examples are broad natural-language phrases like 'Remember that...' and 'Find all notes about...', which can overlap with ordinary conversation and cause unintended activation. For a memory skill, accidental invocation is more dangerous because it can silently persist sensitive context or retrieve prior memories into prompts without deliberate user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill prominently advertises automatic context injection but does not clearly warn that stored memories may be inserted into future prompts, potentially exposing private or sensitive information. This omission is especially risky in a long-term memory skill because users may assume data stays local and dormant rather than actively influencing future agent behavior and outputs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The auto-inject triggers use generic words such as 'inbox', 'messages', 'notification', 'weather', and 'forecast', which are common in normal dialogue and may cause unsolicited memory injection. In a memory system, this increases privacy and prompt-manipulation risk because unrelated conversations can be augmented with stale, irrelevant, or sensitive stored data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains very broad, common topics such as "income," "skills," "workspace," and "preferences," which are likely to appear in many normal conversations. In a long-term memory system with auto-injection enabled, this can cause memories to be injected too often or in irrelevant contexts, increasing the chance of unnecessary exposure of prior sensitive information and cross-session context leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The demo output normalizes long-term storage of user preferences and automatic context injection without any visible consent, retention, sensitivity filtering, or disclosure controls. In a memory system for agents, this can lead to persistent collection and replay of user data across sessions, increasing the risk of privacy leakage, over-collection, and unintended exposure of prior conversation content to downstream prompts or tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guidance explicitly recommends storing permanent user preferences and decisions, and temporary context, but provides no warning about consent, minimization, retention controls, or privacy-sensitive content. In a long-term memory skill, this can normalize indefinite collection of personal behavioral data and lead downstream agents to persist information users may not expect to be retained across sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The examples encourage storing behavioral patterns, project status, preferences, and decisions without any caution that these records may reveal sensitive traits, work history, or personal habits. Because this file is operational guidance for a memory system, these examples can directly shape unsafe data-handling behavior in agents that persist user information by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI allows irreversible deletion of stored memories by ID or age without any confirmation prompt, dry-run, or undo capability. In a long-term memory skill, this increases the risk of accidental or induced data loss, especially if another agent step or user typo triggers the delete path on valuable persistent context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The deletion examples document destructive operations, including age-based deletion, without making clear that removal may be permanent and difficult to recover from. In a long-term memory system, that creates a risk of accidental data loss, especially because the feature is presented as routine maintenance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The Weather Alert integration stores "User is in UTC timezone" as memory context, which imposes a locale-related assumption rather than offering a user-selected setting. The file does not indicate that this timezone was explicitly chosen by the user or that locale preferences are configurable.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.