Engram — Knowledge Graphs for AI Agents

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 0.1.12

Overview

This skill is a coherent knowledge-graph tool, but it encourages broad persistent storage of sensitive workspace, organizational, infrastructure, and people metadata without clear safeguards.

Install only if you intentionally want a durable local knowledge graph. Keep it limited to non-sensitive code architecture by default, avoid storing secrets, credential paths, SSH config details, email contents, personal trust rankings, or private organizational data, and consider pinning/auditing the npm package and restricting database access before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-21
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npm install -g @clawdactual/engram

This installs the engram CLI globally. Verify with:

bash

engram --help

text

### Technical Analysis

The installation instructions retrieve and globally install the current version of `@clawdactual/engram` without pinning an audited version or verifying package integrity or provenance. npm packages may execute lifecycle scripts during installation, and the subsequently invoked CLI executes package-controlled code with the permissions of the user running it.

The `-g` option also places the package in the user's or system's global npm environment rather than isolating it to this project. The documentation does not require inspection of lifecycle scripts, signature or checksum verification, use of a lockfile, or installation with scripts disabled.

This finding does not establish that the referenced package is currently malicious. The vulnerability is the unsafe and mutable supply-chain trust model: the effective code installed in the future can differ from the code reviewed today.

### Attack Path

1. An attacker compromises the package publisher account, npm release process, or another component of the package's dependency chain.
2. The attacker publishes a malicious release under the existing package name.
3. A user follows the documented `npm install -g @clawdactual/engram` instruction.
4. npm resolves the mutable current release because no exact version or integrity value is specified.
5. Malicious lifecycle scripts may execute during installation, or malicious code executes when the user runs `engram --help` or another command.
6. The payload operates with the installing user's privileges and can access resources available to that account.

###
...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact, reviewed version rather than installing the mutable latest release:

   bash

   npm install --save-exact @clawdactual/engram@<audited-version>
   

2. Prefer a project-local dependency over a global installation and invoke it through a locked project environment.
3. Commit and enforce a lockfile containing npm integrity hashes.
4. Verify package provenance, publisher identity, release signatures where available, and the integrity of the package tarball.
5. Audit direct and transitive dependencies as well as npm lifecycle scripts before approving a release.
6. In controlled deployments, install with lifecycle scripts disabled unless they have been explicitly reviewed:

   bash

   npm install --ignore-scripts
   

7. Execute the CLI in a least-privileged account or sandbox with access restricted to the repositories and files required for the task.
8. Document an approved version-upgrade and security-review process instead of allowing automatic adoption of new releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:198

Finding

Centralized Persistence of Sensitive Organizational and Operational Metadata Without Documented Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 198-204; persistent database location documented at line 32
Vulnerability Type: Excessive collection and insufficiently protected persistence of sensitive metadata
Risk Level: Medium

Vulnerable Code

markdown

**Database:** `~/.config/engram/models.db` (override: `ENGRAM_DB_PATH=/path/to/db`)

markdown

### First Install: Seed Your Environment

On first use, scan your workspace and create models for:
- **Code** — repos you work on. Modules, services, dependencies.
- **Org** — company structure. People, teams, repos, service relationships, trust levels.
- **Infrastructure** — local tools. Email chains, SSH configs, credential paths, channel setups.
- **People** — who you interact with. Roles, channels, trust levels (owner/boss/coworker/friend).

Technical Analysis

The Skill recommends aggregating sensitive operational and interpersonal information in a persistent SQLite database. The suggested data includes organizational relationships, trust levels, email-chain information, SSH configuration information, communication channels, and credential locations.

Even where passwords or private keys are not stored directly, credential paths and SSH configuration metadata can identify high-value files, hosts, accounts, and access routes. Trust relationships and organizational details can support targeted social engineering, while service and repository relationships can expose internal architecture.

Centralizing these categories in ~/.config/engram/models.db creates a high-value reconnaissance asset. The Skill does not document data minimization, encryption at rest, restrictive file permissions, consent requirements, secret filtering, retention periods, secure deletion, or controls for exported models. The finding is therefore based on the sensitive collection instructions and absence of documented safeguards; it does not assert undocumented ...[truncated 1640 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove email-chain content, credential paths, SSH configuration details, personal trust levels, and similar sensitive information from the default seeding guidance.
2. Adopt data minimization: store only architectural relationships necessary for the current task.
3. Add an explicit prohibition against storing passwords, API tokens, private keys, session material, recovery codes, or secret values in node labels or metadata.
4. Store only generalized references when a credential-related dependency is essential, such as requires deployment credential, rather than a precise filesystem path or account identifier.
5. Require restrictive database permissions and validate them when the database is created. On Unix-like systems, the database and its containing directory should be accessible only to the owning user.
6. Support and document encryption at rest with keys managed separately from the database.
7. Establish retention limits, selective deletion, secure deletion where feasible, and periodic review of stale personal or infrastructure data.
8. Require informed authorization before recording information about personnel, communication channels, or organizational trust relationships.
9. Apply equivalent controls to exports, backups, temporary files, and batch-import files because these can contain the same sensitive graph data.
10. Add automated secret detection and warnings before accepting metadata that resembles private keys, tokens, passwords, or credential files.
11. Document a threat model explaining which local users and processes can access the database and recommend an isolated, least-privileged storage location.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly recommends modeling infrastructure details, email chains, SSH configs, credential paths, channels, and trust levels in a persistent local knowledge graph, but provides no sensitivity classification, minimization, or storage protections. This materially increases the risk of long-term retention of secrets and personal data that could later be exposed through agent queries, exports, local compromise, or accidental sharing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is unusually broad for an auto-invoked skill, including generic phrases such as 'build a model of', 'map the architecture', 'what depends on', and 'blast radius'. That can cause the skill to activate in many ordinary coding conversations and then encourage persistent graph writes, expanding the chance of unintended data capture or side effects.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The session-awareness guidance tells users to modify bootstrap instructions so future sessions remember the graph and continue maintaining it. That promotes cross-session persistence of user and workspace context, which can bypass expectations of ephemeral assistance and amplify any accidental collection of sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The command reference includes destructive operations such as model deletion and overlay discard without prominent warnings, confirmation guidance, or backup recommendations. In an agent setting, terse documentation of destructive commands increases the risk that an automated workflow or user copies a command that irreversibly removes stored knowledge.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These instructions encourage persistent collection of sensitive personal and operational context across sessions, including people relationships, trust levels, infrastructure, and credential-related artifacts. In a long-term memory system, this creates a durable surveillance and secret-retention surface that is more dangerous than transient conversation context because it persists, can be cross-linked, and can be exported.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

3. Add discoveries incrementally — During coding, when you discover non-obvious relationships (e.g., "this function silently depends on NODE_ENV being set"), add them immediately:

   bash

   engram upsert myapp isPubSubDisabled --type function -m "note=returns false in production regardless of DISABLE_AUTH"
   engram link myapp fleet-rest calls isPubSubDisabled
   

Static analysis

No suspicious patterns detected.