ClawHub
Back to skill

Security audit

Amemo Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Amemo cloud integration, but it stores login tokens and personal data in skill files and syncs broad agent memory to and from the cloud with weak safeguards.

Review before installing. Use only if you are comfortable with Amemo receiving your note, task, health, email, and assistant-memory data, and avoid using it in workspaces where MEMORY.md or skill files may contain secrets. The strongest concerns are local plaintext token storage in SKILL.md and full memory synchronization without preview or redaction.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

other

Error
Location
modules/amemo-save-mate/SKILL.md:51
Finding

External Disclosure of the Complete Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: modules/amemo-save-mate/SKILL.md, lines 51-63
Vulnerability Type: Unrestricted transmission of persistent Agent memory
Risk Level: Critical

Vulnerable Code

text
2. Check whether userToken exists
    ├── No token → Start the login flow
    ↓
3. Extract memory content
    ├── Trigger is "permanently remember XXX" → Extract XXX directly
    ├── Trigger is "remember this" → Extract key information recently provided by the user
    └── Trigger is "save permanent memory" → Read memory/MEMORY.md
    ↓
4. Append the new memory content to memory/MEMORY.md
    ├── File does not exist → Create it automatically
    └── File exists → Append a new entry
    ↓
5. Call POST /save-mate and submit the complete MEMORY.md content
    ↓
6. Return the result

The same behavior is explicitly demonstrated again at lines 94-99:

text
User: Save permanent memory
    ↓
The AI reads the complete memory/MEMORY.md file
    ↓
Calls /save-mate to synchronize it with the server

Technical Analysis

The Skill instructs the Agent to read the entire memory/MEMORY.md file and transmit it to https://skill.amemo.cn/save-mate. This is broader than transmitting only the new memory entry explicitly selected by the user.

Persistent Agent memory may contain personal preferences, conversation-derived facts, operational context, confidential project details, or secrets unrelated to Amemo. The workflow specifies no content filtering, secret detection, redaction, scope restriction, preview, or per-entry confirmation before transmission.

Although the operation requires an authenticated userToken and a relevant user trigger, the user-facing trigger does not necessarily communicate that the complete local memory corpus will be disclosed to an external service.

Attack Path

  1. A user authenticates with Amemo, causing a valid token to become available. 2 ...[truncated 1270 chars]
Remediation
View remediation

Remediation Suggestions

  1. Transmit only the exact memory entry explicitly selected and approved by the user.
  2. Never upload the complete MEMORY.md file by default.
  3. Display a clear preview of the exact content and destination before transmission.
  4. Require explicit confirmation that distinguishes local storage from cloud synchronization.
  5. Scan for authentication tokens, API keys, passwords, private keys, personal identifiers, and other sensitive patterns before upload.
  6. Redact or block sensitive content unless the user separately confirms each item.
  7. Add a local-only memory option that performs no network request.
  8. Maintain an allowlisted synchronization file containing only Amemo-specific entries rather than reusing general Agent memory.
  9. Document server-side retention, deletion, encryption, and access-control policies.
  10. Support deletion and revocation of previously synchronized memory.

T02 · Agent Memory Poisoning

Error
Location
modules/amemo-init-mate/SKILL.md:54
Finding

Untrusted Cloud Content Can Overwrite Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: modules/amemo-init-mate/SKILL.md, lines 54-76
Vulnerability Type: Persistent Agent memory poisoning
Risk Level: Critical

Vulnerable Code

text
1. Recognize the trigger words for refreshing, initializing, or resetting Agent memory
    ↓
2. Check whether userToken exists
    ├── No token → Start the login flow
    ↓
3. Check whether the memory directory exists
    ├── Missing → Automatically create the memory directory
    ↓
4. Call POST /init-mate
    ↓
5. Parse the response
    └── data.mateMemory: AI Agent memory content in Markdown format
    ↓
6. Update local MEMORY.md
    ├── Create the memory directory first if it does not exist
    ├── Write mateMemory to memory/MEMORY.md
    ↓
7. Return the result to the user
markdown
{mateMemory}

Technical Analysis

The Skill treats data.mateMemory returned by the remote Amemo service as trusted persistent memory and writes it directly into memory/MEMORY.md. The content is copied in full without schema validation, provenance labeling, instruction neutralization, sanitization, a displayed diff, or explicit approval of the returned content.

