ClawHub
Back to skill

Security audit

Focalpoint Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local project-memory tool, but it asks the agent to load and write persistent memory automatically in every conversation and installs an unpinned external MCP package.

Install only if you want an agent-wide project memory system that can write local persistent records automatically. Treat saved knowledge and logs as durable project data, avoid storing secrets or regulated information, review what the focalpoint package installs, and prefer a pinned, isolated environment with explicit rules limiting when memory is loaded or written.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:245
Finding

Mandatory Global Agent Lifecycle and Workflow Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 245-255
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet:

markdown
## Automatic Memory Rules

Follow these rules in EVERY conversation:

1. **Conversation start** -> Call `bootstrap` to load memory
2. **Before starting a task** -> `activate_workbench` to prepare context
3. **User makes a decision** -> `append_log` with category="decision"
4. **Risk identified** -> `append_log` with category="risk"
5. **Task progresses** -> `update_status`
6. **Design conclusions** -> `set_knowledge` to persist for future sessions
7. **Before conversation ends** -> `append_log` key takeaways
8. **Every ~10 min** -> `heartbeat` to check for risks

Technical Analysis

The skill declares that its rules apply in “EVERY conversation,” rather than limiting them to sessions in which the user explicitly requests FocalPoint functionality. It requires automatic lifecycle calls at conversation start, before tasks, periodically during sessions, and before conversations end.

This changes the agent's default workflow and directs it to import external context through bootstrap and activate_workbench. The document states that workbench activation returns a role prompt, meaning externally maintained content can influence how the agent approaches unrelated tasks. Mandatory periodic and end-of-session calls also override the principle that tool use should be driven by the current user request.

The issue is an instruction-scope vulnerability: loading the skill causes its operational rules to compete with the agent's ordinary task objectives across all conversations.

Attack Path

  1. The skill is installed and loaded by an agent or MCP-capable client.
  2. The agent follows the instruction to call bootstrap at the beginning of every conversation.
  3. Stored context is imported even when the current request is unr ...[truncated 935 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace “EVERY conversation” with an explicit, narrowly scoped activation condition.
  • Require the user to opt in before calling bootstrap, activate_workbench, or any persistence tool.
  • Do not automatically apply role prompts returned by stored or external context.
  • Restrict heartbeat activity to an explicitly enabled project-monitoring mode.
  • Require confirmation before invoking tools at conversation end.
  • Clearly display which project and data scope each tool call will access.
  • Treat all retrieved memory, knowledge documents, and role prompts as untrusted data rather than authoritative instructions.
  • Provide a session-only mode that performs no background calls and does not modify persistent state.

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:249
Finding

Unconfirmed Persistence of Conversation-Derived Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 249-254
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Code Snippet:

markdown
3. **User makes a decision** -> `append_log` with category="decision"
4. **Risk identified** -> `append_log` with category="risk"
5. **Task progresses** -> `update_status`
6. **Design conclusions** -> `set_knowledge` to persist for future sessions
7. **Before conversation ends** -> `append_log` key takeaways
8. **Every ~10 min** -> `heartbeat` to check for risks

Technical Analysis

These rules direct the agent to write decisions, risks, design conclusions, progress, and conversation summaries to persistent storage automatically. They do not require user confirmation, sensitivity screening, provenance tracking, or validation that the content is appropriate for long-term memory.

Conversation content may originate from untrusted users, imported documents, retrieved web content, or tool output. If such content is summarized as a decision, risk, design conclusion, or takeaway, it can be stored through append_log or set_knowledge. The same skill later directs the agent to reload memory with bootstrap and working context with activate_workbench, creating a feedback path from attacker-controlled input to future agent behavior.

The vulnerability does not require direct database access. An attacker only needs to supply content that the agent interprets as material that must be retained under the automatic memory rules.

