ClawHub
Back to skill

Security audit

Simplemem

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent SimpleMem memory skill, but users should understand that memories persist on disk and may be processed by OpenAI-backed services when an API key is used.

Install only if you are comfortable with a persistent memory tool. Do not store secrets, credentials, regulated personal data, or confidential business content as memories. If you enable OPENAI_API_KEY, assume memory and query text may leave the local machine for SimpleMem/OpenAI-backed processing. Prefer a pinned dependency version or reviewed commit, and review or delete artifact/data/memories.json when you want to clear local memory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Code Execution

Content
View full analysis
Remediation
View remediation
" ``` 2. If installation from Git is required, pin a full verified commit hash rather than cloning a mutable default branch. 3. Publish a lockfile that pins all transitive dependencies. 4. Require package hashes, such as through a hash-locked requirements file and `pip install --require-hashes`. 5. Review package build configuration and dependencies before approving upgrades. 6. Install the dependency in an isolated virtual environment or container with least privilege. 7. Restrict access to credentials and sensitive local files during installation and first execution. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
simplemem.py:48
Finding

Persistent Memories Are Stored in Plaintext with Weak Caller Isolation

Content
View full analysis
0: ...[truncated 2227 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · simplemem.py (reported line 120)May include surrounding context.

python
if __name__ == "__main__":
    import sys
    
    # Get API key from args or env
    api_key = os.getenv("OPENAI_API_KEY", "")
    wrapper = SimpleMemWrapper(api_key=api_key)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises capabilities that imply environment-variable access and local file read/write, but it does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and makes it easier for an agent or operator to invoke the skill without understanding that it can persist data and access sensitive configuration such as API-key-backed behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly provides cross-session persistent memory, but the description does not warn users that interaction data may be stored beyond the current conversation. This creates a privacy and consent risk because users or agent operators may supply sensitive data without realizing it will be retained and reused later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The configuration section says that providing an OpenAI API key enables full features, but it does not clearly warn that user content or stored memories may be transmitted to OpenAI for embeddings or related processing. This is dangerous because operators may assume processing remains local when enabling the key, leading to unintentional third-party data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

If an API key is present, the wrapper sends supplied content to an external SimpleMem/OpenAI-backed system during initialization and later operations without any user-facing disclosure or consent mechanism. This can leak sensitive prompts, memories, or identifiers to a third-party processor, especially in agent contexts where inputs may contain confidential data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

When the primary backend is unavailable, the wrapper silently falls back to storing memory contents and metadata in a local JSON file. This persists potentially sensitive user data to disk without any consent flow, warning, retention policy, or access control, which can expose private data to other local users, backups, or later compromise of the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The PowerShell usage comments and example content are written in Spanish while the rest of the skill description is in English, and the document does not indicate that the skill is intentionally locale-specific or that users may choose their preferred language. This creates a natural-language locale inconsistency that can violate language policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

Several docstrings and comments such as 'Wrapper para usar SimpleMem desde OpenClaw' and 'Funciones CLI simples' are written in Spanish, which can impose a language expectation on users or maintainers without opt-in. No justification or alternative language choice is provided in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.