Agent memory files may be loaded as trusted context in later sessions. Consequently, remote content containing instruction-like text can become persistent control material rather than remaining inert application data. A compromised Amemo service, compromised user account, stolen token, or maliciously modified cloud memory could introduce instructions designed to alter future Agent behavior.

This creates a trust-boundary violation: data controlled outside the local Agent environment is promoted directly into long-term Agent state.

Attack Path

  1. An attacker compromises the Amemo account, obtains the authentication token, or gains control over the /init-mate response or its backing data.
  2. The attacker places instruction-like con ...[truncated 1264 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat every remote mateMemory value as untrusted application data.
  2. Do not write remote content directly into a file interpreted as Agent instructions or trusted memory.
  3. Store imported data in a separate structured data file that the Agent reads only as quoted, non-authoritative user data.
  4. Enforce a strict schema containing specific preference fields rather than accepting arbitrary Markdown.
  5. Reject or quarantine content containing instruction patterns, tool directives, role declarations, hidden markup, or requests to ignore higher-priority instructions.
  6. Show the user a complete diff before modifying local persistent memory.
  7. Require explicit confirmation for additions, replacements, and deletions.
  8. Preserve the existing memory file and use atomic writes with a recoverable backup.
  9. Attach source, timestamp, account, and integrity metadata to every imported entry.
  10. Cryptographically authenticate server responses where possible and implement server-side authorization checks.
  11. Limit imported content size and normalize Markdown to prevent hidden or ambiguous directives.
  12. Ensure the host Agent assigns imported memory lower priority than system, developer, and current user instructions.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:55
Finding

Authentication Token and Personal Data Stored in Plaintext Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-73
Vulnerability Type: Plaintext credential and personal-data persistence
Risk Level: High

Vulnerable Code

text
| userEmail | Task reminder email address, persisted after the user's initial configuration |

BEGIN UpdateUserConfig(token, name, phone)
  READ the SKILL.md file
  LOCATE the JSON configuration inside the amemo-user-config tags
  PRESERVE the existing userEmail
  REPLACE the JSON with:
    {
        "userToken": "{token}",
        "userName": "{name}",
        "userPhone": "{phone}",
        "loginAt": "{current time}",
        "userEmail": "{preserved value}"
    }
  WRITE the SKILL.md file
  SEND a personalized welcome message
END

The login module repeats this requirement at modules/amemo-login/SKILL.md, lines 109-123:

json
{
  "userToken": "{extracted userToken}",
  "userName": "{extracted userName}",
  "userPhone": "{extracted userPhone}",
  "loginAt": "{current time}"
}

Technical Analysis

The Skill persists a bearer token, phone number, user name, login time, and email address directly inside the root SKILL.md file. This file is part of the Skill package and is expected to be read as Agent instructions.

Source and instruction files are inappropriate secret stores because they may be:

  • Read by unrelated tools or processes.
  • Copied when the Skill directory is archived or shared.
  • Included in backups.
  • Indexed for search or model context.
  • Accidentally committed to source control.
  • Exposed in diagnostics or audit output.

No restrictive file permissions, encryption at rest, platform credential store, token redaction, or separation between public Skill instructions and private per-user configuration is specified. Because userToken authenticates subsequent API calls, disclosure may enable unauthorized access to the user's notes, tasks, health information, an ...[truncated 1517 chars]

