ClawHub
Back to skill

Security audit

Wb Lobster Memory

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real WorkBuddy memory bridge, but it needs Review because it can persist conversation-derived personal and work context with broad activation and uses an unpinned external installer.

Install only if you deliberately want WorkBuddy to maintain long-term local graph memory from conversations. Pin and inspect the lobster-memory dependency before running its installer, avoid storing secrets or sensitive personal/work details, set the memory directory intentionally, and use dry-run/review procedures before consolidation or deletion.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:35
Finding

Unpinned External Dependency Installer

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–36
Vulnerability Type: Unpinned third-party dependency with immediate installer execution
Risk Level: High

Complete Code Snippet:

bash
git clone https://github.com/LittleLollipop/lobster-memory.git
cd lobster-memory && bash install.sh

Technical Analysis

The documented installation procedure clones the mutable default branch of an external Git repository and immediately executes its install.sh script. It does not pin a reviewed release tag or commit hash, nor does it require verification through a cryptographic checksum or signature.

Consequently, the code executed by users can change after this skill has been reviewed. Compromise of the upstream repository, its maintainer account, or its release process could introduce arbitrary commands into the installer. This is an unsafe software supply-chain practice even though the audit found no evidence that the currently referenced project is malicious.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying its default branch.
  2. The attacker adds malicious commands to install.sh or code invoked by that script.
  3. A user follows the instructions in SKILL.md and clones the repository without selecting a fixed, previously reviewed commit.
  4. The shell executes the attacker-controlled install.sh.
  5. The payload runs with the permissions of the user performing the installation.

Impact Assessment

Successful exploitation permits arbitrary command execution under the installing user's account. Depending on that account's permissions and the commands used to run the installer, the attacker could access or alter user-readable files, steal credentials available to the process, modify development or WorkBuddy configuration, install additional software, or compromise stored memory data.

The direct privilege l ...[truncated 280 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a specific, reviewed commit hash or immutable signed release instead of the mutable default branch.

  2. Publish and verify a cryptographic checksum or signature for the expected source archive and installer before execution.

  3. Replace the clone-and-run instructions with a procedure similar to:

    bash
    git clone https://github.com/LittleLollipop/lobster-memory.git
cd lobster-memory
git checkout --detach EXPECTED_COMMIT_HASH
test "$(git rev-parse HEAD)" = "EXPECTED_COMMIT_HASH"
# Verify the documented signature or checksum here.
less install.sh
bash install.sh

  4. Document the expected commit, checksum, signer identity, and verification failure behavior.

  5. Recommend running installation with ordinary user privileges in an isolated environment and explicitly warn users not to invoke the installer with sudo.

  6. Review dependency lock files and transitive dependencies in the external engine before updating the pinned revision.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly describes persistent memory storage and consolidation/forgetting behavior, but it does not clearly warn users that remembered content is written to disk long-term or that consolidation may alter or remove stored data. In a memory skill that captures user preferences, project context, and feedback, this omission can lead to unintentional retention of sensitive information and surprise data loss during consolidation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger set includes broad, natural phrases such as '记住这个', '回忆一下', and '长期记忆', which can appear in ordinary conversation without a deliberate intent to invoke a privileged persistence workflow. In this skill, activation can cause storage and later retrieval of long-term preference, relationship, project, and feedback data, so accidental triggering may lead to unintended retention of sensitive user information and over-collection beyond user expectation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes broad long-term recording of user preferences, project context, and feedback, but does not clearly constrain when storage occurs or what approval boundary applies. In a memory skill, vague activation scope can lead to over-collection of sensitive conversational data, unexpected persistence, and recall of information the user did not intend to store.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says the skill stores user preferences and project context in long-term graph memory, but it does not explicitly warn users that personal and work-related information may be persisted beyond the current session. This weakens informed consent and increases the risk of sensitive data retention, especially because memory systems can accumulate behavioral, relational, and project intelligence over time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This is a code file, so natural-language policy checks apply to comments and docstrings. The opening docstring presents the skill description and usage notes only in Chinese, which can impose a language constraint on users or maintainers without any opt-in or stated regional justification.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This skill is explicitly designed to persist and later replay user conversation-derived memories, including preferences, relationships, feedback, and emotional valence. That creates a real privacy and data-retention risk: sensitive user content may be stored longer than intended, recalled in later contexts, or exposed through local file access or over-broad memory queries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.