ClawHub
Back to skill

Security audit

LWC Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local memory tool, but it can automatically install software and create persistent global memory state during broad activations.

Install only if you want an agent memory layer that may create ~/.lwc state and install the lwc CLI under ~/.local/bin. Consider setting LWC_AUTO_INSTALL=0 and manually installing/reviewing lwc first if you want tighter control over software installation and persistent global memory.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill directs the agent to run shell commands such as `scripts/bootstrap.sh`, `command -v lwc`, and multiple `lwc` CLI invocations, yet the metadata declares no permissions. This creates a capability/permission mismatch that can lead to unreviewed command execution and weakens host-side safety controls and operator awareness.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The activation text is extremely broad, covering research, planning, debugging, architecture, maintenance, document ingest, incident recovery, and any request involving search/update/repair. Such breadth can cause the skill to activate for routine tasks, unnecessarily expanding access to durable memory and shell-backed workflows and increasing the chance of unintended data persistence or command execution.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This bootstrap script will automatically install the `lwc` binary when it is missing and will also initialize and configure persistent global state under `~/.lwc` without any explicit user confirmation in this file. Even though the behavior appears product-motivated rather than malicious, silently installing software and mutating long-lived user state increases supply-chain and consent risk, especially in an agent/skill context where execution may be surprising to the operator.

Static analysis

No suspicious patterns detected.