ClawHub
Back to skill

Security audit

lossless-claw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local memory tool, but it asks agents to retain conversation logs and personal details permanently without clear privacy controls.

Review this skill before installing if your conversations may contain credentials, private personal details, business data, or other sensitive information. Use it only with inputs you are comfortable retaining, and require a clear storage location, review step, redaction process, and deletion path before applying long-term memory changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:12
Finding

Unbounded Retention of Sensitive Conversation Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–15 and 27–29
Vulnerability Type: Privacy-sensitive data collection and retention
Risk Level: Medium

The skill instructs the agent to process conversation transcripts or logs, extract identity information and preferences, preserve original content, and permanently retain selected information.

markdown
1. 读取会话文本或日志
2. 提取身份、偏好、任务、知识
3. 将原始内容保留到短期日志
4. 将高价值内容提升到长期层
markdown
- 重要内容永久固化
- 无效噪声不进入长期层
- 保留完整短期回溯链路

Technical Analysis

Conversation logs can contain credentials, authentication tokens, personal identifiers, confidential business information, and other sensitive data. The documented workflow explicitly calls for retaining raw content and permanently promoting selected information to a long-term layer.

No consent check, sensitive-data filter, field allowlist, retention deadline, encryption requirement, access-control policy, deletion facility, or documented storage location is specified. Consequently, sensitive information could be copied into durable storage without adequate controls. The referenced scripts/personal_ai_memory.py implementation is absent from the audited project, so its actual storage and protection behavior cannot be verified.

Attack Path

  1. A user supplies a session transcript containing personal information, credentials, or confidential material.
  2. The workflow reads the transcript and extracts identity, preference, task, and knowledge fields.
  3. The original transcript is retained in a short-term log.
  4. Content considered valuable is promoted to long-term storage, particularly when the documented --apply operation is used.
  5. A later session, user, process, or storage compromise accesses or discloses the retained information.

Impact Assessment

Successful exploitation or accidental exposure could disclose sensitive conversation content across sessions. The affected scope inclu ...[truncated 302 chars]

Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed user consent before processing or retaining transcripts.
  • Make raw-session retention opt-in rather than the default.
  • Detect and redact credentials, tokens, private keys, financial data, health data, and sensitive identifiers before storage.
  • Use an allowlist of fields eligible for long-term retention instead of broadly extracting identity and knowledge.
  • Require user review and confirmation before applying long-term-memory changes.
  • Encrypt retained data at rest and restrict access according to least privilege.
  • Define short, enforceable retention periods for raw logs and automatically delete expired records.
  • Provide mechanisms to inspect, correct, export, and permanently delete retained information.
  • Document the storage location, trust boundary, access model, and backup behavior.
  • Include the referenced script in the package for review, or remove the nonfunctional command documentation until its implementation can be audited.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly processes session text/logs and promotes extracted identity, preferences, tasks, and knowledge into a long-term layer, but it does not warn users that personal or sensitive data may be retained and persisted. This creates a real privacy and consent risk because users may provide logs containing personal data without understanding that the information can be stored beyond the current session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest description and body text are entirely in Chinese, with no indication that users may choose another language or locale. This can be a natural-language policy concern if the skill implicitly forces a specific language without opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.