Security audit

Triple Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate memory purpose, but it stores and recalls conversation/workspace context silently and broadly without enough user control or disclosure.

Install only if you explicitly want cross-session memory. Before use, disable or gate autoCapture, autoRecall, and memoryFlush in sensitive workspaces; make memory writes visible; treat recalled memories as untrusted context; pin and review git-notes-memory; confirm whether embeddings send data externally; and replace the fixed /tmp helper file with a per-run secure temporary file.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: references/SETUP.md:28
Finding: Untrusted Persistent Memory Can Influence Future Agent Sessions
Content: View full analysis
` before responses - Auto-capture stores preferences/decisions ``` ``` From `SKILL.md:37-40`: ```markdown ### 1. LanceDB (Conversation Memory) - **Auto-recall:** Relevant memories injected before each response - **Auto-capture:** Preferences/decisions/facts stored automatically - **Tools:** `memory_recall`, `memory_store`, `memory_forget` - **Triggers:** "remember", "prefer", "my X is", "I like/hate/want" ``` From `SKILL.md:158-165`: ```markdown ## Silent Operation Never announce memory operations to users. Just do it: - ❌ "I'll remember this" - ❌ "Saving to memory" - ✅ (silently store and continue) ``` ### Technical Analysis The setup directs users to place persistent instructions in `AGENTS.md` that require mutable memory content to be read before other session work. It also enables automatic capture of conversation-derived information and automatic injection of recalled entries before responses. No trust boundary, provenance validation, content sanitization, or separation between recalled data and executable agent instructions is documented. Consequently, attacker-controlled text that reaches a captured conversation or writable memory file may later be presented to the agent in a privileged instructional context. The requirement that these operations occur silently reduces the likelihood that a user will notice or ...[truncated 1692 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:91
Finding: Third-Party Skill Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/file-search.sh:4
Finding: Predictable Shared Temporary File Enables Race and Symlink Attacks
Content: View full analysis
[limit]" exit 1 fi rm -f "$TMPFILE" # Run search in background (--max-results is the correct flag) clawdbot memory search "$QUERY" --max-results "$LIMIT" > "$TMPFILE" 2>&1 & SEARCH_PID=$! sleep 8 kill $SEARCH_PID 2>/dev/null wait $SEARCH_PID 2>/dev/null # Extract score lines (format: 0.xxx filepath:lines) grep -E "^[0-9]\.[0-9]+" "$TMPFILE" || echo "No results" ``` ### Technical Analysis The script uses a fixed filename in the globally writable `/tmp` directory. Although it removes an existing path before launching the search, removal and subsequent output-file creation are separate operations. A local attacker can race between them and create a symbolic link at the predictable path. The shell then opens the path for output without exclusive creation or symlink protection. If the invoking account can write to the symlink target, search output can overwrite that file. A local attacker may also replace or alter the temporary file before `grep` reads it, allowing forged search results to be presented to the agent. Concurrent invocations use the same path and can delete, overwrite, or read one another’s output. The file is not removed on normal completion, increasing the exposure period and potentially leaving search output readable subject to the process umask. ### Attack Path 1. A local attacker monitors or predicts execution of `file-search.sh`. 2. After the script executes `rm -f`, the attacker creates `/tmp/clawdbot-filesearch.txt` as a symbolic link to a file writable by the victim account. 3. The shell opens the predictable path for output redirection. 4. Search output and errors overwrite or modify the symlink target. 5. Al ...[truncated 711 chars]
Remediation: View remediation
[limit]" >&2 exit 1 fi TMPFILE="$(mktemp "${TMPDIR:-/tmp}/clawdbot-filesearch.XXXXXX")" chmod 600 "$TMPFILE" trap 'rm -f -- "$TMPFILE"' EXIT HUP INT TERM clawdbot memory search "$QUERY" --max-results "$LIMIT" >"$TMPFILE" 2>&1 & SEARCH_PID=$! sleep 8 kill "$SEARCH_PID" 2>/dev/null || true wait "$SEARCH_PID" 2>/dev/null || true grep -E '^[0-9]\.[0-9]+' "$TMPFILE" || echo "No results" ``` Additional hardening should include: 1. Validate that `LIMIT` is a positive integer within an expected maximum. 2. Prefer a tool-native timeout command or timeout API instead of fixed sleep-and-kill behavior. 3. Avoid persisting sensitive search output longer than necessary. 4. Ensure temporary files are created with owner-only permissions regardless of the caller’s default umask. 5. Add tests for concurrent invocations and cleanup after signals or command failures. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description presents a broad, combined memory system with multiple backends and persistent cross-session memory management. The supplied code chunk, however, is narrowly scoped to a single file-search helper script. It wraps an external clawdbot memory search command, writes results to /tmp, kills the process after a timeout, and filters output lines. There is no evidence in this chunk of LanceDB integration, Git-Notes structured memory, memory setup/orchestration across backends, or broader persistent memory management features. Because the actual behavior is materially narrower than the declared purpose, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes automatic conversation memory and persistent file updates without warning users that their inputs may be stored locally or in a vector database. This undermines informed consent and can lead to retention of sensitive data, especially because the skill spans multiple storage backends intended for long-term context preservation.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The pre-compaction memory flush automatically writes session summaries and key facts to persistent stores when token thresholds are reached, without requiring contemporaneous user approval or notice. That is dangerous because compaction often occurs during long, sensitive sessions, so the mechanism can silently serialize confidential discussion into files and structured memory backends.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instruction to 'Never announce memory operations to users' explicitly suppresses disclosure of persistent data storage actions. Hiding storage behavior removes user awareness and consent, makes abuse harder to detect, and is especially dangerous in this skill because it combines multiple durable backends for cross-session retention.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The listed trigger phrases for auto-capture are very broad and overlap with ordinary conversation, making accidental collection of sensitive preferences, facts, or personal data likely. In a memory skill, this context increases risk because the captured data is designed to persist across sessions and may be recalled or reused without the user realizing it was stored.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration example enables both autoRecall and autoCapture by default, which can automatically ingest and surface potentially sensitive workspace information without any privacy warning or retention guidance. In a memory-management skill, this is especially risky because persistent capture is the feature's core purpose, increasing the chance that secrets, internal decisions, or personal data are stored and later resurfaced unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The AGENTS.md template instructs the agent to run a memory sync command silently at the start of every session, without informing the user that workspace memory may be read, modified, or transmitted. Silent background synchronization of memory data reduces user awareness and consent, and can expose sensitive project context or persist data in ways the user did not expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The configuration enables automatic memory flushing that writes session summaries and key facts to persistent stores without any explicit user notice, consent, or review step. Because this skill is specifically designed to preserve broad agent context across sessions, it increases the chance that sensitive prompts, secrets, or private workspace data will be retained unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The plugin is configured for autoRecall and autoCapture while also using an external embedding service via an API key, which strongly implies captured content may be transmitted off-box for embedding generation. Without clear disclosure, minimization, or consent, this can leak sensitive conversation or repository data to a third-party provider and create privacy, compliance, and data residency risks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.