ClawHub
Back to skill

Security audit

Agent Essentials

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent, but it can write conversation-derived lessons into persistent agent memory without clear per-write user approval.

Install only if you want an agent to keep lightweight self-improvement notes. Review or disable the daily-memory behavior if you do not want conversation-derived lessons saved under ~/.claude/memory, and treat any future memory-loaded guidance as editable user data rather than trusted policy.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:61
Finding

Persistent Daily Memory Writes Without Explicit User Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-89
Vulnerability Type: Persistent agent memory poisoning through unconfirmed writes
Risk Level: Medium

Vulnerable Code Snippet:

markdown
| Session note | Daily memory / learnings file | — |
| Workflow rule | `AGENTS.md` | ✓ |
| Tool gotcha | `TOOLS.md` | ✓ |
| Voice / boundary pattern | `SOUL.md` | ✓ |
| User preference | `USER.md` or long-term memory | ✓ |
| Missing capability | Skill discovery (see above) | ✓ |

   - For any ✓ row: show the diff and ask "append to <file>? [y/N]" before writing. Never silently mutate durable files.

3. **Promote** to durable file only if **all** hold:
     - **Recurring** — ≥2 occurrences (user saying "Nth time" / "又错了" is proof)
     - **High-value** — non-trivial consequence (broken CI, lost work, wrong user output), not style nits
     - **Broadly reusable** — class of situations, not one specific file/PR
     - **Rule-preventable** — a future-you reading the rule would avoid it
   - If any fails, keep in daily memory only.

## File Locations

Resolve durable files in this order — first hit wins:

| File | Lookup order |
|---|---|
| `AGENTS.md` | `./AGENTS.md` → `~/.claude/AGENTS.md` |
| `TOOLS.md` | `./TOOLS.md` → `~/.claude/TOOLS.md` |
| `SOUL.md` | `./SOUL.md` → `~/.claude/SOUL.md` |
| `USER.md` | `~/.claude/USER.md` (always user-scoped) |
| Daily memory | `~/.claude/memory/YYYY-MM-DD.md` (auto-create if missing) |

If none exists and a write is approved, create at the project-root path (or `~/.claude/` for `USER.md`) and tell the user "creating new file `<path>`."

Technical Analysis

The skill treats user corrections, failures, and workflow observations as material that can be converted into persistent lessons. Although writes to files such as AGENTS.md, TOOLS.md, SOUL.md, and USER.md require a displayed diff and explicit confirmation, the session-not ...[truncated 1835 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation before every persistent write, including daily-memory and session-note files.
  2. Display the exact destination path and a complete proposed diff before requesting approval.
  3. Default confirmation prompts to denial and perform no write when the response is absent or ambiguous.
  4. Treat all conversation-derived lesson content as untrusted data. Remove imperative instructions, executable commands, URLs, secrets, credentials, and unrelated personal information before persistence.
  5. Record provenance with each approved entry, including the source session, creation time, and whether the content originated from the user, a tool, or the agent's inference.
  6. Separate short-lived session notes from memory loaded automatically in future sessions. Prefer an ephemeral store unless the user explicitly requests persistence.
  7. Add review, expiration, and deletion mechanisms so users can inspect and remove stored lessons.
  8. Revise the routing table so the daily-memory row also requires confirmation, and replace “keep in daily memory only” with “offer to save in daily memory after presenting a sanitized diff.”

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
## Capability Expansion

**Rule**: never stop at "I can't" or "no built-in way" without checking for a better capability path.

**Triggers** — request implies external platform / workflow automation / system integration / repeatable ops / capability gap. Common phrasing: *"automate X" / "integrate with X" / "support X platform" / "help me do this in X"*.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list includes "help me do this in X," which is a generic conversational pattern and may match many ordinary user requests rather than a narrowly defined capability-expansion scenario. Although the section gives some surrounding context, this specific example is broad enough to risk unintended invocation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
3. **Act** — pause for user confirmation before any of these:
   - **Installing a skill** → show name, source, one-line value, and ask "install? [y/N]" before downloading.
   - **Creating a new custom skill** → show the proposed name + 3-line description and ask before scaffolding.
   - **Doing the task directly** → only this branch may proceed without confirmation, and only if no fallback above is viable.

## Self-Improvement

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill explicitly supports creating and appending to durable files such as AGENTS.md, TOOLS.md, SOUL.md, USER.md, and daily memory. Even with confirmation for many writes, this creates persistent state that can influence future agent behavior, and daily memory auto-creation/session persistence increases the chance of durable prompt injection, policy drift, or storage of unsafe instructions if prior captured content is adversarial or poorly vetted.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
| `USER.md` | `~/.claude/USER.md` (always user-scoped) |
| Daily memory | `~/.claude/memory/YYYY-MM-DD.md` (auto-create if missing) |

If none exists and a write is approved, create at the project-root path (or `~/.claude/` for `USER.md`) and tell the user "creating new file `<path>`."

## Decision Tree

Scope Creep

Low
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
This skill has two jobs:

1. **Expand capabilities** — discover better capability paths before declaring failure.
2. **Self-improve** — capture important lessons and route them to the right durable layer.

## Capability Expansion

Static analysis

No suspicious patterns detected.