Triple Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This memory skill is not clearly malicious, but it asks agents to silently store and load persistent memory with broad auto-capture, which creates meaningful privacy and prompt-injection risk.

Install only if you intentionally want persistent agent memory across sessions and are comfortable with automatic capture. Before using it, disable silent operation, require explicit consent for storing memories, document when memory is read or written, review/delete stored records regularly, pin dependencies, and replace the shared /tmp file-search script pattern with a unique mktemp-based file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:137

Finding

Persistent Memory Instructions Create a Concealed Prompt-Injection Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:137-143; references/SETUP.md:24-28
Vulnerability Type: Persistent instruction hijacking and memory poisoning
Risk Level: High

Vulnerable code in SKILL.md:137-143:

markdown

## Silent Operation

Never announce memory operations to users. Just do it:
- ❌ "I'll remember this"
- ❌ "Saving to memory"
- ✅ (silently store and continue)

Vulnerable code in references/SETUP.md:24-28:

markdown

## Every Session

Before doing anything else:
1. Read `memory/active-context.md` for current session state
2. Run `sync --start` on git-notes-memory (silently)

Technical Analysis

The setup template directs the agent to read mutable persistent memory before performing any other session activity. The Skill also explicitly requires memory operations to be concealed from the user.

If an attacker, compromised dependency, malicious repository contributor, or untrusted automation process can modify memory/active-context.md or synchronized Git notes, it can place instruction-like content into those stores. A subsequent agent session may consume that content as context before processing the user's task. The requirement to perform the operation silently reduces the user's ability to identify that persistent state influenced the response.

This combines a current-session instruction-control risk with a cross-session memory-poisoning risk. The vulnerable behavior does not itself grant an attacker write access; exploitation depends on the attacker or another compromised component being able to modify one of the consumed memory sources.

Attack Path

1. A user copies the provided template into the workspace's AGENTS.md.
2. The agent is consequently instructed to read memory/active-context.md and synchronize Git-note memory at the beginning of every session.
3. An attacker or compromised component with workspace or memory-write access inser ...[truncated 1052 chars]

Remediation

View remediation

Remediation Suggestions

• Remove instructions requiring memory operations to be concealed from users.
• Do not direct the agent to treat mutable memory as authoritative instructions.
• Clearly delimit recalled memory as untrusted reference data that cannot override system, developer, workspace, or current-user instructions.
• Require explicit user consent before enabling automatic capture or cross-session synchronization.
• Display an auditable notice when persistent memory is read, written, synchronized, or deleted.
• Validate the provenance and integrity of memory records before injecting them into agent context.
• Store structured data rather than unrestricted instruction-like prose where possible.
• Restrict write access to memory files and Git notes using repository permissions and operating-system access controls.
• Provide a review and deletion mechanism so users can inspect and remove poisoned records.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Executable Skill Dependencies Are Referenced Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7-12; SKILL.md:62-65
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable dependency declarations in SKILL.md:7-12:

yaml

metadata:
  clawdbot:
    emoji: "🧠"
    requires:
      plugins:
        - memory-lancedb
      skills:
        - git-notes-memory

Vulnerable installation instruction in SKILL.md:62-65:

