ClawHub
Back to skill

Security audit

Fpms Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned, but it broadly persists conversation-derived task data and installs an unpinned MCP server package with limited scoping and disclosure.

Review this carefully before installing. Use it only for workspaces where automatic project memory is acceptable, avoid discussing secrets or highly sensitive information while it is active, verify the focalpoint package source and version before installation, and require narrow GitHub permissions if enabling sync.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Package Is Installed and Executed as an MCP Server

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:111
Finding

Unconditional Rules Automatically Persist Conversation-Derived Data Across Sessions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill advertises GitHub sync without any warning about repository access, token permissions, or what data may be transmitted between the local memory system and GitHub. Even if the sync is optional, omitting these disclosures can lead users to authorize broader access than intended or expose private repository metadata and task history.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Risk detection

text
AI automatically runs heartbeat and finds:
  - Deploy task BLOCKED for 4 days
  - Docs update STALE — no activity for a week
  - Bug fix AT RISK — deadline is tomorrow

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to perform persistent memory actions in every conversation, including bootstrapping at start, creating nodes from user mentions, and appending logs before the conversation ends, but it provides no user-facing notice or consent flow about retention. This creates a real privacy and data-governance risk because users may disclose sensitive project, personal, or business information without understanding it will be stored across sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.