Security audit

Clawzempic

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real LLM proxy and memory skill, but it asks users to trust a remote service with provider credentials and persistent conversation memory without enough current disclosure or control details.

Install only if you are comfortable routing prompts and provider authentication through Clawzempic and storing conversation-derived memory server-side. Before using it with real keys or sensitive work, look for exact version pinning, clear credential custody terms, retention and deletion controls, memory opt-out controls, and guidance for revoking or rotating provider keys.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Error

Location: SKILL.md:30
Finding: Unpinned Third-Party Packages Can Execute Mutable Registry Code
Content: View full analysis
Remediation: View remediation

other

Error

Location: SKILL-v2.3.0-original.md:46
Finding: Remote Service Receives and Stores Provider Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: competitors/triple-memory-skill/scripts/file-search.sh:5
Finding: Predictable Temporary File Enables Symlink-Based File Clobbering
Content: View full analysis
[limit]" exit 1 fi rm -f "$TMPFILE" # Run search in background (--max-results is the correct flag) clawdbot memory search "$QUERY" --max-results "$LIMIT" > "$TMPFILE" 2>&1 & SEARCH_PID=$! sleep 8 kill $SEARCH_PID 2>/dev/null wait $SEARCH_PID 2>/dev/null # Extract score lines (format: 0.xxx filepath:lines) grep -E "^[0-9]\.[0-9]+" "$TMPFILE" || echo "No results" ``` ### Technical Analysis The script uses the fixed shared path `/tmp/clawdbot-filesearch.txt`. Removing the path before use does not make it safe because there is a race between `rm -f` and the shell's opening of the redirection target. A local attacker can create a symbolic link at that path after the removal operation. Shell redirection follows the link and opens the target with truncation. The target must be writable by the victim, but it can be any such file accessible to the invoking account. The shared filename also allows concurrent script executions to overwrite one another's search output and may expose result data through permissive temporary-file permissions. ### Attack Path 1. An attacker with local access monitors `/tmp/clawdbot-filesearch.txt`. 2. The victim starts `file-search.sh`. 3. Immediately after the script removes the path, the attacker creates a symbolic link with that name pointing to a victim-writable target. 4. The shell processes `> "$TMPFILE"` and follows the symbolic link. 5. The target is truncated and receives command output. 6. Depending on the selected target, the victim may lose data or have configuration content replaced with search output. ### Impact Assessment Exploitation can truncate or corrupt files w ...[truncated 290 chars]
Remediation: View remediation
[limit]" exit 1 fi TMPFILE="$(mktemp "${TMPDIR:-/tmp}/clawdbot-filesearch.XXXXXX")" trap 'rm -f "$TMPFILE"' EXIT INT TERM clawdbot memory search "$QUERY" --max-results "$LIMIT" >"$TMPFILE" 2>&1 & SEARCH_PID=$! sleep 8 kill "$SEARCH_PID" 2>/dev/null || true wait "$SEARCH_PID" 2>/dev/null || true grep -E "^[0-9]\.[0-9]+" "$TMPFILE" || echo "No results" ``` Also validate that `LIMIT` is a positive integer, use the tool's native timeout option if available, and avoid shared temporary output entirely when the output can be processed through a pipeline. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: competitors/elite-longterm-memory/SKILL.md:393
Finding: Troubleshooting Instructions Print the Full OpenAI API Key
Content: View full analysis
Remediation: View remediation

other

Warning

Location: competitors/triple-memory-skill/SKILL.md:24
Finding: Silent Automatic Memory Capture Persists User Data and Searches Broad Workspace Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (64)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A cost-saving skill that actually functions as a memory-search wrapper with file access introduces undisclosed data-handling behavior. In this context, hidden memory search and file interaction are more dangerous because the skill explicitly markets itself as an optimization layer, not as a data access or retrieval component.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: A cost-saving skill that actually functions as a memory-search wrapper with file access introduces undisclosed data-handling behavior. In this context, hidden memory search and file interaction are more dangerous because the skill explicitly markets itself as an optimization layer, not as a data access or retrieval component.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A cost-saving skill that actually functions as a memory-search wrapper with file access introduces undisclosed data-handling behavior. In this context, hidden memory search and file interaction are more dangerous because the skill explicitly markets itself as an optimization layer, not as a data access or retrieval component.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill tells the agent to silently store user decisions without any privacy notice, consent flow, or retention guidance. This is dangerous because decisions often contain sensitive personal, business, or security-relevant context that would be persisted without user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The cloud backup section promotes cross-device sync of memory data but omits any warning that conversation-derived memory may leave the local machine and be stored by a third party. For a long-term memory system, that omission can cause unintentional external disclosure of sensitive context at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill recommends automatic fact extraction from conversations via an external service without warning that message content may be uploaded and processed remotely. Automatic extraction increases the chance that sensitive details, identifiers, credentials, or confidential project facts are captured and retained without deliberate review.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The documented rm -rf ~/.openclaw/memory/lancedb/ command is a destructive filesystem operation that can be copied or automated without safeguards. While it is scoped to an app directory and intended as maintenance, it still risks irreversible data loss and should not be presented casually to an agent or user.
Content: Scanner excerpt · competitors/elite-longterm-memory/SKILL.md (reported line 293)May include surrounding context.
md
memory_recall query="*" limit=50 # Clear all vectors (nuclear option) rm -rf ~/.openclaw/memory/lancedb/ openclaw gateway restart # Export Git-Notes

