Security audit

Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local-memory skill that stores and manages markdown files on the user's machine, with privacy caveats but no evidence of hidden exfiltration or malicious behavior.

Install only if you want an agent to keep durable local memory in plaintext files under ~/Clawic/data/memory/. Do not store secrets there, review excluded topics and deletion policy, and use private encrypted or version-controlled storage carefully because cloud sync and git history can retain deleted facts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises triggers using very common phrases such as 'save this', 'note that for later', and 'don't forget', which are likely to appear in ordinary conversation outside an explicit memory-management request. This can cause unintended invocation and storage actions, increasing the risk of capturing sensitive or irrelevant user data into durable plaintext memory without sufficiently clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The maintenance instructions tell the operator to file or delete inbox items, which can affect user data, but the document does not provide a clear warning at that point about the risk of irreversible loss. Although recovery guidance appears later, the skill description does not prominently disclose the risk before the destructive action is suggested.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example command moves a markdown file into an archive location and instructs manual index updates, but there is no immediate warning that it changes the filesystem and can create inconsistency if done incorrectly. The later note about versioning helps, but it comes after the actionable command rather than as a warning attached to it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The template instructs deletion of an existing config.md after merging into config.yaml, but does not require an explicit confirmation or user-facing warning before the destructive step. In a memory-management skill that persists user data, silent deletion increases the risk of accidental data loss if the merge is incomplete, incorrect, or the old file contains information not represented in the new schema.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction says user preferences should be persisted 'the moment they say them — never asked for up front,' which encourages automatic storage of potentially sensitive personal data without clear consent at the point of collection. In a durable memory skill, this expands privacy risk, can capture more than the user intended, and may conflict with least-privilege expectations for long-term retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The section discusses handing the folder to another destination and notes that sync/ should be stripped and that git history includes deleted facts. However, the skill description does not clearly present this as a safety/privacy warning before export steps, even though exporting can affect privacy and disclose sensitive historical data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The proactive lookup rules include broad conversational triggers such as "As I mentioned," "like last time," and "the usual," which can appear in ordinary dialogue without a clear user request to retrieve durable memory. In a memory skill, this can cause unintended reads of stored personal or project data, increasing unnecessary data exposure and creating privacy and context-minimization risks even if no external attacker is involved.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to create files and directories under ~/Clawic/data/memory/ as part of first use, but it does not require an explicit user-facing warning or confirmation that local filesystem writes will occur. Because this is a persistence skill, file creation is contextually expected, but silent writes in the user's home directory still create integrity and privacy risk if the user did not realize durable local storage would be modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The migration section directs the agent to move existing data from alternate paths and delete config.md after merging, without requiring backup, confirmation, or a safety warning. These are destructive or irreversible filesystem operations that could cause data loss, overwrite conflicts, or accidental modification of another tool's files if the existing store is misidentified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The markdown includes an mv command that changes stored data by renaming a file, which can break references or overwrite expectations if run incorrectly. While the section discusses checking mentions before deletion and warns about sed -i, it does not explicitly warn the user about the rename operation itself on this line.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing warnings about behaviors affecting user data or system integrity. Line L12 directs appending a line to ~/Clawic/data/memory/MIGRATION.md, which is a write to user data, but the document does not explicitly warn that following the migration procedure will modify files in the local store.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.