ClawBrain Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 1.2.0

Overview

This memory skill is coherent but should be reviewed carefully because it enables automatic long-term storage and reuse of conversation and identity information without clear limits or consent controls.

Review this before installing if you discuss sensitive, personal, business, legal, medical, or confidential topics. The skill may persist conversation-derived memories across sessions and update profile or identity facts automatically; install only if you understand how to inspect, correct, delete, disable, and control the memory store.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:38

Finding

Unvalidated Conversation Input Can Poison Persistent Identity Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-40
Vulnerability Type: Persistent memory poisoning through unvalidated identity updates
Risk Level: Medium

Vulnerable Content

The audited passage states, in English translation:

markdown

### Real-Time Identity Updates

When you tell the Agent that you changed jobs, changed roles, or made any other identity change, the new information takes effect immediately without waiting or restarting. Old identity information is archived rather than overwritten.

Technical Analysis

The Skill instructs the Agent to make conversationally supplied identity changes effective immediately and preserve them across sessions. It does not define authentication, confirmation, provenance validation, trust boundaries, or restrictions on which conversations may modify persistent identity records.

Consequently, untrusted or inaccurate conversational input may be treated as authoritative identity data. Archiving rather than deleting the previous value also causes attacker-controlled or erroneous information to remain in long-term storage. Subsequent memory consolidation may further reinforce that information.

The project contains only SKILL.md; no implementation was available to verify backend authorization controls, storage encryption, retention limits, or the precise influence of stored identity records. The finding therefore concerns the unsafe behavior explicitly specified by the Skill and does not establish operating-system compromise or arbitrary code execution.

Attack Path

1. An attacker obtains the ability to interact with the Agent, contributes content through an untrusted conversation, or causes attacker-controlled text to be processed as user input.
2. The attacker submits a false identity statement, such as a claim that the user has changed roles, organizations, responsibilities, or preferences.
3. Following the Skill instruction, the Agent make ...[truncated 1202 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before committing identity, employment, role, authorization, or other sensitive profile changes to persistent memory.
2. Restrict persistent-memory mutation to authenticated first-party conversations and reject updates originating from retrieved documents, quoted text, tool output, shared channels, or other untrusted sources.
3. Store provenance metadata with every record, including source, timestamp, conversation identifier, confidence, and whether the content is a direct statement or an AI-generated inference.
4. Treat stored memories exclusively as data. Never interpret remembered text as system instructions, authorization grants, tool permissions, or safety-policy overrides.
5. Use a pending-update workflow for sensitive changes and display the old and proposed values before approval.
6. Preserve an auditable version history while allowing users to inspect, correct, delete, and permanently purge inaccurate records.
7. Apply retention limits and data minimization so that only necessary identity fields are stored.
8. Ensure memory retrieval favors verified, recent records and exposes conflicts instead of silently replacing trusted information.
9. Add tests covering prompt injection, impersonation, shared-session contamination, conflicting identity claims, and poisoning through quoted or retrieved content.
10. Protect the underlying memory service with strong authentication, authorization, encryption in transit and at rest, and tenant isolation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description prominently advertises that the system will 'remember everything' and preserve cross-conversation structured long-term memory, but it does not provide a clear warning that user conversation content may be persistently stored. In this context, the omission is dangerous because users may disclose personal, confidential, or regulated data without understanding it will be retained beyond the current chat and potentially surfaced later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill says it is 'installed and automatically effective' and gives broad example prompts for recall, but it does not define when memory retrieval or storage occurs, what scope is covered, or how users can control it. For a long-term memory skill, vague auto-activation boundaries can cause unanticipated collection and retrieval of sensitive conversation content across sessions, increasing privacy and data-minimization risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.