ClawHub
Back to skill

Security audit

Memory Router

Security checks across malware telemetry and agentic risk

Overview

MemoryRouter is a local memory-management skill with disclosed file reads and writes, and its higher-risk actions are user-directed with confirmation gates.

Install only if you want this skill to manage local agent memory files. Avoid scheduling destructive commands, review heartbeat automation because some 'safe' commands still write generated files, and do not put secrets in SESSION-STATE.md or memory files that you would not want printed in an agent transcript.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The guide marks `--compact` as a SAFE heartbeat command, but elsewhere states that this command regenerates the manifest at `memory/memory-manifest.json`, which is a file write and therefore not side-effect-free. Mislabeling a mutating command as safe can cause agents or operators to schedule it automatically, leading to unintended state changes, possible overwrite of manually edited manifests, and incorrect assumptions about execution safety.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The section name sanitization removes only backticks, dollar signs, and backslashes, but it does not strip newline characters or markdown metacharacters. An attacker-controlled section value containing a newline can break out of the intended heading and inject additional markdown sections into SESSION-STATE.md, corrupting WAL structure and potentially spoofing or overriding state consumed by downstream agents.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
walGetState prints the full contents of SESSION-STATE.md directly to stdout. In this skill's context, that file is explicitly described as active working memory and may contain sensitive user context, decisions, blockers, or secrets; emitting it unredacted can leak data into logs, terminals, agent transcripts, or monitoring systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.