ClawHub
Back to skill

Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local memory integration, but it asks the agent to follow mutable local-server instructions and persist conversation summaries automatically across sessions.

Review this skill before installing if you plan to use it with confidential work. Treat the local SAGE server and dashboard as trusted components because they can influence agent behavior and store durable memory. Avoid storing secrets or sensitive personal data unless you have checked the dashboard, encryption, deletion controls, and release provenance for the installed SAGE binary.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:41
Finding

Mandatory Dynamic Instruction Loading Can Hijack Agent Behavior

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:59
Finding

Automatic Persistent Storage Enables Memory Poisoning and Unintended Retention

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:123
Finding

Installation Instructions Execute Unverified External Release Binaries

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

MCP Config Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
3. Start the server: `sage-gui serve`
4. Run `sage-gui mcp install` in your project directory to generate `.mcp.json`, then restart your session

You can review the generated `.mcp.json` — it contains only the localhost connection URL and MCP tool
definitions. No credentials or API keys are included.

## Key Principles

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says to use the skill to 'manage persistent agent memory, recall past context, reflect on completed tasks, and maintain continuity across sessions' and includes very broad keywords like 'memory', 'recall', 'remember', 'context', and 'brain'. For a markdown skill description, these terms overlap with common conversational language and the file does not provide explicit trigger boundaries or negative examples to distinguish when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This skill is explicitly designed to persist cross-session memory, including summaries of conversation topics, task outcomes, and user preferences. Even though storage is local and transcripts are not automatically captured, the mandatory per-turn memory guidance creates a real risk of retaining sensitive user data longer than expected, especially if the agent stores secrets, personal data, or confidential work context without explicit consent each session.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
This skill enables **persistent memory storage** for AI agents. By design:

- **What is stored**: Observations you write via `sage_turn` and `sage_remember` — typically summaries
  of conversation topics, task outcomes, and user preferences. The agent decides what to store; raw
  conversation transcripts are NOT automatically captured.
- **Where data lives**: All data is stored **locally** on your machine in `~/.sage/data/sage.db` (SQLite).

Static analysis

No suspicious patterns detected.