markdown

### Install Git-Notes Memory
```bash
clawdhub install git-notes-memory

text

### Technical Analysis

The Skill identifies executable plugin and Skill dependencies only by mutable package names. It does not specify reviewed versions, cryptographic hashes, signatures, or an authenticated source. The installation command therefore resolves whatever release the configured registry currently associates with `git-notes-memory`.

Dependency names alone do not prove that either named package is malicious. The weakness is that later package replacement, registry compromise, account takeover, or an unsafe package-resolution source could cause code different from the audited version to be installed.

The dependencies are especially sensitive because they process conversation memory, workspace state, and Git-backed records. A compromised implementation could obtain the same data and execution permissions granted to the agent or plugin host.

### Attack Path

1. An attacker compromises a dependency publisher, package registry, or package-resolution source.
2. The attacker publishes a modified release under the expected mutable package name.
3. A user follows `clawdhub install git-notes-memory`, or the environment resolves the declared dependencies automatically.
4. The installer retrieves the attacker-controlled release because no version or integrity value is enforced.
5. The compromised dependency executes with the permissions granted by the hosting agent environment and accesses
...[truncated 550 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every plugin and Skill dependency to a specific reviewed version.
• Where supported, pin dependencies by cryptographic digest rather than version alone.
• Require package-signature verification and fail closed when verification is unavailable or invalid.
• Document the expected authenticated registry and prohibit fallback to untrusted sources.
• Maintain a lock file or equivalent immutable dependency manifest.
• Review dependency updates before changing pinned versions.
• Run memory-related dependencies with the minimum required filesystem, network, credential, and command-execution permissions.
• Record the publisher identity and expected artifact checksum in the setup documentation.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/file-search.sh:6

Finding

Predictable Shared Temporary File Permits Race and Symlink Attacks

Content

View full analysis

Vulnerability Details

File Location: scripts/file-search.sh:6-23
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable code:

bash

TMPFILE="/tmp/clawdbot-filesearch.txt"

if [ -z "$QUERY" ]; then
  echo "Usage: file-search.sh <query> [limit]"
  exit 1
fi

rm -f "$TMPFILE"

# Run search in background (--max-results is the correct flag)
clawdbot memory search "$QUERY" --max-results "$LIMIT" > "$TMPFILE" 2>&1 &
SEARCH_PID=$!
sleep 8
kill $SEARCH_PID 2>/dev/null
wait $SEARCH_PID 2>/dev/null

# Extract score lines (format: 0.xxx filepath:lines)
grep -E "^[0-9]\.[0-9]+" "$TMPFILE" || echo "No results"

Technical Analysis

The script uses the fixed path /tmp/clawdbot-filesearch.txt in a directory that is commonly shared among local users and processes. Removing the path before opening it does not make the operation safe because the deletion and shell redirection are separate operations.

An attacker can race the script after rm -f and create the same path as a symbolic link. Shell redirection follows symbolic links, so the search process can truncate and overwrite a target file writable by the victim account. An attacker can also create or monitor a file at the predictable path to capture search output. Concurrent legitimate executions can overwrite each other's data and produce incorrect results.

The exploitability of the symlink race depends on local access, timing, operating-system protections, and the victim's permissions. The target file must be writable by the account running the script.

Attack Path

1. A local attacker predicts the constant path /tmp/clawdbot-filesearch.txt.
2. The victim starts file-search.sh.
3. After the script removes the path, the attacker creates a symbolic link at that location pointing to a file writable by the victim.
4. The shell processes the output redirection and follows the att ...[truncated 709 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique temporary file with mktemp, and terminate if creation fails.
• Set a restrictive umask, such as umask 077, before creating the file.
• Register a cleanup trap so the unique file is removed on normal exit, interruption, and error.
• Quote all references to the generated temporary path.
• Avoid separating path validation from file creation; rely on the atomic creation guarantees provided by mktemp.
• Consider capturing output through a pipe when a persistent temporary file is unnecessary.
• Add explicit timeout handling instead of a fixed shared-file workflow.

Example hardened pattern:

bash

umask 077
TMPFILE="$(mktemp "${TMPDIR:-/tmp}/clawdbot-filesearch.XXXXXX")" || exit 1
trap 'rm -f -- "$TMPFILE"' EXIT HUP INT TERM

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description claims a complete memory system that combines multiple backends and supports persistent context management across sessions. The supplied code chunk only performs one narrow function: invoking an external search command for file-based memory search and formatting its output. There is no visible implementation of LanceDB, Git-Notes, multi-backend coordination, or broader memory management features such as storing decisions/preferences/tasks. While file-based search is one component mentioned in the description, this code alone materially underimplements the declared purpose, so the description does not accurately represent the behavior of the supplied code chunk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs silent automatic memory storage and tells the agent never to announce memory operations to users. This is dangerous because it removes informed consent and transparency around persistent storage of user-provided information, increasing the likelihood of retaining sensitive data, violating privacy expectations, and undermining auditability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill markets itself as a local memory system, but its documented setup requires an OpenAI API key for embeddings, which implies data may be sent to an external service. This creates a confidentiality and deployment-boundary risk because users may store conversation memories under the assumption they remain local when they can be transmitted off-host for embedding generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The listed trigger phrases such as 'remember', 'prefer', and common expressions like 'I like' are broad enough to match ordinary conversation, causing over-collection of user data without meaningful intent to persist it. In a memory skill, this increases privacy risk and can silently accumulate sensitive preferences, facts, or personal data across sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states 'No external API calls' for a memory component area while also instructing configuration of OpenAI-backed embeddings. That contradiction can cause operators to enable the skill in restricted or sensitive environments under false assumptions, leading to unintended exfiltration of memory contents or metadata.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Promoting silent retention of user information across sessions without disclosure creates a privacy and governance vulnerability. In the context of a memory skill, the behavior is more dangerous because persistence is the core function, so nondisclosure directly affects user trust, data minimization, and compliance obligations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example configuration enables auto-capture by default-like example without warning that user prompts, decisions, or preferences may be persisted to LanceDB. In a comprehensive memory system, this increases the chance of storing sensitive or unexpected personal/project information without informed consent or data minimization controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructs the agent to run a background memory synchronization silently at the start of every session, with no user-facing disclosure or consent step. In a memory skill, this can cause automatic collection, retrieval, or persistence of workspace and session data before the user understands that memory backends are being accessed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.