ClawHub
Back to skill

Security audit

Smara Memory

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate memory integration, but it needs review because it can automatically store and retrieve user facts with an external service without clear consent or sensitivity limits.

Install only if users understand that memories are stored with Smara and you have clear rules for what may be saved. Avoid storing secrets, credentials, health, financial, or other sensitive personal data by default; use a scoped or revocable API key; require explicit user consent for persistence; and define how users can review and delete stored memories.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The skill encourages use in broad, ordinary conversations and explicitly tells the agent to persist facts after conversations, but it does not define consent, minimization, or category limits for what may be stored. In a memory skill, this materially increases the chance that agents will save unnecessary or sensitive user information to a third-party service without clear user awareness.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill is centered on persistent collection, retrieval, and deletion of user data via an external API, yet it provides no privacy notice, consent guidance, sensitivity restrictions, or retention/deletion policy. Because the skill's purpose is cross-conversation memory, the absence of these safeguards makes misuse and privacy harm substantially more likely than in a normal stateless integration.

External Transmission

Medium
Category
Data Exfiltration
Content
### Store a memory

```bash
curl -X POST https://api.smara.io/v1/memories \
  -H "Authorization: Bearer $SMARA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
91% confidence
Finding
This example sends user facts to an external Smara API, which is an actual outbound data transfer of potentially personal information. The risk is not the mere existence of HTTPS calls, but that the skill instructs agents to transmit learned user context to a third party without embedded consent and sensitivity checks.

External Transmission

Medium
Category
Data Exfiltration
Content
### Store a memory

```bash
curl -X POST https://api.smara.io/v1/memories \
  -H "Authorization: Bearer $SMARA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
91% confidence
Finding
This example sends user facts to an external Smara API, which is an actual outbound data transfer of potentially personal information. The risk is not the mere existence of HTTPS calls, but that the skill instructs agents to transmit learned user context to a third party without embedded consent and sensitivity checks.

External Transmission

Medium
Category
Data Exfiltration
Content
### Search memories

```bash
curl "https://api.smara.io/v1/memories/search?user_id=user_id_here&query=editor+preferences&limit=5" \
  -H "Authorization: Bearer $SMARA_API_KEY"
```
Confidence
85% confidence
Finding
Searching memories sends user identifiers and query context to the external service, which can expose user profile information and conversational intent to a third party. In this skill, searches are recommended 'before responding,' making routine background transmission more likely and broadening privacy exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
### Get full user context

```bash
curl "https://api.smara.io/v1/users/user_id_here/context" \
  -H "Authorization: Bearer $SMARA_API_KEY"
```
Confidence
90% confidence
Finding
Fetching full user context from an external API can aggregate and expose a broad set of historical user data in one request. Because the endpoint is specifically for full context, compromise or misuse could reveal more information than a narrow point lookup, increasing privacy and profiling risk.

Static analysis

No suspicious patterns detected.