ClawHub
Back to skill

Security audit

snswatcher

Security checks for vulnerabilities and agentic risk

Overview

This prototype can save entire short comments in persistent memory despite promising never to retain complete comments.

Use non-sensitive test comments and request --dry-run before updating memory. Short comments can be saved verbatim, and statistical verification does not establish truth, safety, or authenticity. An unwanted update can be removed by deleting its labeled memory block.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

The fallback can store an entire comment despite explicit guarantees that raw comments are never retained.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

For a single-sentence comment of at most 160 characters, the fallback summary retains the complete comment, contradicting the explicit no-raw-comment retention guarantee. If that comment passes verification, its full contents can be persisted in the agent's MEMORY.md, creating a privacy and retention risk; whitespace normalization and Markdown-prefix removal do not provide meaningful redaction.

Content

No source excerpt is available for this finding.

The output option permits appending to arbitrary files rather than only MEMORY.md.

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The manifest limits persistence to MEMORY.md, and L008-L010 additionally promise that no other files are written. The unrestricted --memory-out path is selected at L348 and used at L373-L375 to create parent directories and append to any caller-selected writable file, without checking that it is the intended memory file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.