ClawHub
Back to skill

Security audit

Memory Vault

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent cloud memory tool, but it asks agents to store and reuse persistent remote memory without enough user controls or data-handling detail.

Install only if you trust ndpsoftware with agent memory and are comfortable with notes, logs, preferences, project context, and task state being sent to and retained by a remote service. Use a service-specific token, avoid secrets and regulated personal data, and confirm there is a way to review and delete stored memory before relying on it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The keyword list is unusually broad for a skill that writes and retrieves persistent remote memory, increasing the chance the agent invokes it in contexts where the user did not intend cloud-backed storage. Because this skill handles long-term state and notes, accidental invocation can lead to unnecessary transmission or retention of sensitive context.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill describes persistent storage to a remote cloud endpoint but does not clearly warn that agent notes, execution state, preferences, and recalled context may be transmitted off-system and retained across sessions. For a memory vault, this omission is especially dangerous because agents may upload sensitive prompts, credentials, personal data, or internal project context without informed user consent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.