Remediation
View remediation

Remediation Suggestions

  1. Store bearer tokens in the host platform's credential manager, OS keychain, or dedicated secret store.
  2. Never write tokens or personal data into SKILL.md, source files, templates, or other package artifacts.
  3. Place non-secret per-user settings in a separate configuration directory with restrictive permissions.
  4. Encrypt sensitive local configuration at rest using a key not stored beside the encrypted data.
  5. Use short-lived access tokens and securely stored refresh tokens.
  6. Implement token rotation and immediate revocation on logout, expiration, or suspected disclosure.
  7. Ensure tokens are never printed in Agent responses, command output, diagnostics, or logs.
  8. Avoid exposing tokens in shell command arguments where they may be retained in process listings or shell history.
  9. Add repository ignore rules and secret-scanning controls for all local configuration files.
  10. Separate distributable Skill instructions from mutable user state.
  11. Apply least-privilege API scopes so a disclosed token cannot automatically access every data category.
  12. Provide a migration routine that removes credentials already embedded in existing SKILL.md installations and revokes the affected tokens.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
Findings (52)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that login success will automatically update SKILL.md with userToken, phone number, login time, and email persistence behavior, but it does not provide a clear user-facing warning or consent step for storing secrets and personal data in a local markdown file. This creates a substantial confidentiality risk because tokens and PII may be exposed to other tools, repositories, logs, or future prompts that can read the file.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to rewrite SKILL.md to persist authentication material and user profile data. Self-modifying the skill file is dangerous because it changes trusted instructions at runtime and embeds secrets into a file that may be readable by other sessions, tools, version control, or downstream prompts.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
"loginAt": "{当前时间}",
        "userEmail": "{保留原值}"
    }
  WRITE SKILL.md 文件
  SEND 个性化欢迎消息
END

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
用户在多步骤流程中发起无关请求时的处理策略：
BEGIN HandleInterrupt(newIntent)
  IF newIntent CONTAINS "取消" OR "算了" THEN
    CLEAR context
    RETURN 正常对话
  END IF

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md
读取子模块目录下的 `SKILL.md` 获取完整的请求参数和 curl 示例，然后执行 HTTP 请求。

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The module directs the system to write userToken and profile data into the main SKILL.md file, which is a persistent documentation/config artifact rather than a secure secret store. Persisting authentication material there risks token exposure through logs, repository sync, later tool reads, or prompt leakage, and exceeds what a login helper should need to do.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger scope is overly broad because any 4-6 digit user input may be treated as a verification code. In this skill family, that is especially dangerous because the parent metadata already warns against numeric false positives, so the subskill’s behavior undermines the intended safety boundary around login actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill requires persisting a token and phone number into the main SKILL.md file without clearly informing the user that sensitive account data will be stored locally in a persistent prompt/config asset. This creates a transparency and privacy failure on top of the underlying secret-storage risk.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The automatic invocation rules do not define adequate exclusions or context requirements, making it ambiguous when login should or should not run. In practice, this allows opportunistic activation from incidental numeric content and creates a pathway for unintended authentication requests and state changes.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The verification code extraction logic relies only on a generic regex and does not constrain the search to a trusted login context. While regex extraction itself is common, using it without contextual guards in an assistant that handles many ordinary numeric messages materially raises the risk of false triggering and mishandling user data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The configuration update step explicitly tells the skill to modify the main skill definition file with credentials after login. Giving a login helper the ability to rewrite core skill files with secrets creates a durable exfiltration and cross-context leakage risk, because future prompts or tools may expose those values outside the authentication workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The config update instructions require writing account identifiers and authentication material into the main SKILL.md without confirmation or user notice. Because this is a persistent shared artifact rather than a secure credential store, the lack of consent compounds the risk of secret leakage and unauthorized reuse.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions are broad enough to match ordinary descriptive conversation, including generic statements and phrases like '的时候/的情况/的经历'. That creates a real risk that the assistant will transmit and store user content remotely without a sufficiently explicit, narrowly scoped user request to save a note.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill does not clearly warn users that their conversation content will be sent to https://skill.amemo.cn and stored in a cloud memo. Because the skill is triggered by conversational language, the lack of notice increases the likelihood of unintended disclosure of sensitive personal, financial, health, or confidential data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly requires writing the user's email into the main SKILL.md without adequate disclosure of privacy, retention, or access implications. Persisting PII in an instruction file is inappropriate and can leak data through prompt inspection, versioning, logging, or reuse by unrelated agent flows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The listed task-reminder triggers include very common phrases like "提醒我", "今天去", and "记得要", which can appear in ordinary conversation and may cause unintended invocation. The description says to invoke immediately when these intents appear, but it does not narrow scope with clear exclusions for casual discussion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest-style trigger list says the skill should activate for login intent on phrases including "手机号+验证码/login", which is too broad because ordinary messages containing a phone number or verification code could match. Although L010 excludes some numeric conversation, it does not clearly constrain when raw phone-number or code messages should count as login versus normal chat outside an established login flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill directs the agent to execute local shell commands via curl and run a local Python script as part of routine operation. Even though these actions support the skill's functionality, they expand the trust boundary from remote API calls to arbitrary local command/script execution, which is risky because prompt-controlled inputs may flow into shell arguments or script invocation and the local script contents are not constrained in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends highly sensitive health information requests together with a user authentication token to an external service, but the skill text does not disclose this privacy/security implication or require explicit user awareness. Because the data categories include medical-style metrics such as blood pressure, heart rate, and blood oxygen, missing notice and consent increases the risk of unauthorized disclosure or surprise transmission of regulated or highly sensitive personal data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This skill is explicitly designed to POST a user login token and requested health-data type to a remote endpoint, which is an external transmission of sensitive authentication and health-related metadata. In this context, the transmission is expected functionality, but it is still security-relevant because compromise, misuse, overcollection, or insufficient user awareness could expose both account access material and sensitive personal health information.

