Memory Hygiene

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This memory-maintenance skill is coherent but asks for irreversible memory deletion and a persistent monthly wipe job without enough guardrails.

Review this skill carefully before installing. Use the audit and storage guidance only after confirming what is in your memory store. Do not run the wipe command or create the monthly cron job unless you have a backup, have verified the exact path, and are comfortable losing and rebuilding all vector memory.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:17

Finding

Unbounded Destructive Deletion of the Vector Memory Database

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-22
Vulnerability Type: Unsafe recursive deletion without validation or recovery controls
Risk Level: High

Vulnerable Code:

markdown

**Wipe:** Clear all vector memory
```bash
rm -rf ~/.clawdbot/memory/lancedb/

Then restart gateway: clawdbot gateway restart

text

### Technical Analysis

The Skill recommends executing `rm -rf` directly against the complete LanceDB storage directory. This operation is recursive, irreversible, and does not include path canonicalization, existence or ownership checks, an interactive confirmation, a backup, or transaction and recovery handling.

Although the path is nominally limited to the user's home directory, its effective target depends on environment expansion and filesystem layout. The command could remove all valid vector memories immediately. Symbolic links, unexpected home-directory configuration, or changes to the expected storage layout could also cause behavior beyond the intended cleanup scope.

The subsequent gateway restart does not restore deleted information and may make the destructive operation appear to have completed normally.

### Attack Path

1. A user invokes the documented “Wipe” procedure to perform memory maintenance.
2. The shell expands `~` to the executing account's home directory.
3. `rm -rf` recursively removes the entire `memory/lancedb` directory without requesting confirmation.
4. All valid and invalid vector-memory records are deleted together.
5. The gateway is restarted, but the deleted memory remains unavailable because no backup or rollback mechanism exists.

### Impact Assessment

Exploitation does not grant additional operating-system privileges; the command runs with the privileges of the invoking user or agent. Within those privileges, however, it can permanently delete the complete vector-memory database.

The affected scope includes all memories stored in t
...[truncated 336 chars]

Remediation

View remediation

Remediation Suggestions

• Replace direct recursive deletion with a supported LanceDB or memory-plugin cleanup API where available.
• Stop or quiesce the gateway before modifying its storage to prevent concurrent access and database corruption.
• Resolve and canonicalize the target path, then verify that it exactly matches the expected database directory.
• Reject symbolic links and verify ownership and permissions before deletion.
• Require explicit user confirmation that identifies the exact path and expected data loss.
• Create a timestamped backup or atomic snapshot before cleanup and document a tested restoration procedure.
• Prefer selective deletion based on age, category, or confidence rather than deleting the complete database.
• If filesystem deletion remains necessary, use a guarded maintenance script that fails closed when any validation check is unsuccessful.

T06 · System Persistence

Error

• Location: SKILL.md:60

Finding

Persistent Scheduled Task Performs Unattended Memory Erasure and Reseeding

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-68
Vulnerability Type: Persistent scheduled destructive maintenance task
Risk Level: High

Vulnerable Code:

markdown

## Monthly Maintenance Cron

Set up a monthly wipe + reseed:

cron action=add job={ "name": "memory-maintenance", "schedule": "0 4 1 * *", "text": "Monthly memory maintenance: 1) Wipe ~/.clawdbot/memory/lancedb/ 2) Parse MEMORY.md 3) Store key facts to fresh LanceDB 4) Report completion" }

text

Technical Analysis

The Skill directs the agent to register a recurring cron job that survives the original Skill invocation. Every month, the job instructs an agent to wipe the complete LanceDB directory, parse MEMORY.md, and repopulate persistent vector memory.

The task lacks an approval gate, backup requirement, path validation, retention policy, integrity verification, failure recovery, and restrictions on what may be extracted from MEMORY.md. The natural-language instruction also leaves “key facts” undefined, making reseeding behavior dependent on the executing agent's interpretation.

Because the scheduled task persists across sessions, its destructive and data-processing effects recur without contemporaneous user authorization. Parsing the entire memory file can also place sensitive material into a vector store if filtering is incomplete, despite the document's separate recommendation not to store tokens.

Attack Path

1. A user or agent follows the Skill and registers the memory-maintenance cron job.
2. The scheduled task persists after the initial maintenance session.
3. At 04:00 on the first day of each month, the task executes without a fresh confirmation.
4. The task wipes ~/.clawdbot/memory/lancedb/, deleting all existing vector memories.
5. It parses MEMORY.md, which may contain sensitive or irrelevant information.
6. Agent-selected “key facts” are written into the fresh persisten ...[truncated 819 chars]

Remediation

View remediation

Remediation Suggestions

• Do not schedule an unconditional full database wipe. Use scoped retention rules that remove only records meeting explicit age, category, or quality criteria.
• Require fresh user approval before every destructive maintenance operation.
• Create and verify a restorable backup before modifying the database.
• Validate and canonicalize the database path and reject symbolic links or unexpected ownership.
• Replace the natural-language reseeding operation with a deterministic, reviewed procedure.
• Define a strict allowlist of permitted memory categories and fields.
• Apply mandatory secret detection and redaction before any content from MEMORY.md is stored.
• Record an audit log containing the execution time, approved scope, deleted record count, inserted record count, and any filtered sensitive values.
• Add failure handling so that unsuccessful parsing or reseeding restores the previous database rather than leaving an empty or partial store.
• Provide explicit commands to inspect, disable, and remove the scheduled task, and use a nonpersistent one-time maintenance operation by default.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The skill instructs use of a raw 'rm -rf /.clawdbot/memory/lancedb/' command, which is a high-risk parameter usage pattern because it performs irreversible recursive deletion via shell semantics. Even though the intended target is narrower than '', documentation that encourages direct destructive shell commands in an agent-maintenance skill increases the chance of path mistakes, variable expansion errors, or unsafe automation.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Wipe: Clear all vector memory

bash

rm -rf ~/.clawdbot/memory/lancedb/

Then restart gateway: clawdbot gateway restart

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The skill instructs use of a raw 'rm -rf /.clawdbot/memory/lancedb/' command, which is a high-risk parameter usage pattern because it performs irreversible recursive deletion via shell semantics. Even though the intended target is narrower than '', documentation that encourages direct destructive shell commands in an agent-maintenance skill increases the chance of path mistakes, variable expansion errors, or unsafe automation.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Wipe: Clear all vector memory

bash

rm -rf ~/.clawdbot/memory/lancedb/

Then restart gateway: clawdbot gateway restart

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents a destructive deletion of the LanceDB memory directory without requiring confirmation, backup, or explicit validation of the target path. In an agent context, users or downstream automation may execute this command verbatim, causing irreversible loss of stored memory and potential operational disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The scheduled monthly wipe-and-reseed job automates recurring destructive behavior without safeguards such as backup, dry-run validation, or confirmation. If misconfigured or triggered unexpectedly, it can repeatedly erase memory state and normalize unsafe deletion practices in production environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.