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The documented rm -rf ~/.openclaw/memory/lancedb/ command is a destructive filesystem operation that can be copied or automated without safeguards. While it is scoped to an app directory and intended as maintenance, it still risks irreversible data loss and should not be presented casually to an agent or user.
Content: Scanner excerpt · competitors/elite-longterm-memory/SKILL.md (reported line 293)May include surrounding context.
md
memory_recall query="*" limit=50 # Clear all vectors (nuclear option) rm -rf ~/.openclaw/memory/lancedb/ openclaw gateway restart # Export Git-Notes

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill focused on reducing LLM costs through smart routing, caching, and memory. This file instead provides CLI commands to create and inspect local markdown memory files and directories, with no evidence of model routing, caching, or cost-optimization behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The architecture describes automatic capture, structured storage, and file updates as part of normal response handling without any user warning about persistence. This is dangerous because it normalizes undisclosed cross-session retention in multiple backends, expanding both privacy exposure and the attack surface for later retrieval or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The pre-compaction memory flush automatically writes session summaries and key facts to persistent files and git-notes when token thresholds are reached, without user awareness at the time of retention. This can preserve sensitive context that the user did not intend to survive the session, especially because compaction is an internal system event rather than an explicit user action.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directly tells agents to hide memory operations from users while persisting data, which is a strong anti-transparency pattern. Concealed storage prevents informed consent and makes it difficult for users to detect, contest, or correct retained information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly states that provider keys are stored server-side and that cross-session memory is automatically injected, but it does not prominently warn users that prompts, memory contents, and related metadata are sent to and retained by a third-party service. In this context, the omission is security-relevant because the product positions itself as a transparent drop-in proxy while handling highly sensitive credential and conversational data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run npx clawzempic without pinning an exact package version. This allows the executed code to change over time if the publisher account, package, or latest tag is compromised, creating a supply-chain execution risk at install/run time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The audit feature says every security event is logged, but the skill does not explain whether logs may include prompt fragments, tool outputs, identifiers, or other sensitive metadata. Since the product inspects tool output for credentials and injection attempts, audit records themselves may become a concentration point for sensitive information if users are not warned and logging is not minimized.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The verification command uses npx clawzempic without a pinned version, so users may execute whatever code is currently published under the package name rather than the reviewed release. In a security-sensitive proxy that handles provider keys and prompt traffic, this materially increases supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The status command references an unpinned npx package, which can fetch and run newer or malicious code unexpectedly. Because this tool advertises server-side key storage and prompt handling, compromise could expose credentials, prompts, or memory data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The savings dashboard command also executes an unpinned npm package via npx, introducing the same mutable-package supply-chain risk. An attacker controlling the package or publish pipeline could run arbitrary code on user systems under the guise of a routine dashboard command.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill declares no explicit tool scope or permissions, yet the associated capabilities indicate access to environment data and file reading. This weakens the trust boundary for users and reviewers because the documented interface does not accurately disclose what the skill may access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx clawzempic without a pinned version causes execution of whatever package version is current at install or run time. This creates a supply-chain risk where a compromised or malicious package update could execute arbitrary code in the user's environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises server-side cross-session memory, including permanent facts and long-term recall, but does not provide a clear warning about retention, storage, and privacy implications. This can lead users to submit sensitive information without informed consent, creating confidentiality and compliance risks.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The command npx clawzempic is unpinned, so users may execute an unexpected future package release. In package-ecosystem attacks, this can become a remote code execution vector through poisoned updates or account compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The npx clawzempic invocation is not version-pinned, exposing users to supply-chain drift and arbitrary behavior changes over time. Because this is presented as a verification command, users may run it with elevated trust, increasing the danger of a compromised release.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes 'Cloud Backup' and 'Mem0 Auto-Extraction' but does not warn that conversation content, facts, or memory artifacts may be transmitted to third-party services. For an AI memory system, that omission is security-relevant because users may unknowingly route sensitive prompts, secrets, or personal data off-device.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx elite-longterm-memory init without pinning a package version. npx will fetch the latest published package at execution time, so a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.