ClawHub
Back to skill

Security audit

Memory Backfill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory-maintenance workflow that persistently updates project memory files, which is disclosed and aligned with its purpose.

Install only if you want an agent to maintain durable project memory. Review proposed changes before writing them, avoid storing secrets, credentials, regulated data, or private third-party details, and periodically audit MEMORY.md and memory/*.md for stale or sensitive content.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs the agent to write to persistent memory artifacts (`MEMORY.md` and dated `memory/*.md`) as part of normal execution, but it does not require user consent, scope checks, or confirmation before modifying long-lived project state. This is dangerous because it can cause unauthorized persistence of potentially sensitive, incorrect, or prompt-injected content that influences future agent behavior and contaminates project memory over time.

Static analysis

No suspicious patterns detected.