critical
suspicious.env_credential_access
- Location
- src/autoDream.ts:113
- Finding
- Environment variable access combined with network send.
Enhanced Memory System V3
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
Detected: suspicious.env_credential_access
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
A malicious search query or saved memory entry could run commands on the user's machine when vector search is used.
Why it was flagged
The skill constructs a shell command from the search query or memory text and executes it. Only double quotes are escaped, so crafted text containing shell-breaking characters could execute local commands.
Skill content
const curlCmd = ... ${model} ... ${cleanText.replace(/"/g, '\\"')} ...; const { stdout } = await execAsync(curlCmd, { timeout: 30000 });Recommendation
Replace shell-based curl with fetch or spawn/execFile using fixed arguments, and disable vector search until command injection is fixed.
What this means
If invoked with a crafted path, the agent could read files outside the memory store, potentially exposing private local files.
Why it was flagged
memory_get accepts absolute paths and relative paths without checking that the resolved file remains inside memoryDir.
Skill content
if (!path.isAbsolute(p)) { return path.join(baseDir, p); } return path.resolve(p); ... const content = await fs.readFile(fullPath, 'utf-8');Recommendation
Reject absolute paths and '..' traversal, normalize paths, and enforce that all reads remain under the configured memory directory.
What this means
A mistaken or manipulated invocation could create or overwrite files outside the intended memory directory.
Why it was flagged
memory_write uses the same unbounded path expansion and then writes to that resolved path, including overwrite mode.
Skill content
if (!path.isAbsolute(p)) { return path.join(baseDir, p); } return path.resolve(p); ... await fs.writeFile(fullPath, content, 'utf-8');Recommendation
Constrain writes to memoryDir, block absolute/traversal paths, consider extension allowlists, and require explicit approval for overwrites.
What this means
Private user preferences, feedback, project notes, or secrets stored in memory may leave the local machine and be processed by a third-party provider.
Why it was flagged
AutoDream builds prompts from memory file contents and sends them to the MiniMax API.
Skill content
recentFiles.map(f => `## ${f.relativePath}\n${f.content.slice(0, 2000)}`) ... fetch('https://api.minimaxi.com/anthropic/v1/messages', ... content: prompt)Recommendation
Make external consolidation opt-in, clearly disclose MiniMax data transfer, add redaction controls, and allow local-only AutoDream.
What this means
A cloud API key may be used automatically for memory consolidation, potentially consuming account quota and granting access not obvious from the registry metadata.
Why it was flagged
The code uses a MiniMax bearer token from the environment, but the registry metadata declares no required environment variables or primary credential.
Skill content
const resolvedApiKey = apiKey || process.env.MINIMAX_CODING_API_KEY; ... 'Authorization': `Bearer ${apiKey}`Recommendation
Declare MINIMAX_CODING_API_KEY as a credential, document its scope and cost implications, and require explicit user enablement before use.
What this means
Private and team memory categories may be mixed in search results or reused in future context more broadly than the user expects.
Why it was flagged
The tool accepts a memory type parameter, but the handler does not pass it to the search function, weakening the advertised user/feedback/project/reference separation.
Skill content
handler: async (params: { query: string; topK?: number; type?: string; group?: string }) => { return await memorySearch(params.query, params.topK || 5, params.group, config); }Recommendation
Enforce type and scope filters in code, preserve provenance for memory entries, and avoid auto-loading shared or private memories outside their intended context.
Concern
ASI08: Cascading FailuresWhat this means
An incorrect consolidation could erase or distort memory and affect future sessions that rely on that stored context.
Why it was flagged
The skill describes automatic background consolidation that can delete and update persistent memory, but the artifacts do not show review, backup, or rollback controls.
Skill content
AutoDream 自动整合系统，在空闲时整理记忆。 ... 识别过时信息并删除 ... 更新 MEMORY.md 索引
Recommendation
Add dry-run review, backups/versioning, and explicit confirmation before deleting or rewriting persistent memories.