Security audit

ClawdTalk Persona Plugin

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent caller-memory plugin, but it automatically stores and reuses sensitive call and persona data with weak limits, so users should review it before installing.

Install only if you intend to maintain a persistent caller-memory database and have caller notice/consent, retention/deletion rules, and a trusted Persona API endpoint. Prefer HTTPS for any non-local server, restrict who can configure the endpoint, and avoid sending call IDs or storing sensitive transcript-derived details unless explicitly needed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:7
Finding: Persistent Caller-Controlled Content Can Poison Future Agent Context
Content: View full analysis
> = {}; if (raw.soul) documents.soul = raw.soul as Record; if (raw.identity) documents.identity = raw.identity as Record; if (raw.memory) documents.memory = raw.memory as Record; if (Object.keys(documents).length === 0) { return formatResult({ updated: [], message: 'No documents provided — nothing to update.', }); } try { const result = await this.client.updatePersonaDocs(phone, documents); return formatResult({ document_versions: result.document_versions, updated: result.updated, message: `Persona updated for ${phone}: ${result.updated.map(t => `${t} v${result.document_versions[t]}`).join(', ')}.`, }); } ...[truncated 2581 chars]
Remediation: View remediation

other

Warning

Location: src/lib/persona-client.ts:138
Finding: Recent Call Results May Expose Full Transcripts and Arbitrary Metadata
Content: View full analysis
Remediation: View remediation
({ id: call.id, direction: call.direction, duration_seconds: call.duration_seconds, purpose: call.purpose, summary: call.summary, created_at: call.created_at, })); ``` 2. Exclude `transcript`, `metadata`, `conversation_id`, and internal caller identifiers from the routine lookup response. 3. Provide transcript access through a separate tool requiring explicit user intent, authorization, and auditing. 4. Redact phone numbers and sensitive personal information unless needed for the immediate task. 5. Enforce response schemas at runtime rather than relying only on TypeScript interfaces. 6. Apply response-size limits to prevent unexpectedly large transcripts from entering model context. 7. Update the backend to omit sensitive fields by default and require an explicit field-selection parameter. 8. Document retention, transcript-access, and disclosure behavior accurately. 9. Add tests confirming that transcript and metadata fields are absent from `persona_get_caller` output. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: src/lib/persona-client.ts:26
Finding: Bearer Credentials and Caller Data May Be Transmitted to Insecure or Arbitrary Endpoints
Content: View full analysis
(method: string, path: string, body?: unknown): Promise { const url = `${this.baseUrl}${path}`; const signal = AbortSignal.timeout(15_000); let response: Response; try { response = await fetch(url, { method, headers: this.headers, body: body !== undefined ? JSON.stringify(body) : undefined, signal, }); } catch (err) { const msg = err instanceof Error ? err.message : String(err); throw new PersonaApiError(0, `Persona API unreachable: ${msg}`); } ``` ### Technical Analysis The server setting accepts arbitrary strings and is used directly as the base URL. No check enforces HTTPS for non-loopback destinations, restricts permitted hosts, rejects embedded URL credentials, or confirms that plaintext HTTP is only used with a verified loopback address. Every request carries the Persona API key in the `Authorization` header. Write requests can additionally contain phone numbers, c ...[truncated 2381 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs persistent storage of caller identity, memories, and transcript-derived context across calls without any requirement to notify the caller, obtain consent, or limit collection. In a voice-calling context, this creates a significant privacy and compliance risk because users may disclose sensitive personal data without understanding it will be retained indefinitely.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill’s core purpose is to persist caller-specific identity, personality, and memory data across calls by default, creating long-term profiling of individuals. In this context, systematic accumulation of cross-call personal history materially increases the risk of privacy harm, misuse, and unauthorized access to sensitive relationship or behavioral data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates logging every call and immediately updating persona records with specific topics, decisions, emotions, follow-ups, and potentially auto-fetched transcripts, yet provides no safeguards against storing sensitive information. This encourages broad, systematic capture of personal data that could include health, family, financial, or other confidential details.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions direct the agent to record detailed summaries including emotions and decisions, and to supply a call ID that triggers backend transcript retrieval, resulting in expansive retention of conversational content. This is dangerous because it normalizes collection of highly revealing interaction data without necessity checks or user-facing safeguards.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The persona update guidance explicitly tells the agent to persist factual identity information, relationships, preferences, and episodic memories from each call. Because these fields accumulate over time and old versions are never lost, the system creates a durable dossier on callers that can be highly invasive if exposed or repurposed.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The required call flow and notes enforce updating memory after every call, making long-term retention of caller information automatic rather than exceptional. In a conversational agent context, this significantly raises danger because repeated interactions can gradually reveal intimate personal patterns that users may never expect to be permanently stored.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This operation sends potentially sensitive conversational data, including summaries, purpose, duration, direction, and optionally transcript-related identifiers, to an external backend. The code description explains functionality but does not provide a clear warning about privacy impact or user data transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The update operation transmits structured personal data such as identity facts, memories, and personality observations to the Persona backend. Although the description states what the tool does, it does not clearly warn users that sensitive personal profile data will be stored remotely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs persistent storage of caller identity, preferences, memories, and potentially full transcripts, but provides no user-facing warning, consent step, retention limits, or guidance on handling sensitive data. In a telephony context, this creates a privacy and compliance risk because highly personal information may be collected and reused across calls without the caller's knowledge.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates recording personal details and call-derived memories for every caller as a default behavior, regardless of necessity or sensitivity. This broad, compulsory collection increases privacy exposure and can accumulate sensitive behavioral profiles that may be misused, over-retained, or accessed inappropriately.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The tool encourages retrieval and reuse of comprehensive caller context, including identity, memory, and recent call summaries, to shape future conversations. Even if intended for personalization, this increases the risk of unnecessary disclosure, profiling, and inappropriate use of historic sensitive information in later calls, especially if context is injected wholesale into prompts.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to always extract observations from each conversation and store dated episodic memory entries, creating a persistent longitudinal record by default. This is dangerous because it normalizes indiscriminate post-call surveillance and increases the chance that sensitive or intimate details are retained beyond what is operationally necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This TypeScript code performs multiple network requests carrying potentially sensitive data, including phone numbers, caller notes, call summaries, and persona documents. While the file has a brief technical comment, it provides no confirmation prompt, user-facing log, or warning comment/docstring disclosing that such data is sent to an external Persona API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The tool logs and sends a caller's phone number to the Persona backend during lookup, which is a privacy-relevant network operation on personal data. While there is an internal logger message, there is no visible user-facing warning, confirmation, or comment/docstring disclosing this data transmission to the user.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.