Security audit

Unified Memory Architect

Security checks for vulnerabilities and agentic risk

Overview

The skill is advertised as memory search, but it also ships broad agent-control, persistent-memory, background-check, and unsafe integration instructions that need human review before installation.

Treat this as a Review item, not a normal install. Only use it in an isolated workspace after removing or disabling the AGENTS/BOOTSTRAP/SOUL/USER/HEARTBEAT behavior, verifying the real source and scripts, backing up memory data, and adding authentication plus localhost binding before running the API example.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: AGENTS.md:3
Finding: Agent Identity and Session-Goal Hijacking Through Workspace Instructions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: AGENTS.md:20
Finding: Persistent Memory Poisoning and Unauthorized Private-Context Mutation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: AGENTS.md:128
Finding: Autonomous Heartbeat, External-Service, and Repository Actions Beyond Declared Functionality
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: BOOTSTRAP.md:21
Finding: Persistent Profile Creation Followed by Bootstrap Self-Deletion
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: docs/INSTALL.md:14
Finding: Unverified Remote Package Retrieval and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples/integration.js:8
Finding: Unauthenticated Network API Exposes Memory Query Results
Content: View full analysis
{ // CORS 头 res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Content-Type', 'application/json'); if (req.url === '/api/stats' && req.method === 'GET') { const stats = getStats(); res.end(JSON.stringify({ success: true, data: stats })); return; } if (req.url.startsWith('/api/query/tag/') && req.method === 'GET') { const tag = req.url.split('/').pop(); const limit = parseInt(new URL(req.url, 'http://localhost').searchParams.get('limit') || '10'); const results = queryByTag(tag, limit); res.end(JSON.stringify({ success: true, data: results })); return; } if (req.url.startsWith('/api/query/date/') && req.method === 'GET') { const date = req.url.split('/').pop(); const limit = parseInt(new URL(req.url, 'http://localhost').searchParams.get('limit') || '10'); const results = queryByDate(date, limit); res.end(JSON.stringify({ success: true, data: results })); return; } if (req.url.startsWith('/api/search') && req.method === 'GET') { const keyword = new URL(req.url, 'http://localhost').searchParams.get('q') || ''; const limit = parseInt(new URL(req.url, 'http://localhost').searchParams.get('limit') || '10'); const results = searchMemories(keyword, limit); res.end(JSON.stringify({ success: true, data: results })); return; } res.statusCode = 404; res.end(JSON.stringify({ success: false, error: 'Not Found' })); }); const PORT = 3000; server.listen(PORT, () => { console.log(`API Server running at http://loca ...[truncated 1821 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: docs/INSTALL.md:102
Finding: Unsafe Recursive Deletion of Potentially Shared or Persistent Memory Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (51)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · TOOLS.md (reported line 36)May include surrounding context.
md
## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · clawhub/assets/architecture-diagram.svg (reported line 20)May include surrounding context.
text
<stop offset="100%" stop-color="#059669"/> </linearGradient> </defs>  <rect width="1024" height="576" fill="url(#bg)"/>  <text x="512" y="35" text-anchor="middle" font-family="Arial" font-size="20" font-weight="bold" fill="#ffffff">Unified Memory Architect — System Architecture</text>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · clawhub/assets/architecture-diagram.svg (reported line 37)May include surrounding context.
text
<rect x="465" y="88" width="120" height="28" rx="4" fill="#ffffff10"/> <text x="525" y="106" text-anchor="middle">📥 import/batch.json</text> </g>  <path d="M512 125 L512 145" stroke="#00d4ff" stroke-width="2" marker-end="url(#arrowCyan)"/> <defs><marker id="arrowCyan" markerWidth="10" markerHeight="7" refX="9" refY="3.5" orient="auto"><polygon points="0 0,10 3.5,0 7" fill="#00d4ff"/></marker></defs>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · clawhub/assets/screenshot-query.svg (reported line 8)May include surrounding context.
text
<stop offset="100%" stop-color="#0d0d1a"/> </linearGradient> </defs>  <rect width="900" height="520" rx="12" fill="#111122"/>  <rect width="900" height="36" rx="12" fill="#1e1e2e"/>

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: rm -rf unified-memory-architect/ is a forceful recursive deletion command that can cause irreversible loss if executed from the wrong directory or if users blindly copy the command without verifying the target. In documentation, such commands are particularly risky because they normalize destructive actions without safeguards.
Content: Scanner excerpt · docs/INSTALL.md (reported line 105)May include surrounding context.
bash
# 删除安装目录 rm -rf unified-memory-architect/ # 清理数据（可选） rm -rf memory/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: rm -rf memory/ is especially dangerous because memory is a generic directory name and the command is presented as optional cleanup of data, increasing the chance that users delete unrelated or valuable content from an unintended location. The skill context makes this more dangerous because the project appears to manage stored memory/data, so the command likely destroys potentially important user data.
Content: Scanner excerpt · docs/INSTALL.md (reported line 108)May include surrounding context.
rm -rf unified-memory-architect/

