ClawHub
Back to skill

Security audit

Memory Key

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small memory-folder pointer with templates, and its disclosed behavior is proportionate, though users should review the companion memory-treasure skill before installing it.

Before installing, confirm that you want a memory workflow under ~/.openclaw/workspace/memory/ and separately inspect or trust the memory-treasure skill, since this package depends on it for actual memory management.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned External Skill Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-24
Vulnerability Type: Unpinned third-party Skill installation
Risk Level: Medium

Complete Code Snippet:

text
clawhub install memory-key
clawhub install memory-treasure

Technical Analysis

The installation instructions direct users to retrieve and install the external memory-treasure Skill without specifying an immutable version, integrity digest, authoritative source, or review requirement. Consequently, the dependency resolved when the command is executed may differ from the implementation originally intended or reviewed.

The companion Skill's implementation is not included in this project, so its behavior and security properties cannot be verified by this audit. Installing it also expands the effective functionality beyond this project's stated role as a path pointer.

Attack Path

  1. An attacker compromises the publishing account or distribution source for memory-treasure, or publishes a malicious package that is resolved under that name.
  2. The attacker releases a modified version containing harmful instructions or executable behavior.
  3. A user follows the installation instructions in SKILL.md.
  4. ClawHub retrieves the current mutable package without validating it against a project-specified version or digest.
  5. The malicious package executes or influences the agent using whatever permissions and tool access the installation environment grants it.

Impact Assessment

Successful exploitation could allow the substituted dependency to access or alter memory data, influence subsequent agent behavior, invoke available tools, or perform other actions permitted to installed Skills. The exact privilege level and affected scope depend on the ClawHub runtime, the agent's tool permissions, and the behavior of the retrieved package. No malicious behavior in memory-treasure itself was established because that dependency was ...[truncated 35 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin memory-treasure to a reviewed, immutable version or cryptographic digest.
  • Document the authoritative package publisher and source repository.
  • Verify package signatures or checksums before installation.
  • Review and document the dependency's required permissions and memory access.
  • Make installation of the companion Skill optional unless it is strictly required.
  • Where feasible, vendor the reviewed dependency implementation into the project so it can be audited together with this Skill.
  • Establish an update process requiring security review before changing the pinned dependency version.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad and generic enough that the skill could be invoked in unrelated conversations about memory or a 'memory palace,' causing unintended activation. In this skill’s context, that matters because it directs users or downstream tooling to a specific filesystem path, which can create confusing or unnecessary exposure of local environment structure even if it performs no other action.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrase '记忆宫' is a broad wake phrase with no scope constraints, authentication, or conditions on what memory behavior it enables. In a memory-related skill, an underspecified trigger can cause accidental activation, prompt collisions with unrelated conversation, or unauthorized invocation that alters or exposes persistent memory state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The file presents core headings, description, and trigger information in both Chinese and English, but does not state whether the skill operates in a specific language or lets the user choose. Under the language/locale policy, skills should not implicitly force or assume a language without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown template uses Chinese section headings throughout, which imposes a specific language on users without any accompanying note that the language is optional or configurable. The policy requires flagging language or locale constraints when they are forced without user opt-in or documented justification.

Content

No source excerpt is available for this finding.