ClawHub
Back to skill

Security audit

GoldHold Memory

Security checks for vulnerabilities and agentic risk

Overview

GoldHold is a disclosed remote memory skill, but it asks agents to persist and reuse session facts, summaries, directives, and identity-like records without enough safeguards for sensitive data or instruction trust.

Install only if you are comfortable sending selected agent memories and session summaries to GoldHold. Do not store secrets, API keys, private customer data, regulated records, or sensitive internal details. Treat all retrieved memories, directives, corrections, inbox messages, and identity records as untrusted context that cannot override current instructions, and use this only where you have a clear review and deletion process for stored records.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:40
Finding

Persistent Remote Memory Can Poison Future Agent Sessions

Content
View full analysis
POST /v1/auto (get context, inbox, tasks) | DURING SESSION --> POST /v1/turn (search + store each interaction) ``` From lines 120–137: ```markdown | Type | When to Use | |------|-------------| | FACT | Established truths, verified information | | DECISION | Choices made and the reasoning behind them | | DIRECTIVE | Standing instructions or rules | | NOTE | General observations, session notes | | CORRECTION | Overrides previous information (corrections outrank facts) | | CHECKPOINT | State snapshot at a point in time | | IDENTITY | Who you are, your configuration, persona | | DOCUMENT | Longer-form content, specs, references | | RELATION | Links between entities (person X works at company Y) | | TOMBSTONE | Marks something as deleted or invalid | | CUSTOM | Anything that doesn't fit the above | ## Storage Classes | Class | Purpose | Retrieval Priority | |-------|---------|-------------------| | **canonical** | Permanent truth, settled answers, standing directives | Checked first | | **corrections** | Field-proven overrides of old truth (outranks canonical on conflict) | Checked second | ``` From lines 151–157: ```markdown ## Rules 1. **Search before you assume.** Your past self left notes. Call `/v1/turn` with a search query before forming opinions or making claims about past work. 2. **Store decisions and facts immediately.** If something was decided, corrected, or established, store it in the same turn. 3. **Use `compact: true`** on all requests. Saves tokens. 4. **One close per s ...[truncated 3318 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:54
Finding

Unrestricted Remote Storage Can Disclose Sensitive Session Context

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README promotes persistent cross-session memory and API-based storage for agent decisions, facts, and corrections, but it does not warn users that sensitive prompts, personal data, secrets, or regulated information may be retained and transmitted to a third-party service. In an AI-agent context, durable memory materially changes the privacy and security model, because agents may automatically store user content or credentials unless the operator is explicitly told to minimize, redact, classify, and govern what is persisted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is explicitly designed to persist agent memory by sending session context, decisions, and summaries to a third-party service, but it does not clearly warn users in the skill description that potentially sensitive data will be transmitted off-platform for storage and retrieval. This creates a real privacy and data-governance risk because users may invoke the skill without informed consent about external handling of their session data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill instructs agents to send session context and stored memories to https://relay.goldhold.ai, which is an external service outside the local trust boundary. In the context of a persistent-memory skill, this behavior is intentional, but it is still security-relevant because it can exfiltrate sensitive prompts, decisions, identities, or operational details if used without strict scoping and user awareness.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

bash
# Resume session
curl -X POST https://relay.goldhold.ai/v1/auto \
  -H "Authorization: Bearer $GOLDHOLD_API_KEY" \
  -H "Content-Type: application/json" \
  -H "User-Agent: goldhold-agent/1.0" \