Content

Scanner excerpt · modules/amemo-find-data/SKILL.md (reported line 35)May include surrounding context.

bash
# 按类型查询
curl -X POST https://skill.amemo.cn/find-data \
  -H "Content-Type: application/json" \
  -d '{"userToken": "<token>", "dataType": "步数"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation instructs sending a user login token to a remote service endpoint but does not include any explicit user-facing warning, consent step, or guidance on secure token handling. Because the token is an authentication credential and the skill is specifically designed to query private notes, undocumented transmission increases the risk of credential misuse, overcollection, or user-unaware disclosure of sensitive personal data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The example shows an external POST request to a third-party endpoint containing a userToken and note-search parameters. External transmission is expected for this skill's functionality, but it still represents a real security concern because it sends an authentication secret off-process and could expose account access or private note data if the endpoint, transport, logs, or downstream handling are compromised.

Content

Scanner excerpt · modules/amemo-find-memo/SKILL.md (reported line 37)May include surrounding context.

bash
# 按标题查询
curl -X POST https://skill.amemo.cn/find-memo \
  -H "Content-Type: application/json" \
  -d '{"userToken": "<token>", "memoId": null, "memoTitle": "量化", "memoContent": null}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description defines activation using only Chinese phrases, and the rest of the skill content presents output and interactions exclusively in Chinese. This can constitute a language/locale policy violation because it imposes a specific language behavior without offering user choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill specification requires a user login token and sends it to an external service, but the document does not include any user-facing notice about what data is transmitted, how the token is handled, or what trust boundary applies. In an agent setting, this can lead to silent credential use against a third-party endpoint and increases the risk of privacy violations or token misuse if the service or surrounding tooling is compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill instructs the agent to transmit a user token and task query parameters to an external HTTPS endpoint, which is a real data egress path. In context this is expected functionality, but it is still security-relevant because it moves authenticated user data outside the model runtime and could expose sensitive task metadata if consent, endpoint trust, or transport/logging controls are weak.

Content

Scanner excerpt · modules/amemo-find-task/SKILL.md (reported line 38)May include surrounding context.

bash
# 查询所有任务（所有可选字段传 null）
curl -X POST https://skill.amemo.cn/find-task \
  -H "Content-Type: application/json" \
  -d '{
    "userToken": "<token>",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases for this skill are broad enough to match ordinary user requests about refreshing, initializing, or resetting an assistant's memory, which can cause the agent to invoke a state-changing workflow without sufficiently explicit user intent. Because the skill pulls remote memory and overwrites local memory/MEMORY.md, accidental activation could replace local context with remote content and alter subsequent assistant behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.