ClawHub
Back to skill

Security audit

Andrew Memory Layer

Security checks for vulnerabilities and agentic risk

Overview

This memory skill does what it says, but it sends sensitive memory and conversation content to external or configurable endpoints by default and allows durable identity changes without a clear approval boundary.

Install only if you are comfortable with an agent storing long-term memories and potentially sending memory text, search queries, and conversation transcripts to MiniMax or to any configured local LLM endpoint. Prefer local mode for sensitive use, restrict localLlmUrl to a trusted loopback Ollama service, avoid storing secrets or regulated data, and require human review before using the identity-setting or vector-regeneration tools.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
src/MemoryClient.js:30
Finding

Raw memories, search queries, and conversations are transmitted to MiniMax by default

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/MemoryClient.js:57
Finding

Unrestricted localLlmUrl can redirect sensitive memory traffic to an attacker-controlled server

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
index.js:120
Finding

Core Identity can be persistently overwritten without authorization or provenance controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documents capabilities that can access environment variables and communicate over the network, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this increases the risk of over-broad access, accidental secret exposure, or unintended external communication because users and orchestrators cannot clearly constrain what the skill may do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill is designed to store long-term semantic memories about users, including preferences, facts, experiences, and distilled conversation content, but it does not warn that sensitive personal data may be retained. That omission can lead users or operators to store private information without informed consent, creating privacy, retention, and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented cloud mode uses the MiniMax API, but the skill does not disclose that conversation text, distilled memories, or search-related content may be sent to an external provider. In a memory skill, this context makes the omission more dangerous because the transmitted data is likely to include persistent, user-specific, and potentially sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The distillation tool accepts arbitrary conversation messages and forwards them to client.distill(), while plugin configuration explicitly supports API and local LLM modes. That means sensitive user conversation content may be processed by an external model endpoint without any notice, consent boundary, redaction, or data-minimization controls, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a semantic memory layer for learning facts, searching context, maintaining persona, and extracting memories from conversations. The andrew_memory_regenerate_vectors tool performs backend reindexing/model-migration maintenance rather than a user-facing memory capability, making it an unjustified extra capability relative to the stated purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded external MiniMax domain confirms third-party transmission rather than purely local processing. In a long-term memory component, this increases data exposure risk because users and integrators may reasonably expect memory storage/search to stay local unless clearly stated otherwise.

Content

Scanner excerpt · src/MemoryClient.js (reported line 77)May include surrounding context.

js
// API mode: MiniMax
        try {
            const response = await fetch('https://api.minimaxi.com/v1/embeddings', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded external MiniMax domain confirms third-party transmission rather than purely local processing. In a long-term memory component, this increases data exposure risk because users and integrators may reasonably expect memory storage/search to stay local unless clearly stated otherwise.

Content

Scanner excerpt · src/MemoryClient.js (reported line 77)May include surrounding context.

js
// API mode: MiniMax
        try {
            const response = await fetch('https://api.minimaxi.com/v1/embeddings', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The client sends arbitrary memory/query text to a third-party embedding API, and the same file later sends conversation content to an external LLM for distillation. In a memory layer, this text is likely to contain long-term user facts, identity data, and prior conversation context, so undisclosed exfiltration to an external service creates a real confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The hard-coded prompt instructs the model in Chinese and implicitly constrains the skill's behavior to a specific language. There is no opt-in, language selection mechanism, or documented reason for enforcing this locale.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded MiniMax messages endpoint indicates conversation content can leave the local environment for processing. Given this skill manages identity and distilled memories, the context amplifies risk because uploaded content is likely more persistent and sensitive than ordinary prompts.

Content

Scanner excerpt · src/MemoryClient.js (reported line 318)May include surrounding context.

js
}

        try {
            const response = await fetch('https://api.minimaxi.com/anthropic/v1/messages', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded MiniMax messages endpoint indicates conversation content can leave the local environment for processing. Given this skill manages identity and distilled memories, the context amplifies risk because uploaded content is likely more persistent and sensitive than ordinary prompts.

Content

Scanner excerpt · src/MemoryClient.js (reported line 318)May include surrounding context.

js
}

        try {
            const response = await fetch('https://api.minimaxi.com/anthropic/v1/messages', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency uses a caret range (^0.27.1), which allows automatic installation of newer compatible versions rather than a single audited release. This increases supply-chain risk because a compromised upstream release or breaking security change could be pulled into the skill without explicit review; in a memory-layer skill that stores and retrieves long-term agent data, a malicious dependency could access sensitive conversation history or corrupt memory behavior.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
"extensions": ["./index.js"]
  },
  "dependencies": {
    "@lancedb/lancedb": "^0.27.1"
  }
}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The client reads MINIMAX_API_KEY from the environment, which is a sensitive credential access pattern covered by the warning requirement for code files. There is no nearby comment, docstring, or user-facing notice explaining that the skill depends on and accesses this credential.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/MemoryClient.js:33