Attack Path

  1. An attacker or untrusted document introduces false project facts, misleading decisions, or instruction-like content into a conversation.
  2. The agent interprets the content as a decision, risk, design conclusion, or key takeaway.
  3. Following the mandatory rules, the agent calls append_log or set_knowledge without requesting confirmation.
  4. The attacker-controlled content is stored in pe ...[truncated 827 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit user approval before every persistent memory write.
  • Show the exact proposed content, destination node, category, and retention period before saving.
  • Separate untrusted source material from verified decisions and authoritative project knowledge.
  • Record provenance, author identity, timestamps, and trust level for every stored entry.
  • Prevent stored content from being interpreted as agent instructions.
  • Apply secret, credential, personal-data, and sensitive-content detection before persistence.
  • Isolate memory by user, workspace, and project, with strict authorization checks.
  • Provide review, correction, expiration, and deletion controls for all saved records.
  • Load only memory relevant to the current user-approved project instead of loading global context automatically.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned External Package Supplies the Entire Executable Implementation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-13 and 69-72
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata:
  openclaw:
    emoji: "🧠"
    homepage: "https://github.com/jeff0052/founderOSclaudecode"
    requires:
      bins:
        - python3
    install:
      - kind: uv
        package: focalpoint
        bins: [focalpoint]
bash
### 1. Install
```bash
pip install focalpoint
text

### Technical Analysis

The artifact contains only `SKILL.md`; it does not include the executable implementation of the `focalpoint` MCP server. Installation is delegated to the external PyPI package named `focalpoint`, with no exact version, hash, lockfile, signature, or vendored source.

Consequently, the code reviewed in this artifact is not the code that will execute. Package resolution can select a release published after the skill was audited. Python package installation may execute package-controlled build logic, and the installed `focalpoint` command subsequently operates as an MCP server with the filesystem, network, and process permissions of its runtime account.

This finding establishes an unsafe and unverifiable dependency path; it does not establish that the current PyPI package is itself malicious.

### Attack Path

1. A user follows the documented setup or the package manager processes the `uv` installation metadata.
2. The installer resolves the unpinned `focalpoint` package from the configured package index.
3. A compromised maintainer account, package index, release pipeline, or future package release supplies altered package contents.
4. Package-controlled installation or build behavior executes with the installer's permissions.
5. The resulting `focalpoint` binary is registered as an MCP server.
6. The agent invokes the server's tools and provides conversation-derived or project data.
7. A c
...[truncated 668 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed exact version.
  • Require package hashes and use a locked dependency manifest.
  • Include or vendor the executable source so that the reviewed artifact matches the executed implementation.
  • Publish signed releases and verify package provenance before installation.
  • Use a private or allowlisted package index where appropriate.
  • Install and run the MCP server in an isolated virtual environment or container.
  • Restrict its filesystem, network, environment-variable, and subprocess permissions.
  • Avoid installation with administrator or root privileges.
  • Re-audit each dependency update before changing the pinned version.
  • Document the precise package publisher, source repository, release commit, and reproducible-build procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description is highly broad and capability-rich ('cognitive operating system', 'memory + attention management + workflow orchestration') without stating when the skill should or should not be invoked. In agent ecosystems, vague trigger language increases the chance of over-invocation on unrelated conversations, which can lead to unnecessary context loading, storage actions, and privacy-impacting tool use.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The knowledge-document feature encourages storing arbitrary documents and automatically inheriting them to child tasks, which can cause sensitive architecture, requirements, or business information to spread into broader context assembly than originally intended. That broadens disclosure scope and makes accidental resurfacing to future task contexts more likely.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Risk detection

text
AI automatically runs heartbeat and finds:
  - Deploy task BLOCKED for 4 days
  - Docs update STALE — no activity for a week
  - Bug fix AT RISK — deadline is tomorrow

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The automatic rules instruct the agent to persist decisions, risks, task progress, design conclusions, and end-of-conversation takeaways in every conversation, but provide no consent, minimization, retention, or sensitivity handling guidance. That creates a real privacy and compliance risk because user and project information may be stored locally by default even when it includes confidential or regulated content.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs the AI to summarize and persist conversation content across sessions as a standing rule, which creates durable natural-language records that may later be surfaced to the model in other contexts. This increases the risk of cross-session exposure of sensitive information, especially because the persistence behavior is automatic rather than user-approved per item.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.