清理数据（可选）

rm -rf memory/

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/TROUBLESHOOTING.md (reported line 59)May include surrounding context.
解决方案:

bash
# 1. 删除旧索引 rm memory/processed/index*.json # 2. 重建索引 node memory/scripts/enhance-tags.cjs

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction to delete BOOTSTRAP.md after reading creates an unnecessary destructive action with no confirmation, audit trail, or user approval. In an agent workspace, this can remove provenance or setup context that may be needed for recovery, review, or incident investigation, and it normalizes autonomous file deletion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to persist user-related information into memory/ files and MEMORY.md without a clear consent flow or retention disclosure. This creates privacy and data-governance risk because sensitive personal details may be stored long-term and later surfaced in unrelated contexts.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · AGENTS.md (reported line 51)May include surrounding context.
md
## Red Lines - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The heartbeat section promotes ongoing checks of email, calendar, social notifications, and writes to memory/heartbeat-state.json without an explicit informed-consent mechanism. This effectively establishes continuous monitoring and activity logging, which can expose sensitive behavioral data and broaden the agent's access footprint over time.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The skill explicitly authorizes proactive actions 'without asking,' including reading/organizing memory files, checking project state, updating documentation, and committing/pushing changes. In an agent with broad workspace or integration access, this can lead to unauthorized modifications, disclosure of sensitive context, or outbound changes to remote repositories without contemporaneous user approval.
Content: Scanner excerpt · AGENTS.md (reported line 186)May include surrounding context.
md
- Nothing new since last check - You just checked <30 minutes ago **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to collect and persist personal profile data in IDENTITY.md, USER.md, and SOUL.md without any notice, consent flow, data minimization guidance, or retention limits. This creates privacy risk because users may disclose names, timezone, preferences, and sensitive behavioral boundaries that are then stored locally without understanding that persistence is occurring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill encourages linking external messaging channels such as WhatsApp and Telegram without warning about account-linking, metadata exposure, impersonation risk, or third-party privacy implications. Even if optional, guiding a user through connecting personal accounts can expand the attack surface and cause the user to expose contact details or create persistent out-of-band access without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README advertises data-modifying scripts such as migration, import, integration, and cleanup operations but does not warn users that these commands can alter, archive, or remove memory data. In an agent-skill context, documentation is often treated as operational guidance, so omission of safety notes increases the chance of accidental destructive execution against user data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill heading and overview text are written in Chinese, and the document does not indicate that language selection is optional or limited to a region-specific use case. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The document advertises capabilities over a memory corpus and CLI queries, but it does not disclose any privacy or data-sensitivity implications despite describing operations over personal or system-derived memories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is explicitly designed to store, index, and query large amounts of memory content, including raw and processed data, but the documentation provides no warning that these memories may contain sensitive personal, confidential, or regulated information. This can lead users to ingest or expose sensitive content through search, indexing, logs, archives, or API responses without applying appropriate handling controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The Memory.content.language field is restricted to 'zh' | 'en', which expresses a natural-language locale constraint in the documentation. Because the file does not explain that this is optional, user-selectable, or justified as a region-specific limitation, it appears to force a language policy without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document title and all instructional content are written in Chinese, presenting the coding policy in a single enforced language. Under the policy, forcing a specific language without opt-in or justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file uses Chinese throughout and does not indicate that contributors may use another language or that the repository is intentionally Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file uses Chinese throughout, including headings, questions, and operational instructions, but does not indicate that the skill is intended only for Chinese-speaking users or provide any language/locale option. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/INSTALL.md (reported line 56)May include surrounding context.
bash
# 设置权限 chmod 755 memory/processed chmod 755 memory/archive chmod 755 memory/import

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/INSTALL.md (reported line 57)May include surrounding context.
bash
# 设置权限 chmod 755 memory/processed chmod 755 memory/archive chmod 755 memory/import

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/INSTALL.md (reported line 58)May include surrounding context.
bash
# 设置权限 chmod 755 memory/processed chmod 755 memory/archive chmod 755 memory/import

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T02 · Agent Memory Poisoning

T01 · Skill Instruction Hijacking

T02 · Agent Memory Poisoning

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Self-Modification

Hidden Instructions

Hidden Instructions

Hidden Instructions

Tool Parameter Abuse

Tool Parameter Abuse

清理数据（可选）

Tool Parameter Abuse

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Static analysis