ClawHub
Back to skill

Security audit

ClawBrain Recall

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed memory-recall skill with no executable code, but users should know it may search past conversations when recall-like phrases are used.

Install this only if you want the agent to search and reuse past conversation memory. Avoid storing highly sensitive information in the connected memory system, since normal recall-style prompts may bring prior history into later answers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The listed auto-trigger phrases are very broad, conversational expressions that can appear in ordinary user dialogue without an explicit request to search stored memory. In a recall skill, that creates a real risk of unintended activation, which can surface historical conversation content or metadata when the user did not mean to invoke memory search.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.