ClawHub
Back to skill

Security audit

Memory Architect

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent memory-organization tool, but it rewrites persistent agent memory and creates searchable plaintext records of contacts, accounts, chat IDs, emails, and relationships without enough safeguards.

Install only if you are comfortable letting the agent reorganize and persist your memory files. Before use, make a backup of MEMORY.md, review any directives moved into protocols.md, exclude secrets and sensitive account data, and periodically delete or prune archive and ontology entries you no longer want retained.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:29
Finding

Untrusted Instructions Can Be Promoted into Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-35, SKILL.md:61-65, and SKILL.md:83-87
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Vulnerable Code

markdown
| Content type | Tier | Examples |
|-------------|------|---------|
| Stable workflow / procedure | protocols | Emoji shortcuts, deploy steps, tool usage rules |
| Active project / waiting-on | active | Current builds, pending replies, live URLs |
| Completed work / reference data | archive | Done tasks, contact lists, account tables, old decisions |
| Named entity with properties | ontology | People, orgs, projects, properties, locations |
markdown
### 4. Rewrite MEMORY.md as router

Replace MEMORY.md with a ~25-line index that:
- Lists the three tiers with one-line descriptions
- Notes the ontology location
- Preserves any system directives (NO_REPLY rules, heartbeat instructions)
- Contains zero project-specific content
markdown
### On each session
- Read `memory/protocols.md` (always)
- Scan `memory/active.md` (always)
- `memory/archive.md` — only on `memory_search` or explicit request

Technical Analysis

The Skill directs the agent to read all existing memory, identify workflow instructions and system-like directives, and preserve them in files that are automatically read in future sessions. It does not require provenance verification, distinguish trusted directives from untrusted memory content, or request user confirmation before promoting an instruction into the persistent protocol tier.

Consequently, an instruction previously inserted into MEMORY.md by an untrusted source could be classified as a stable workflow or preserved system directive. Moving it into memory/protocols.md increases its persistence because that file must be read during every session. The Skill therefore acts as an amplification mechanism for pre-existing prompt injection or memory poisoning.

...[truncated 1363 chars]

Remediation
View remediation

Remediation Suggestions

  • Treat all existing memory content as untrusted data rather than executable instructions.
  • Do not automatically migrate behavioral rules, tool-use instructions, safety exceptions, heartbeat rules, or response-control directives.
  • Require explicit user review and approval before adding any instruction to memory/protocols.md.
  • Record provenance for each migrated entry, including its source file, author or origin, migration time, and approval status.
  • Allow only predefined, schema-validated workflow fields in the protocol tier.
  • Reject content that attempts to alter system policies, tool permissions, disclosure controls, or instruction precedence.
  • Place newly discovered directives in a quarantine or review file rather than an automatically loaded file.
  • Add a verification step that displays a diff of all persistent instruction changes before writing them.
  • Provide a rollback mechanism and periodically review persistent instructions for obsolete or suspicious content.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:49
Finding

Sensitive Reference and Entity Data Is Persisted in Plaintext Without Retention Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:49-58 and SKILL.md:89-93
Vulnerability Type: Plaintext sensitive-data storage and excessive retention
Risk Level: Medium

Vulnerable Code

markdown
**archive.md rules:**
- Completed work grouped by date or category
- Reference data (contacts, accounts, chat IDs)
- Keep searchable — use headers and tables

### 3. Extract entities to ontology

For each named person, organization, project, property, or location, create a JSONL entry:

```jsonl
{"op":"create","entity":{"id":"p_alice","type":"Person","properties":{"name":"Alice","email":"alice@example.com","role":"Engineer"}},"timestamp":"2026-01-01T00:00:00Z"}
{"op":"relate","from":"p_alice","rel":"member_of","to":"org_acme","timestamp":"2026-01-01T00:00:00Z"}
text

```markdown
### When adding new information
- New procedure → protocols.md
- New project/active item → active.md
- Completed item → move active → archive
- New person/org/project → append to graph.jsonl

Technical Analysis

The Skill explicitly directs the agent to store contacts, account information, chat identifiers, email addresses, and entity relationships in searchable Markdown and JSONL files. The ontology is append-only, but the design specifies no data minimization, sensitivity filtering, encryption, file-permission requirements, consent checks, deletion mechanism, or retention period.

This process can duplicate information from MEMORY.md across memory/archive.md and memory/ontology/graph.jsonl. Structuring the information by entity and relationship also makes personal or account-related data easier to enumerate. Append-only storage can retain stale or deleted information even after the original record has been removed.

Attack Path

  1. MEMORY.md contains personal, account-related, contact, property, location, or chat-identifier information.
  2. The Skill classifies that information as reference ...[truncated 1002 chars]
Remediation
View remediation

Remediation Suggestions

  • Exclude passwords, tokens, authentication material, recovery codes, financial account details, and other secrets from all memory tiers.
  • Define an allowlist of entity properties that may be persisted; redact or omit all other fields.
  • Require explicit user confirmation before extracting personal data or account-related information into the ontology.
  • Avoid duplicating sensitive values across archive and graph files; store references to a single protected record where possible.
  • Apply restrictive filesystem permissions to generated files and directories.
  • Encrypt sensitive records at rest when persistence is necessary.
  • Add retention limits, periodic review, and deletion or tombstone operations so append-only storage does not cause indefinite retention.
  • Ensure deletion requests propagate to the archive, ontology, backups, and derived indexes.
  • Display a migration preview identifying sensitive fields before files are written.
  • Document the privacy implications of creating searchable relationship graphs and collect only data necessary for the requested task.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
87% confidence
Finding

The skill directs the agent to replace the original MEMORY.md with a condensed router while preserving selected directives, which is a form of memory manipulation that can alter or discard important context. If performed incorrectly or without safeguards, this can cause loss of safety-relevant instructions, integrity issues in user memory, or selective retention of directives that changes future agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
### 4. Rewrite MEMORY.md as router

Replace MEMORY.md with a ~25-line index that:
- Lists the three tiers with one-line descriptions
- Notes the ontology location
- Preserves any system directives (NO_REPLY rules, heartbeat instructions)

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly instructs the agent to preserve, reorganize, and further structure sensitive data such as contacts, accounts, chat IDs, emails, roles, and locations into multiple memory files and an ontology graph. This increases persistence, discoverability, and linkage of personal or account data, which can amplify privacy impact and unauthorized disclosure if those files are later read by other tools, surfaced in context, or mishandled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.