ClawHub
Back to skill

Security audit

NumPy

Security checks for vulnerabilities and agentic risk

Overview

The skill is a normal NumPy helper, but it asks to save user context in shared persistent memory while also claiming it only stores data under its own local folder.

Review this skill before installing if you do not want NumPy-related preferences or context stored in shared cross-session agent memory. The local ~/numpy/ storage is reasonable for this helper, but the MAIN memory behavior should be opt-in, clearly scoped, and removable.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
setup.md:17
Finding

Persistent Main-Memory Modification Outside the Declared Storage Boundary

Content
View full analysis

Vulnerability Details

File Location: setup.md:17, setup.md:39, setup.md:49-51; contradictory security claim in SKILL.md:214-221
Vulnerability Type: Persistent cross-session memory modification and storage-boundary violation
Risk Level: Medium

Vulnerable Code

From setup.md:

markdown
Save their preference to their MAIN memory so other sessions know when to use this skill.
markdown
## Data Storage

Creates `~/numpy/` with:
- `memory.md` — preferences and context learned from conversations
- `snippets/` — user's saved code patterns (optional)

Only reads and writes within `~/numpy/`. Does not access other directories.

## What You're Saving

In `~/numpy/memory.md`:
- Their experience level
- Common use cases
- Preferences for dtypes, memory management
- Patterns they use frequently

In their MAIN memory:
- When to activate this skill
- Brief context about their numerical computing needs

The related claim in SKILL.md:214-221 is:

markdown
## Security & Privacy

**Data that stays local:**
- All computations run locally
- Code patterns saved in ~/numpy/

**This skill does NOT:**
- Send data externally
- Access files outside ~/numpy/

Technical Analysis

The setup process directs the Agent to persist activation preferences and user context in an unspecified “MAIN memory” so that the information affects future sessions. This operation exceeds the explicitly declared ~/numpy/ storage boundary and contradicts the statements that the Skill only reads and writes within that directory and does not access files outside it.

Persistent Agent memory is a security-sensitive state channel because content placed there can influence behavior after the current Skill invocation ends. The instructions do not identify the underlying memory location, define a namespace for this Skill, limit which fields may be written, require explicit consent for e ...[truncated 1940 chars]

Remediation
View remediation

Remediation Suggestions

  1. Store all Skill-specific state exclusively in ~/numpy/memory.md, including activation preferences.
  2. Remove the instruction to write to MAIN memory unless cross-session global storage is essential.
  3. If MAIN-memory integration is retained:
    • Obtain explicit, informed opt-in consent before writing.
    • Clearly identify the storage mechanism and location.
    • Use a dedicated namespace such as skills.numpy.activation.
    • Restrict stored content to a narrowly defined, non-sensitive activation preference.
    • Never store arbitrary conversational text as executable instructions or behavioral rules.
    • Prevent the Skill from replacing or modifying unrelated memory entries.
    • Provide commands or documented steps to inspect, update, and delete the entry.
    • Ensure uninstalling or resetting the Skill also offers removal of its MAIN-memory state.
  4. Treat persisted content as untrusted data rather than higher-priority instructions.
  5. Correct setup.md and SKILL.md so their privacy and storage disclosures accurately describe every location read or written.
  6. Add tests or policy checks that reject writes outside the declared Skill-local directory unless separately authorized.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation guidance is broad and ambiguous, encouraging the skill to trigger for general 'arrays,' 'numerical Python,' or 'data processing' work rather than a narrowly scoped, user-initiated condition. This can cause over-activation and collection of user context in situations where the user did not clearly intend to invoke the skill, increasing privacy and consent risk, especially because the same setup also instructs persistence to memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly directs saving activation preferences and user context to MAIN memory without requiring a clear disclosure or consent step at the time of storage. Persistent cross-session memory can expose behavioral preferences and work context beyond the current interaction, so storing it silently creates a meaningful privacy and data-governance issue even if the content appears low sensitivity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.