Security audit

Kannaka Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is mostly purpose-aligned, but its installer creates a persistent extension with a command-injection flaw and builds unpinned remote code, so it needs careful review before installation.

Install only after reviewing or fixing the generated extension to avoid shell execution from tool inputs, and prefer a pinned, verified upstream source or signed release. Treat the swarm feature as sending presence or phase state to the configured NATS server, and avoid enabling destructive memory deletion without backup or confirmation expectations.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install.sh:42
Finding: Arbitrary Command Execution Through Shell Command Injection
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.sh:22
Finding: Mutable Remote Source Is Retrieved, Built, and Installed Without Integrity Verification
Content: View full analysis
Remediation: View remediation
&2 exit 1 } ``` 3. Prefer a signed release artifact with a published SHA-256 or stronger checksum. Verify the signature and checksum before executing or installing it. 4. If source builds are required: - Commit and enforce `Cargo.lock`. - Build with `cargo build --locked`. - Review transitive dependencies and project build scripts. - Consider vendoring dependencies and verifying the vendor directory. - Use a controlled, isolated build environment without unnecessary secrets. 5. Associate each Skill release with a specific upstream revision and update that revision only after a new security review. 6. Perform installation with least privilege and avoid exposing sensitive environment variables to the build process. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The generated TypeScript extension constructs shell command strings with untrusted tool inputs and passes them to execSync, enabling command injection through multiple parameters that are not safely quoted or validated, such as category, memory_id, relation_type, display_name, and numeric fields. Because the extension exposes file operations, memory deletion, and arbitrary CLI invocation paths in an agent tool context, a malicious prompt or crafted input could execute arbitrary commands as the user, making this substantially more dangerous than a normal local utility.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill clearly instructs users to run shell installation scripts and use environment-driven network endpoints, yet it declares no explicit tool scope or permissions boundary. This weakens least-privilege controls and can cause an agent platform or user to underestimate the skill's ability to execute shell actions and interact with external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises swarm synchronization through a default external NATS server (nats://swarm.ninja-portal.com:4222) and states that phase gossip and presence are published remotely, but it does not prominently warn that agent metadata and potentially derived memory/state information may leave the local environment. In a memory skill, this context increases sensitivity because users may assume persistence is local while swarm features introduce external transmission by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This shell script performs network access and persistent file writes by cloning a remote repository, building it, and copying artifacts into ~/.local/bin and ~/.openclaw. Although it prints progress messages, those messages do not clearly disclose the safety impact or ask for confirmation before modifying the user's environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documented kannaka_forget capability enables deletion of stored memory, but the skill documentation does not explicitly warn that the action may be permanent or describe whether recovery/versioning exists. In a persistent memory system, unclear destructive semantics can lead to accidental data loss by users or agents invoking the tool without confirmation safeguards.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install.sh:47